# changelog

author: majianhan <majianhan@kylinos.cn> - 5.2.4-13
changelog:
  - Type:CVE
  - CVE:CVE-2025-2752 CVE-2025-2754 CVE-2025-2755 CVE-2025-2756 CVE-2025-5200 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204
  - SUG:NA
  - DESC:fix CVE-2025-2752 CVE-2025-2754 CVE-2025-2755 CVE-2025-2756 CVE-2025-5200 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204


author: happyworker <208suo@208suo.com> - 4.2.4-23
changelog:
  - Fix CVE-2020-22026/CVE-2020-22019/CVE-2020-22021/CVE-2020-22038/CVE-2020-22039/CVE-2020-22044/CVE-2020-22043


author: happyworker <208suo@208suo.com> - 4.2.4-24
changelog:
  - Fix CVE-2021-38090/CVE-2020-21697/CVE-2020-22042/CVE-2020-21688/CVE-2020-22037/CVE-2020-22051/CVE-2020-22020/CVE-2025-22921/CVE-2025-22919


author: weidongkl <weidong@kylinsec.com.cn> - 4.2.4-25
changelog:
  - Type: CVE
  - CVE: CVE-2020-22017
  - SUG: NA
  - DESC: fix heap buffer overflow in avfilter/vf_datascope.c


author: weidongkl <weidong@kylinsec.com.cn> - 4.2.4-26
changelog:
  - Type: CVE
  - CVE: CVE-2020-20451
  - SUG: NA
  - DESC: fix memory leak in open_files when parsing options fails


author: weidongkl <weidong@kylinsec.com.cn> - 4.2.4-27
changelog:
  - Type: CVE
  - CVE: CVE-2020-22029
  - SUG: NA
  - DESC: fix overreads in gauss array in libavfilter/vf_colorconstancy.c


author: weidongkl <weidong@kylinsec.com.cn> - 4.2.4-28
changelog:
  - Type: CVE
  - CVE: CVE-2020-22025
  - SUG: NA
  - DESC: check if height is big enough in gaussian_blur to prevent heap buffer overflow


author: Qingqing Li <liqingqing3@huawei.com> - 2.34-176
changelog:
  - libio: Fix ungetwc operating on byte stream [BZ #33998] (CVE-2026-5928)
  - stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] (CVE-2026-5450)


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-308.0.0.211
changelog:
  - !21578  apparmor: fix unprivileged local user can do privileged policy management
  - !21574  ksmbd: Compare MACs in constant time
  - apparmor: fix unprivileged local user can do privileged policy management
  - !21498  ALSA: usb-audio: Use correct version for UAC3 header validation
  - ksmbd: Compare MACs in constant time
  - !21232 [Hygon][5.10][Feature] spi: dw: Add device HID for Hygon SPI controller
  - !21518  KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
  - !21489  cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_sample()
  - !21455  time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - !21172 [OLK-5.10] Hygon: Update ccp-crypto driver, to support SM4-XTS/GCM and model 10h cpu
  - !21189 [Hygon][5.10][Feature] perf/x86/uncore: Add DF PMU support for Hygon family 18h model 18h
  - !21201 [Hygon][5.10][Feature] hwmon/k10temp: Add support for Hygon family 18h model 18h
  - !21233 [Hygon][5.10][Feature]mmc: sdhci-pci: Add support for Hygon SD controller
  - !21202 [Hygon][5.10][Feature] iommu/hygon: Add support for Hygon family 18h model 18h IOAPIC
  - !21203 [Hygon][5.10][Feature] ALSA: hda: Add support for Hygon family 18h model 18h HD-Audio
  - !21204 [Hygon][5.10][Feature] EDAC/amd64: Add support for Hygon family 18h model 18h
  - !21186 [Hygon][5.10][Feature] x86/amd_nb: Add Hygon family 18h model 18h PCI IDs
  - !21234 [Hygon][5.10][Feature] mmc: sdhci-acpi: Add device HID for Hygon eMMC controller
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
  - spi: dw: Add device HID for Hygon SPI controller
  - !21501 v2  net: usb: pegasus: validate USB endpoints
  - !21467  mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - net: usb: pegasus: validate USB endpoints
  - EDAC/amd64: Add support for Hygon family 18h model 18h
  - ALSA: usb-audio: Use correct version for UAC3 header validation
  - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_sample()
  - !21460  xfs: fix internal error from AGFL exhaustion
  - anolis: mmc: sdhci-acpi: Add device HID for Hygon eMMC controller
  - mmc: sdhci-pci: Add support for Hygon SD controller
  - ALSA: hda: Add support for Hygon family 18h model 18h HD-Audio
  - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - hwmon/k10temp: Add support for Hygon family 18h model 18h
  - iommu/hygon: Add support for Hygon family 18h model 18h IOAPIC
  - perf/x86/uncore: Add DF PMU support for Hygon family 18h model 18h
  - x86/amd_nb: Add Hygon family 18h model 18h PCI IDs
  - xfs: fix internal error from AGFL exhaustion
  - time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - crypto: ccp: fix build issue like redefined RI_XXX_PRESENT
  - crypto: ccp: SM2 ccp encryption support Hygon model 10h
  - crypto: ccp: check if ccp supports sm4-xts/sm4-gcm
  - crypto: ccp: Optimize sm4-gcm algorithm for hygon ccp.
  - crypto: ccp: sm4-xts crypto support data not aligned to 16 bytes
  - crypto: ccp: Support SM4-XTS for hygon ccp
  - crypto: ccp: Support SM4-GCM for hygon ccp


