# changelog

author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-312.0.0.215
changelog:
  - !22139  Fix CVE-2026-31431
  - crypto: algif_aead - Fix minimum RX size check for decryption
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
  - crypto: authencesn - Fix src offset when decrypting in-place
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
  - crypto: authenc - use memcpy_sglist() instead of null skcipher
  - crypto: algif_aead - snapshot IV for async AEAD requests
  - crypto: algif_aead - Revert to operating out-of-place
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  - crypto: scatterwalk - Backport memcpy_sglist()
  - crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  - !22064 CVE-2026-31504
  - !22058 CVE-2026-31515
  - !22007 Fix CVE-2026-31677
  - crypto: af_alg - limit RX SG extraction by receive buffer budget
  - net: fix fanout UAF in packet_release() via NETDEV_UP race
  - !21871 [Hygon][5.10][Feature] pwm: dwc: Add support for Hygon pwm controller
  - !21982 Backport the patch that fix whitespace in sev_cmd_buffer_len() from upstream.
  - af_key: validate families in pfkey_send_migrate()
  - crypto: ccp - Fix whitespace in sev_cmd_buffer_len()
  - pwm: dwc: Add support for Hygon pwm controller
  - openeuler_defconfig: Add CONFIG_PWM_DWC
  - pwm: Add DesignWare PWM Controller Driver


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-313.0.0.216
changelog:
  - !22057 Fix CVE-2026-31590
  - !21943 Fix CVE-2026-31450
  - !21988  Fix CVE-2026-31449
  - !21118 [OLK-5.10] Fix CVE-2025-68340
  - !22045  ALSA: ctxfi: Limit PTP to a single page
  - !22100  KVM: x86: Use scratch field in MMIO fragment to hold small write values
  - !21944  media: dvb-net: fix OOB access in ULE extension header tables
  - !22099 Fix CVE-2026-31678
  - !22070 CVE-2026-31673
  - !22068 CVE-2026-31674
  - !22067 CVE-2026-31680
  - !22065 CVE-2026-31682
  - !22073 CVE-2026-31570
  - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
  - KVM: x86: Use scratch field in MMIO fragment to hold small write values
  - openvswitch: defer tunnel netdev_put to RCU release
  - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
  - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
  - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
  - bridge: br_nd_send: linearize skb before parsing ND options
  - ALSA: ctxfi: Limit PTP to a single page
  - ext4: validate p_idx bounds in ext4_ext_correct_indexes
  - ext4: prevent partial update of the extents path
  - ext4: refactor ext4_ext_rm_idx() to index 'path'
  - media: dvb-net: fix OOB access in ULE extension header tables
  - ext4: publish jinode after initialization
  - team: Move team device type change at the end of team_port_add


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-314.0.0.217
changelog:
  - !22409  CVE
  - !22408  *** fix CVE-2026-31527 ***
  - !22423  ALSA: ctxfi: Check the error for index mapping
  - ALSA: ctxfi: Check the error for index mapping
  - !22405  dmaengine: idxd: Fix not releasing workqueue on .release()
  - !22389  Fix CVE-2025-38680
  - !22373  fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - HID: core: Mitigate potential OOB by removing bogus memset()
  - HID: core: Add printk_ratelimited variants to hid_warn() etc
  - HID: multitouch: Check to ensure report responses match the request
  - Bluetooth: MGMT: validate LTK enc_size on load
  - driver/core: Fix kabi broken of platform_device/device/bus_type
  - driver core: platform: use generic driver_override infrastructure
  - hwmon: axi-fan: don't use driver_override as IRQ name
  - driver core: generalize driver_override in struct device
  - !22299  ALSA: fireworks: bound device-supplied status before string array lookup
  - dmaengine: idxd: Fix not releasing workqueue on .release()
  - !22354  Bluetooth: SMP: derive legacy responder STK authentication from MITM state
  - !22337  HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
  - !22273  EFI/CPER: don't dump the entire memory region
  - !22366  Input: uinput - fix circular locking dependency with ff-core
  - !22344  rxrpc: proc: size address buffers for %pISpc output
  - !22357  dmaengine: idxd: Fix memory leak when a wq is reset
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - !22328  ALSA: caiaq: fix stack out-of-bounds read in init_card
  - !22279 Fix CVE-2026-31699