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-309.0.0.212
changelog:
  - !20937 [OLK-5.10] Fix CVE-2025-39788
  - !20902 [OLK-5.10] Fix CVE-2023-53194
  - !20866 [OLK-5.10] Fix CVE-2025-39738
  - !20675 [OLK-5.10] Fix CVE-2025-40205
  - !20599 [OLK-5.10] fix CVE-2025-38476
  - !20611 【OLK-5.10】fix CVE-2025-39794
  - !20838 [OLK-5.10] fix CVE-2022-50518
  - !21749  fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
  - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
  - !21724 RDMA/hns: Support setting GSI QP SL
  - !21590  x86/uprobes: Fix XOL allocation failure for 32-bit tasks
  - !21595  pstore/ram: fix buffer overflow in persistent_ram_save_old()
  - !21708  nfsd: provide locking for v4_end_grace
  - !21469 [Hygon][5.10][Feature]EDAC/amd64: Adjust the maximum number of memory controllers
  - !20238 Fix CVE-2025-68724
  - !21728  media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - !21716  apparmor: validate DFA start states are in bounds in unpack_pdb
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - apparmor: validate DFA start states are in bounds in unpack_pdb
  - nfsd: provide locking for v4_end_grace
  - !21700 RDMA/hns: Fix the panic caused by a large number of print
  - RDMA/hns: Support setting GSI QP SL
  - RDMA/hns: Fix missing CQE when UD QP use different SL
  - RDMA/hns: Fix hung task when drain qp failed.
  - RDMA/hns: Fix the panic caused by a large number of print
  - RDMA/hns: Delete unused bit_size param
  - !21601 Fix CVE-2026-31408
  - !21597 Fix CVE-2026-31393
  - !21673  apparmor: fix race between freeing data and fs accessing it
  - !21603  ice: Fix memory leak in ice_set_ringparam()
  - !21381  bonding: fix use-after-free due to enslave fail after slave array update
  - !21335 Fix CVE-2025-68813
  - apparmor: fix race between freeing data and fs accessing it
  - !21660  apparmor: fix race on rawdata dereference
  - !21647  CVE-2025-39955
  - !21642 Fix CVE-2026-23407
  - !21653  PM: runtime: Fix a race condition related to device removal
  - !21640 Fix CVE-2026-23406
  - !20550 [OLK-5.10] Fix CVE-2022-50300
  - !21620  Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue
  - apparmor: fix race on rawdata dereference
  - !21497  bus: fsl-mc: fix use-after-free in driver_override_show()
  - !21631 Fix CVE-2026-23408
  - PM: runtime: Fix a race condition related to device removal
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
  - !21614  apparmor: replace recursive profile removal with iterative approach
  - !21495  *** fix CVE-2026-23208 ***
  - !21615  apparmor: fix: limit the number of levels of policy namespaces
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  - apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
  - apparmor: fix side-effect bug in match_char() macro usage
  - apparmor: Fix double free of ns_name in aa_replace_profiles()
  - xen/privcmd: add boot control for restricted usage in domU
  - xen/privcmd: unregister xenstore notifier on module exit
  - xen/privcmd: restrict usage in unprivileged domU
  - apparmor: fix: limit the number of levels of policy namespaces
  - apparmor: replace recursive profile removal with iterative approach
  - ice: Fix memory leak in ice_set_ringparam()
  - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  - pstore/ram: fix buffer overflow in persistent_ram_save_old()
  - x86/uprobes: Fix XOL allocation failure for 32-bit tasks
  - EDAC/amd64: Adjust the maximum number of memory controllers per node to 1 for Hygon family 18h model 18h
  - bus: fsl-mc: fix use-after-free in driver_override_show()
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames
  - bonding: fix use-after-free due to enslave fail after slave array update
  - ipvs: fix ipv4 null-ptr-deref in route error path
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
  - parisc: Fix locking in pdc_iodc_print() firmware call
  - fs/ntfs3: Add length check in indx_get_root
  - btrfs: do not allow relocation of partially dropped subvolumes
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  - ARM: tegra: Use I/O memcpy to write to IRAM
  - rpl: Fix use-after-free in rpl_do_srh_inline().
  - btrfs: fix extent map use-after-free when handling missing device in read_one_chunk


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-310.0.0.213
changelog:
  - !21832  smb: client: fix krb5 mount with username option
  - !21838  ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
  - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
  - smb: client: fix krb5 mount with username option
  - !21801 Fix CVE-2026-23450
  - !21800 Fix CVE-2025-71078
  - !21505 crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - !21811 RDMA/hns: Fix warning in poll cq direct mode
  - !21758  nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  - RDMA/hns: Fix warning in poll cq direct mode
  - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
  - powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - !21766  Fix CVE-2026-23271
  - perf: Fix Wdeclaration-after-statement
  - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  - crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - crypto: hisilicon/qm - add concurrency protection for variable err_threshold


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-311.0.0.214
changelog:
  - !22036 drivers:misc:sdma-dae: Write the CQ head pointer correctly.
  - drivers:misc:sdma-dae: Write the CQ head pointer correctly.
  - !21966  netfilter: nf_tables: unconditionally bump set->nelems before insertion
  - !21965  net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
  - !21968  netfilter: xt_CT: drop pending enqueued packets on template removal
  - !21967  netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  - !21964  netfilter: Fix CVE-2026-23351
  - !21963 v2  bonding: limit BOND_MODE_8023AD to Ethernet devices
  - !21983 Fix CVE-2026-23383
  - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
  - netfilter: xt_CT: drop pending enqueued packets on template removal
  - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  - netfilter: nf_tables: unconditionally bump set->nelems before insertion
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
  - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
  - netfilter: nf_tables: de-constify set commit ops function argument
  - bonding: limit BOND_MODE_8023AD to Ethernet devices
  - !21936 drivers:misc:sdma-dae: Remove interference print.
  - drivers:misc:sdma-dae: Remove interference print.
  - !21901 [Hygon][5.10][bugfix] Fix switch_kernel_fpu_prepare in Hygon non-atomic NT copy path
  - !21896 driver/misc/sdma-dae:Resolve conflicts between NCOB and SDMA
  - drivers:misc:sdma-dae: Checking the address alignment
  - !21897 Fix CVE-2026-31473
  - x86/fpu: fix wrong thread_flag check in switch_kernel_fpu_prepare
  - x86/copy_user_avx2: add sfence before vzeroupper in fixup path
  - !21877 net: hns3: Clear the static alarm about 'implicit type conversion'
  - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
  - net: hns3: Clear the static alarm about 'implicit type conversion'
  - net: hns3: Clear the static alarm about 'no previous prototype'
  - net: hns3: Clear the static alarm about discarding the 'const' qualifier
  - net: hns3: set the freed pointer to NULL
  - net: hns3: fix wrong location of HCLGE_FD_AD_QID_H_B