  - !22277  crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
  - Input: uinput - fix circular locking dependency with ff-core
  - dmaengine: idxd: Fix memory leak when a wq is reset
  - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
  - rxrpc: proc: size address buffers for %pISpc output
  - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
  - !22297 Fix CVE-2026-23317
  - !20491  scsi: leapraid: add RAID disk hide/show events and fix misc issues
  - ALSA: caiaq: fix stack out-of-bounds read in init_card
  - !22303  module: Fix kernel panic when a symbol st_shndx is out of bounds
  - !22318  drm/ioc32: stop speculation on the drm_compat_ioctl path
  - !22231 Revert "[cpufreq]Fix re-boost issue after hotplugging a CPU"
  - !22230  cpufreq: conservative: Reset requested_freq on limits change
  - drm/ioc32: stop speculation on the drm_compat_ioctl path
  - !22293 Fix CVE-2026-43407
  - module: Fix kernel panic when a symbol st_shndx is out of bounds
  - ALSA: fireworks: bound device-supplied status before string array lookup
  - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
  - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
  - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
  - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
  - !22225  bpf: Fix regsafe() for pointers to packet
  - !22263 CVE-2026-31419
  - !22237 Fix CVE-2026-31697
  - EFI/CPER: don't dump the entire memory region
  - !21864 Backport the patch that add support for SEV attestation command
  - bonding: remove unused bond_is_first_slave and bond_is_last_slave macros
  - net: bonding: fix use-after-free in bond_xmit_broadcast()
  - bonding: do not set usable_slaves for broadcast mode
  - net: bonding: update the slave array for broadcast mode
  - !22132 Ethernet: Linkdata: Supports Linkdata ethernet Controllers
  - !22253 [OLK-5.10] Fix CVE-2026-43284
  - Ethernet: Linkdata: Supports Linkdata ethernet Controllers
  - xfrm: esp: avoid in-place decrypt on shared skb frags
  - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
  - Revert "[cpufreq]Fix re-boost issue after hotplugging a CPU"
  - cpufreq: conservative: Reset requested_freq on limits change
  - bpf: Fix regsafe() for pointers to packet
  - !22214  futex: Clear stale exiting pointer in futex_lock_pi() retry path
  - !22205  pstore: ram_core: fix incorrect success return when vmap() fails
  - !22207  perf/x86/intel/uncore: Skip discovery table for offline dies
  - !22211  usb: cdns3: gadget: fix state inconsistency on gadget init failure
  - !22216  x86/CPU: Fix FPDSS on Zen1
  - !22186 Fix CVE-2026-31679
  - x86/CPU: Fix FPDSS on Zen1
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path
  - usb: cdns3: gadget: fix state inconsistency on gadget init failure
  - !22174 Fix CVE-2026-31592
  - !22094  NFSD: Defer sub-object cleanup in export put callbacks
  - !22102  NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
  - !21933  ksmbd: do not expire session on binding failure
  - !21927  nvme-pci: ensure we're polling a polled queue
  - !21925  ext4: avoid infinite loops caused by residual data
  - !22169  xen/privcmd: fix double free via VMA splitting
  - !22168  Buffer overflow in drivers/xen/sys-hypervisor.c
  - !22163  spi: spi-dw-dma: fix print error log when wait finish transaction
  - perf/x86/intel/uncore: Skip discovery table for offline dies
  - pstore: ram_core: fix incorrect success return when vmap() fails
  - openvswitch: validate MPLS set/set_masked payload length
  - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
  - xen/privcmd: fix double free via VMA splitting
  - Buffer overflow in drivers/xen/sys-hypervisor.c
  - spi: spi-dw-dma: fix print error log when wait finish transaction
  - KVM/SVM: add support for SEV attestation command
  - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
  - NFSD: Defer sub-object cleanup in export put callbacks
  - ksmbd: do not expire session on binding failure
  - nvme-pci: ensure we're polling a polled queue
  - ext4: avoid infinite loops caused by residual data
  - scsi: leapraid: add RAID disk hide/show events and fix misc issues


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-315.0.0.218
changelog:
  - !22654 Fix CVE-2026-23395
  - !22674  *** Fix CVE-2026-43428 ***
  - USB: core: Limit the length of unkillable synchronous timeouts
  - USB: usbcore: Introduce usb_bulk_msg_killable()
  - !22476 Fix CVE-2026-43427
  - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  - !22533  usb: xhci: Prevent interrupt storm on host controller error (HCE)
  - !22553 net/oenetcls: free sk entry hash on ntuple cleanup
  - !22565 Fix CVE-2026-43212
  - !22562 Fix CVE-2026-43261
  - !22532 net/oenetcls: RPS enhancements and bug fixes
  - !22183 Fix CVE-2026-31755
  - !22569  Fix CVE-2026-31477
  - ksmbd: fix memory leaks and NULL deref in smb2_lock()
  - ksmbd: use F_SETLK when unlocking a file
  - !22528  ksmbd: validate EaNameLength in smb2_get_ea()
  - !22526  ksmbd: require 3 sub-authorities before reading sub_auth[2
  - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE
  - !22552  CVE-2026-46333
  - arm64: Add support for TSV110 Spectre-BHB mitigation
  - net/oenetcls: free sk entry hash on ntuple cleanup
  - ptrace: Fix kabi breakage in struct task_struct
  - ptrace: slightly saner 'get_dumpable()' logic
  - usb: xhci: Prevent interrupt storm on host controller error (HCE)
  - net/oenetcls: fix mode-0 init rollback for ntuple resources
  - net/oenetcls: fix RPS CPU index scaling bias
  - !22488  ksmbd: require minimum ACE size in smb_check_perm_dacl()
  - !22499  ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
  - !22477  smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
  - ksmbd: validate EaNameLength in smb2_get_ea()
  - ksmbd: require 3 sub-authorities before reading sub_auth[2]
  - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
  - !22358 linkdata: fix compile error
  - ksmbd: require minimum ACE size in smb_check_perm_dacl()
  - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
  - usb: class: cdc-wdm: fix reordering issue in read code path
  - !22403  x86: fix duplicate ret variable in copy_user_generic
  - Linkdata: fix build failure due to missing IPsec configs in defconfig
  - net/oenetcls: Limit rxqs against combined_channels
  - net/oenetcls: Add rps policy switch for phy NIC
  - net/oenetcls: Make OENETCLS default as module
  - net/oenetcls: Support ipv6 for ntuple mode
  - net/oenetcls: Supports rxq multiplexing
  - net/oenetcls: Add local flow NUMA-aware rps
  - net/oenetcls: Fix possible hash collision issue
  - !22410  Bluetooth: hci_event: move wake reason storage into validated event handlers
  - !22191 Fix CVE-2026-31447
  - Bluetooth: hci_event: move wake reason storage into validated event handlers
  - x86: fix duplicate ret variable in copy_user_generic
  - ext4: reject mount if bigalloc with s_first_data_block != 0
  - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-316.0.0.219
changelog:
  - !22869  tracing/probe: reject non-closed empty immediate strings
  - !22863  tracing: branch: Fix inverted check on stat tracer registration
  - !22609  Fix CVE-2026-31729
  - !22130 [Hygon][5.10][Feature] KVM: x86: Add support for CPUID leaf 0x8C860000
  - !21989 Support Hygon CSV2 VM Live Migration
  - !22771 Fix CVE-2026-43037
  - !22769 Fix CVE-2026-43038
  - !22767 Fix CVE-2026-43040
  - !22856  crypto: pcrypt - Fix handling of MAY_BACKLOG requests
  - tracing/probe: reject non-closed empty immediate strings
  - tracing: branch: Fix inverted check on stat tracer registration
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
  - !22814 ipmi: hisi_pso: fix atomic sleep and use-after-free via async workqueue
  - !22466 net/hinic5: Add Huawei Intelligent Network Card Driver: hinic5
  - net/hinic5: Add Huawei Intelligent Network Card Driver: hinic5
  - ipmi: hisi_pso: fix atomic sleep and use-after-free via async workqueue
  - !22770  tracepoints: get correct superblock from dentry in event btrfs_sync_file()
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
  - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
  - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
  - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
  - !22684  mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
  - !22726  Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
  - !22647 [OLK-5.10] Fix CVE-2026-31668
  - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
  - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
  - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  - net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
  - net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
  - net: ipv6: rpl_iptunnel: simplify the return expression of rpl_do_srh()
  - include: net: add static inline dst_dev_overhead() to dst.h