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-312.0.0.215
changelog:
  - !22139  Fix CVE-2026-31431
  - crypto: algif_aead - Fix minimum RX size check for decryption
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
  - crypto: authencesn - Fix src offset when decrypting in-place
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
  - crypto: authenc - use memcpy_sglist() instead of null skcipher
  - crypto: algif_aead - snapshot IV for async AEAD requests
  - crypto: algif_aead - Revert to operating out-of-place
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  - crypto: scatterwalk - Backport memcpy_sglist()
  - crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  - !22064 CVE-2026-31504
  - !22058 CVE-2026-31515
  - !22007 Fix CVE-2026-31677
  - crypto: af_alg - limit RX SG extraction by receive buffer budget
  - net: fix fanout UAF in packet_release() via NETDEV_UP race
  - !21871 [Hygon][5.10][Feature] pwm: dwc: Add support for Hygon pwm controller
  - !21982 Backport the patch that fix whitespace in sev_cmd_buffer_len() from upstream.
  - af_key: validate families in pfkey_send_migrate()
  - crypto: ccp - Fix whitespace in sev_cmd_buffer_len()
  - pwm: dwc: Add support for Hygon pwm controller
  - openeuler_defconfig: Add CONFIG_PWM_DWC
  - pwm: Add DesignWare PWM Controller Driver


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-313.0.0.216
changelog:
  - !22057 Fix CVE-2026-31590
  - !21943 Fix CVE-2026-31450
  - !21988  Fix CVE-2026-31449
  - !21118 [OLK-5.10] Fix CVE-2025-68340
  - !22045  ALSA: ctxfi: Limit PTP to a single page
  - !22100  KVM: x86: Use scratch field in MMIO fragment to hold small write values
  - !21944  media: dvb-net: fix OOB access in ULE extension header tables
  - !22099 Fix CVE-2026-31678
  - !22070 CVE-2026-31673
  - !22068 CVE-2026-31674
  - !22067 CVE-2026-31680
  - !22065 CVE-2026-31682
  - !22073 CVE-2026-31570
  - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
  - KVM: x86: Use scratch field in MMIO fragment to hold small write values
  - openvswitch: defer tunnel netdev_put to RCU release
  - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
  - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
  - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
  - bridge: br_nd_send: linearize skb before parsing ND options
  - ALSA: ctxfi: Limit PTP to a single page
  - ext4: validate p_idx bounds in ext4_ext_correct_indexes
  - ext4: prevent partial update of the extents path
  - ext4: refactor ext4_ext_rm_idx() to index 'path'
  - media: dvb-net: fix OOB access in ULE extension header tables
  - ext4: publish jinode after initialization
  - team: Move team device type change at the end of team_port_add


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-314.0.0.217
changelog:
  - !22409  CVE
  - !22408  *** fix CVE-2026-31527 ***
  - !22423  ALSA: ctxfi: Check the error for index mapping
  - ALSA: ctxfi: Check the error for index mapping
  - !22405  dmaengine: idxd: Fix not releasing workqueue on .release()
  - !22389  Fix CVE-2025-38680
  - !22373  fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - HID: core: Mitigate potential OOB by removing bogus memset()
  - HID: core: Add printk_ratelimited variants to hid_warn() etc
  - HID: multitouch: Check to ensure report responses match the request
  - Bluetooth: MGMT: validate LTK enc_size on load
  - driver/core: Fix kabi broken of platform_device/device/bus_type
  - driver core: platform: use generic driver_override infrastructure
  - hwmon: axi-fan: don't use driver_override as IRQ name
  - driver core: generalize driver_override in struct device
  - !22299  ALSA: fireworks: bound device-supplied status before string array lookup
  - dmaengine: idxd: Fix not releasing workqueue on .release()
  - !22354  Bluetooth: SMP: derive legacy responder STK authentication from MITM state
  - !22337  HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
  - !22273  EFI/CPER: don't dump the entire memory region
  - !22366  Input: uinput - fix circular locking dependency with ff-core
  - !22344  rxrpc: proc: size address buffers for %pISpc output
  - !22357  dmaengine: idxd: Fix memory leak when a wq is reset
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - !22328  ALSA: caiaq: fix stack out-of-bounds read in init_card
  - !22279 Fix CVE-2026-31699
  - !22277  crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
  - Input: uinput - fix circular locking dependency with ff-core
  - dmaengine: idxd: Fix memory leak when a wq is reset
  - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
  - rxrpc: proc: size address buffers for %pISpc output
  - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
  - !22297 Fix CVE-2026-23317
  - !20491  scsi: leapraid: add RAID disk hide/show events and fix misc issues
  - ALSA: caiaq: fix stack out-of-bounds read in init_card
  - !22303  module: Fix kernel panic when a symbol st_shndx is out of bounds
  - !22318  drm/ioc32: stop speculation on the drm_compat_ioctl path
  - !22231 Revert "[cpufreq]Fix re-boost issue after hotplugging a CPU"
  - !22230  cpufreq: conservative: Reset requested_freq on limits change
  - drm/ioc32: stop speculation on the drm_compat_ioctl path
  - !22293 Fix CVE-2026-43407
  - module: Fix kernel panic when a symbol st_shndx is out of bounds
  - ALSA: fireworks: bound device-supplied status before string array lookup
  - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
  - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
  - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
  - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
  - !22225  bpf: Fix regsafe() for pointers to packet
  - !22263 CVE-2026-31419
  - !22237 Fix CVE-2026-31697
  - EFI/CPER: don't dump the entire memory region
  - !21864 Backport the patch that add support for SEV attestation command
  - bonding: remove unused bond_is_first_slave and bond_is_last_slave macros
  - net: bonding: fix use-after-free in bond_xmit_broadcast()
  - bonding: do not set usable_slaves for broadcast mode
  - net: bonding: update the slave array for broadcast mode
  - !22132 Ethernet: Linkdata: Supports Linkdata ethernet Controllers
  - !22253 [OLK-5.10] Fix CVE-2026-43284
  - Ethernet: Linkdata: Supports Linkdata ethernet Controllers
  - xfrm: esp: avoid in-place decrypt on shared skb frags
  - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
  - Revert "[cpufreq]Fix re-boost issue after hotplugging a CPU"
  - cpufreq: conservative: Reset requested_freq on limits change
  - bpf: Fix regsafe() for pointers to packet
  - !22214  futex: Clear stale exiting pointer in futex_lock_pi() retry path
  - !22205  pstore: ram_core: fix incorrect success return when vmap() fails
  - !22207  perf/x86/intel/uncore: Skip discovery table for offline dies
  - !22211  usb: cdns3: gadget: fix state inconsistency on gadget init failure
  - !22216  x86/CPU: Fix FPDSS on Zen1
  - !22186 Fix CVE-2026-31679
  - x86/CPU: Fix FPDSS on Zen1
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path
  - usb: cdns3: gadget: fix state inconsistency on gadget init failure
  - !22174 Fix CVE-2026-31592
  - !22094  NFSD: Defer sub-object cleanup in export put callbacks
  - !22102  NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
  - !21933  ksmbd: do not expire session on binding failure
  - !21927  nvme-pci: ensure we're polling a polled queue
  - !21925  ext4: avoid infinite loops caused by residual data
  - !22169  xen/privcmd: fix double free via VMA splitting
  - !22168  Buffer overflow in drivers/xen/sys-hypervisor.c
  - !22163  spi: spi-dw-dma: fix print error log when wait finish transaction
  - perf/x86/intel/uncore: Skip discovery table for offline dies
  - pstore: ram_core: fix incorrect success return when vmap() fails
  - openvswitch: validate MPLS set/set_masked payload length
  - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
  - xen/privcmd: fix double free via VMA splitting
  - Buffer overflow in drivers/xen/sys-hypervisor.c
  - spi: spi-dw-dma: fix print error log when wait finish transaction
  - KVM/SVM: add support for SEV attestation command
  - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
  - NFSD: Defer sub-object cleanup in export put callbacks
  - ksmbd: do not expire session on binding failure
  - nvme-pci: ensure we're polling a polled queue
  - ext4: avoid infinite loops caused by residual data
  - scsi: leapraid: add RAID disk hide/show events and fix misc issues