  - net: use indirect call helpers for dst_output
  - net: use indirect call helpers for dst_input
  - net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
  - net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
  - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
  - usb: typec: ucsi: skip connector validation before init
  - usb: typec: ucsi: validate connector number in ucsi_notify_common()
  - KVM: SVM: Unmap ghcb pages if they're still mapped when destroy a CSV2 guest
  - KVM: SVM: Export MSR_AMD64_SEV_ES_GHCB to userspace for CSV2 guest
  - KVM: x86: Restore control registers in __set_sregs() to support CSV2 guest live migration
  - KVM: SVM: Keep track EFER even though the VM is CSV2 guest
  - KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_VMSA command
  - KVM: SVM: Add KVM_SEV_SEND_UPDATE_VMSA command
  - KVM: x86: Add support for CPUID leaf 0x8C860000


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-317.0.0.220
changelog:
  - !23420  fbcon: Fix the issue of uninitialized charcount in the remaining consoles
  - !23423 soc: hisilicon: kunpeng_hccs: Remove unused input parameter
  - soc: hisilicon: kunpeng_hccs: Remove unused input parameter
  - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier
  - fbcon: Fix the issue of uninitialized charcount in the remaining consoles
  - !23389  CVE-2026-46181
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
  - refcount: provide ops for cases when object's memory can be reused
  - !23311  sched/cputime: Fix time overflow in cputime_adjust()
  - !23122 Fix CVE-2026-45856
  - !23327 Fix CVE-2026-43466
  - !23329 Fix CVE-2026-46033
  - crypto: authencesn - reject short ahash digests during instance creation
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
  - sched/cputime: Fix time overflow in cputime_adjust()
  - !23253  CVE-2026-31759
  - !23268 Fix CVE-2026-46151
  - !23270 Fix CVE-2026-46167
  - !23275 Fix CVE-2026-46187
  - !23245 Fix CVE-2026-46214
  - !23202  ceph: only d_add() negative dentries when they are unhashed
  - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
  - !23173  thermal: core: Fix thermal zone governor cleanup issues
  - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
  - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
  - usb: ulpi: fix memory leak on ulpi_register() error paths
  - usb: ulpi: fix double free in ulpi_register_interface() error path
  - vsock/virtio: fix accept queue count leak on transport mismatch
  - !23189  Fix CVE-2026-45984
  - ceph: only d_add() negative dentries when they are unhashed
  - gfs2: Fix use-after-free in iomap inline data write path
  - gfs2: Add metapath_dibh helper
  - gfs2: Move the inode glock locking to gfs2_file_buffered_write
  - gfs2: Add wrapper for iomap_file_buffered_write
  - gfs2: Replace gfs2_lblk_to_dblk with gfs2_get_extent
  - gfs2: Turn gfs2_extent_map into gfs2_{get,alloc}_extent
  - gfs2: Add new gfs2_iomap_get helper
  - !22991 Fix CVE-2026-43194
  - !23124  cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
  - thermal: core: Fix thermal zone governor cleanup issues
  - !23016  CVE-2026-45968
  - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
  - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
  - !23069  tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
  - !23035  CVE-2026-43328
  - !23029  Bluetooth: SMP: force responder MITM requirements before building the pairing response
  - !23063  s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
  - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
  - !22881 Fix CVE-2026-43503
  - !22871 Fix CVE-2026-46300
  - s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
  - !22782  apei: use blocking notifier for page offline policy chain
  - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
  - cpufreq: governor: Free dbs_data directly when gov->init() fails
  - Bluetooth: SMP: force responder MITM requirements before building the pairing response
  - sched: idle: Make skipping governor callbacks more consistent
  - cpuidle: Skip governor when only one idle state is available
  - !22900  scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
  - !22845  net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
  - !22956 net/oenetcls: remove HISI_L0 dependency and L0 allocator usage
  - !22701 net/oenetcls: validate module params and reject zero table sizes