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-315.0.0.218
changelog:
  - !22654 Fix CVE-2026-23395
  - !22674  *** Fix CVE-2026-43428 ***
  - USB: core: Limit the length of unkillable synchronous timeouts
  - USB: usbcore: Introduce usb_bulk_msg_killable()
  - !22476 Fix CVE-2026-43427
  - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  - !22533  usb: xhci: Prevent interrupt storm on host controller error (HCE)
  - !22553 net/oenetcls: free sk entry hash on ntuple cleanup
  - !22565 Fix CVE-2026-43212
  - !22562 Fix CVE-2026-43261
  - !22532 net/oenetcls: RPS enhancements and bug fixes
  - !22183 Fix CVE-2026-31755
  - !22569  Fix CVE-2026-31477
  - ksmbd: fix memory leaks and NULL deref in smb2_lock()
  - ksmbd: use F_SETLK when unlocking a file
  - !22528  ksmbd: validate EaNameLength in smb2_get_ea()
  - !22526  ksmbd: require 3 sub-authorities before reading sub_auth[2
  - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE
  - !22552  CVE-2026-46333
  - arm64: Add support for TSV110 Spectre-BHB mitigation
  - net/oenetcls: free sk entry hash on ntuple cleanup
  - ptrace: Fix kabi breakage in struct task_struct
  - ptrace: slightly saner 'get_dumpable()' logic
  - usb: xhci: Prevent interrupt storm on host controller error (HCE)
  - net/oenetcls: fix mode-0 init rollback for ntuple resources
  - net/oenetcls: fix RPS CPU index scaling bias
  - !22488  ksmbd: require minimum ACE size in smb_check_perm_dacl()
  - !22499  ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
  - !22477  smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
  - ksmbd: validate EaNameLength in smb2_get_ea()
  - ksmbd: require 3 sub-authorities before reading sub_auth[2]
  - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
  - !22358 linkdata: fix compile error
  - ksmbd: require minimum ACE size in smb_check_perm_dacl()
  - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
  - usb: class: cdc-wdm: fix reordering issue in read code path
  - !22403  x86: fix duplicate ret variable in copy_user_generic
  - Linkdata: fix build failure due to missing IPsec configs in defconfig
  - net/oenetcls: Limit rxqs against combined_channels
  - net/oenetcls: Add rps policy switch for phy NIC
  - net/oenetcls: Make OENETCLS default as module
  - net/oenetcls: Support ipv6 for ntuple mode
  - net/oenetcls: Supports rxq multiplexing
  - net/oenetcls: Add local flow NUMA-aware rps
  - net/oenetcls: Fix possible hash collision issue
  - !22410  Bluetooth: hci_event: move wake reason storage into validated event handlers
  - !22191 Fix CVE-2026-31447
  - Bluetooth: hci_event: move wake reason storage into validated event handlers
  - x86: fix duplicate ret variable in copy_user_generic
  - ext4: reject mount if bigalloc with s_first_data_block != 0
  - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-316.0.0.219
changelog:
  - !22869  tracing/probe: reject non-closed empty immediate strings
  - !22863  tracing: branch: Fix inverted check on stat tracer registration
  - !22609  Fix CVE-2026-31729
  - !22130 [Hygon][5.10][Feature] KVM: x86: Add support for CPUID leaf 0x8C860000
  - !21989 Support Hygon CSV2 VM Live Migration
  - !22771 Fix CVE-2026-43037
  - !22769 Fix CVE-2026-43038
  - !22767 Fix CVE-2026-43040
  - !22856  crypto: pcrypt - Fix handling of MAY_BACKLOG requests
  - tracing/probe: reject non-closed empty immediate strings
  - tracing: branch: Fix inverted check on stat tracer registration
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
  - !22814 ipmi: hisi_pso: fix atomic sleep and use-after-free via async workqueue
  - !22466 net/hinic5: Add Huawei Intelligent Network Card Driver: hinic5
  - net/hinic5: Add Huawei Intelligent Network Card Driver: hinic5
  - ipmi: hisi_pso: fix atomic sleep and use-after-free via async workqueue
  - !22770  tracepoints: get correct superblock from dentry in event btrfs_sync_file()
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
  - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
  - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
  - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
  - !22684  mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
  - !22726  Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
  - !22647 [OLK-5.10] Fix CVE-2026-31668
  - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
  - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
  - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  - net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
  - net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
  - net: ipv6: rpl_iptunnel: simplify the return expression of rpl_do_srh()
  - include: net: add static inline dst_dev_overhead() to dst.h
  - net: use indirect call helpers for dst_output
  - net: use indirect call helpers for dst_input
  - net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
  - net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
  - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
  - usb: typec: ucsi: skip connector validation before init
  - usb: typec: ucsi: validate connector number in ucsi_notify_common()
  - KVM: SVM: Unmap ghcb pages if they're still mapped when destroy a CSV2 guest
  - KVM: SVM: Export MSR_AMD64_SEV_ES_GHCB to userspace for CSV2 guest
  - KVM: x86: Restore control registers in __set_sregs() to support CSV2 guest live migration
  - KVM: SVM: Keep track EFER even though the VM is CSV2 guest
  - KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_VMSA command
  - KVM: SVM: Add KVM_SEV_SEND_UPDATE_VMSA command
  - KVM: x86: Add support for CPUID leaf 0x8C860000