  - !22939 oenetcls: fix worker-context locking, async add/del race, and runtime policy toggles
  - !22650 Backport the patch that rename sev-es.{ch} to sev.{ch} from upstream
  - net: consume xmit errors of GSO frames
  - !22943  drm: Account property blob allocations to memcg
  - !22888  lib/crypto: chacha: Zeroize permuted_state before it leaves scope
  - net/oenetcls: remove HISI_L0 dependency and L0 allocator usage
  - drm: Account property blob allocations to memcg
  - net/oenetcls: make rps policy module params read-only
  - net/oenetcls: fix async delete race with pending rule add
  - net/oenetcls: move listen-time tuple resolution to worker context
  - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
  - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
  - net: skbuff: preserve shared-frag marker during coalescing
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
  - net/oenetcls: validate module params and reject zero table sizes
  - apei: use blocking notifier for page offline policy chain
  - x86/sev-es: Rename sev-es.{ch} to sev.{ch}


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-318.0.0.221
changelog:
  - !23811  netfilter: x_tables: ensure names are nul-terminated
  - !23803  netfilter: nf_conntrack_helper: pass helper to expect cleanup
  - !23805  mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
  - !23079 Fix CVE-2026-43141
  - !23077 Fix CVE-2026-43149
  - !22764 [OLK-5.10]  Fix CVE-2026-43196
  - !22760 [OLK-5.10] Fix CVE-2026-43202
  - !22742 [OLK-5.10] Fix CVE-2026-43209
  - !23129 [OLK-5.10] Fix CVE-2026-43226
  - !22820 [OLK-5.10] Fix CVE-2026-31687
  - !22905 [OLK-5.10] Fix CVE-2026-31686
  - !22924 Fix CVE-2026-31683
  - !22983 [OLK-5.10] Fix CVE-2026-31660
  - !22996 [OLK-5.10] Fix CVE-2026-31657
  - !23478 [OLK-5.10] Fix CVE-2026-31649
  - !22909 Fix CVE-2026-31629
  - !22722 [OLK-5.10] Fix CVE-2026-31622
  - !22717 [OLK-5.10] Fix  CVE-2026-31618
  - !22711 [OLK-5.10] Fix CVE-2026-31617
  - !22689 [OLK-5.10] Fix  CVE-2026-31616
  - !22686 [OLK-5.10] Fix CVE-2026-31615
  - !22671 [OLK-5.10] Fix CVE-2026-31607
  - !22621 [OLK-5.10] Fix  CVE-2026-31605
  - !23119 [OLK-5.10] Fix CVE-2026-31464
  - netfilter: x_tables: ensure names are nul-terminated
  - !23555 [OLK-5.10] KVM: arm64: Skip device pfn in kvm_set_spte_gfn()
  - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup
  - !23709  iommu/vt-d: Flush cache for PASID table before using it
  - !23752  iommu/amd: move wait_on_sem() out of spinlock
  - !23756  ALSA: ctxfi: Add fallback to default RSR for S/PDIF
  - !19068 [OLK-5.10] ACPI: processor: idle: Set timer broadcast state on C3 for KH-50000
  - !23761 Fix CVE-2026-46243
  - !23629  drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
  - !23746  irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support
  - smb: client: reject userspace cifs.spnego descriptions
  - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
  - iommu/amd: move wait_on_sem() out of spinlock
  - !23304  netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
  - !23308  netfilter: x_tables: guard option walkers against 1-byte tail reads
  - !22965 Fix CVE-2026-43453
  - !22929 Fix CVE-2026-43139
  - !22953 Fix CVE-2026-43190
  - !22949 Fix CVE-2026-43233
  - !23661  xfrm: Fix CVE-2026-43091 RCU policy netns exit
  - !23635  xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
  - !23561  ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
  - !23557  xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
  - !22995  netfilter: ctnetlink: ensure safe access to master conntrack
  - !23166  xfrm: always flush state and policy upon NETDEV_UNREGISTER event
  - !23736  iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode
  - !23628  RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
  - !23704  CVE-2026-46065
  - !23034 Backport the patch that Move GHCB unmapping to fix RCU warning from upstream
  - !23662  ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
  - !23476  xfs: fix delay extent reserve issue
  - !23731  iommu/vt-d: Clear Present bit before tearing down context entry
  - !23730  iommu/vt-d: Clear Present bit before tearing down PASID entry
  - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support
  - !23740 drivers:misc:sdma-dae:Remove redundant print during mm exit and resume.
  - drivers:misc:sdma-dae:Remove redundant print during mm exit and resume.