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-317.0.0.220
changelog:
  - !23420  fbcon: Fix the issue of uninitialized charcount in the remaining consoles
  - !23423 soc: hisilicon: kunpeng_hccs: Remove unused input parameter
  - soc: hisilicon: kunpeng_hccs: Remove unused input parameter
  - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier
  - fbcon: Fix the issue of uninitialized charcount in the remaining consoles
  - !23389  CVE-2026-46181
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
  - refcount: provide ops for cases when object's memory can be reused
  - !23311  sched/cputime: Fix time overflow in cputime_adjust()
  - !23122 Fix CVE-2026-45856
  - !23327 Fix CVE-2026-43466
  - !23329 Fix CVE-2026-46033
  - crypto: authencesn - reject short ahash digests during instance creation
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
  - sched/cputime: Fix time overflow in cputime_adjust()
  - !23253  CVE-2026-31759
  - !23268 Fix CVE-2026-46151
  - !23270 Fix CVE-2026-46167
  - !23275 Fix CVE-2026-46187
  - !23245 Fix CVE-2026-46214
  - !23202  ceph: only d_add() negative dentries when they are unhashed
  - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
  - !23173  thermal: core: Fix thermal zone governor cleanup issues
  - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
  - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
  - usb: ulpi: fix memory leak on ulpi_register() error paths
  - usb: ulpi: fix double free in ulpi_register_interface() error path
  - vsock/virtio: fix accept queue count leak on transport mismatch
  - !23189  Fix CVE-2026-45984
  - ceph: only d_add() negative dentries when they are unhashed
  - gfs2: Fix use-after-free in iomap inline data write path
  - gfs2: Add metapath_dibh helper
  - gfs2: Move the inode glock locking to gfs2_file_buffered_write
  - gfs2: Add wrapper for iomap_file_buffered_write
  - gfs2: Replace gfs2_lblk_to_dblk with gfs2_get_extent
  - gfs2: Turn gfs2_extent_map into gfs2_{get,alloc}_extent
  - gfs2: Add new gfs2_iomap_get helper
  - !22991 Fix CVE-2026-43194
  - !23124  cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
  - thermal: core: Fix thermal zone governor cleanup issues
  - !23016  CVE-2026-45968
  - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
  - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
  - !23069  tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
  - !23035  CVE-2026-43328
  - !23029  Bluetooth: SMP: force responder MITM requirements before building the pairing response
  - !23063  s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
  - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
  - !22881 Fix CVE-2026-43503
  - !22871 Fix CVE-2026-46300
  - s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
  - !22782  apei: use blocking notifier for page offline policy chain
  - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
  - cpufreq: governor: Free dbs_data directly when gov->init() fails
  - Bluetooth: SMP: force responder MITM requirements before building the pairing response
  - sched: idle: Make skipping governor callbacks more consistent
  - cpuidle: Skip governor when only one idle state is available
  - !22900  scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
  - !22845  net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
  - !22956 net/oenetcls: remove HISI_L0 dependency and L0 allocator usage
  - !22701 net/oenetcls: validate module params and reject zero table sizes
  - !22939 oenetcls: fix worker-context locking, async add/del race, and runtime policy toggles
  - !22650 Backport the patch that rename sev-es.{ch} to sev.{ch} from upstream
  - net: consume xmit errors of GSO frames
  - !22943  drm: Account property blob allocations to memcg
  - !22888  lib/crypto: chacha: Zeroize permuted_state before it leaves scope
  - net/oenetcls: remove HISI_L0 dependency and L0 allocator usage
  - drm: Account property blob allocations to memcg
  - net/oenetcls: make rps policy module params read-only
  - net/oenetcls: fix async delete race with pending rule add
  - net/oenetcls: move listen-time tuple resolution to worker context
  - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
  - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
  - net: skbuff: preserve shared-frag marker during coalescing
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
  - net/oenetcls: validate module params and reject zero table sizes
  - apei: use blocking notifier for page offline policy chain
  - x86/sev-es: Rename sev-es.{ch} to sev.{ch}


author: xinghe <xingheyd@163.com> - 4.17.5-15
changelog:
  - Type:cves
  - ID:CVE-2026-3238 CVE-2026-3012 CVE-2026-4480 CVE-2026-4408
  - SUG:NA
  - DESC:fix CVE-2026-3238 CVE-2026-3012 CVE-2026-4480 CVE-2026-4408


author: wjiang <app@cameyan.com> - 249-108
changelog:
  - backport community patches:
        backport-login-user-runtime-dir-free-ignored-sd_bus_error-avo.patch
        backport-login-user-runtime-dir-use-STRLEN-where-appropriate.patch
        backport-systemctl-gracefully-adjust-bus-transport-and-runtim.patch
        backport-journal-do-not-rotate-journal-when-MaxRetentionSec-i.patch
        backport-compress-avoid-a-bunch-of-div-by-zeroes.patch


author: yixiangzhike <yixiangzhike007@163.com> - 249-110
changelog:
  - fix coredump generation when systemd-resolved and systemd-networkd service is started then uninstalled


author: gaihuiying <eaglegai@163.com> - 1.13.2-21
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: gaihuiying <eaglegai@163.com> - 1.13.2-22
changelog:
  - Type:cves
  - CVE:CVE-2026-33278,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960
  - SUG:NA
  - DESC:fix CVE-2026-33278,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960


author: gaihuiying <eaglegai@163.com> - 1.13.2-23
changelog:
  - Type:cves
  - CVE:CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390
  - SUG:NA
  - DESC:fix CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390