  - !23702  spi: spidev: fix lock inversion between spi_lock and buf_lock
  - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode
  - !23705 drivers:misc:sdma-dae: Revert incorrect kernel code optimization.
  - !23734  netfilter: flowtable: strictly check for maximum number of actions
  - !23733 net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
  - !23711 Fix CVE-2026-43198
  - !23723 net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
  - !23718 ipv6: prevent possible UaF in addrconf_permanent_addr()
  - netfilter: flowtable: strictly check for maximum number of actions
  - !23707  spi: fix resource leaks on device setup failure
  - !23708  Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
  - !23305  ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
  - !23710  sound: ua101: fix division by zero at probe
  - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
  - iommu/vt-d: Clear Present bit before tearing down context entry
  - iommu/vt-d: Clear Present bit before tearing down PASID entry
  - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
  - ipv6: prevent possible UaF in addrconf_permanent_addr()
  - tcp: restore kABI for syn_recv_sock() backport
  - sound: ua101: fix division by zero at probe
  - iommu/vt-d: Flush cache for PASID table before using it
  - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
  - spi: fix resource leaks on device setup failure
  - drivers:misc:sdma-dae:Revert optimize kernel code
  - drivers:misc:sdma-dae:Revert add channel depth info in debugfs
  - drivers:misc:sdma-dae:Revert Write the CQ head pointer correctly.
  - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info
  - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
  - fbdev: Refactor implementation of page_mkwrite
  - spi: spidev: fix lock inversion between spi_lock and buf_lock
  - !23679  MIPS: Work around LLVM bug when gp is used as global register variable
  - !23534  dm-thin: fix metadata refcount underflow
  - !23251 Fix CVE-2026-45991
  - !23344 Fix CVE-2026-45983
  - !23532  fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
  - !23264 Fix CVE-2026-46102
  - !23682  RDMA/rxe: Fix double free in rxe_srq_from_init
  - !23266 Fix CVE-2026-46101
  - !23674  KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
  - !23387 Fix CVE-2026-46189
  - RDMA/rxe: Fix double free in rxe_srq_from_init
  - !23018 Fix CVE-2026-46023
  - MIPS: Work around LLVM bug when gp is used as global register variable
  - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
  - !23562 Fix CVE-2026-45840
  - !23437  dlm: validate length in dlm_search_rsb_tree
  - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
  - !22890  scsi: leapraid: update driver to v2.0.1.2
  - !23489  KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
  - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
  - xfrm: Wait for RCU readers during policy netns exit
  - !23239 Fix CVE-2026-45843
  - !23355 Fix CVE-2026-43093
  - tcp: fix potential race in tcp_v6_syn_recv_sock()
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
  - !22749 [OLK-5.10] Fix CVE-2026-23372
  - !22923 [OLK-5.10] Fix CVE-2026-23361
  - !22729 [OLK-5.10] Fix CVE-2026-23339
  - !22805 [OLK-5.10] Fix CVE-2026-23330
  - !22707 [OLK-5.10] Fix CVE-2026-23298
  - !22705 [OLK-5.10] Fix CVE-2026-23291
  - !22699 [OLK-5.10] Fix CVE-2026-23289
  - !22692 [OLK-5.10] Fix CVE-2026-23281
  - !22677 [OLK-5.10] Fix CVE-2026-23266
  - !22673 [OLK-5.10] Fix CVE-2026-23262
  - !22642 [OLK-5.10] Fix CVE-2026-23242
  - !22636 [OLK-5.10] Fix CVE-2026-23238
  - !22604 [OLK-5.10] Fix CVE-2026-23235
  - !22595 [OLK-5.10] Fix CVE-2026-23234
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
  - !22399 [OLK-5.10] Fix CVE-2026-23182
  - !22484 [OLK-5.10] Fix CVE-2026-23176
  - !22850 [OLK-5.10] Fix CVE-2026-23098
  - !22743 [OLK-5.10] Fix CVE-2026-23073
  - !22515 [OLK-5.10] Fix CVE-2025-71188
  - !22505 [OLK-5.10] Fix CVE-2025-71185
  - !22797 [OLK-5.10] Fix CVE-2025-71184
  - !22282 [OLK-5.10] Fix CVE-2025-71088
  - !22274 [OLK-5.10] Fix CVE-2025-68755
  - !22222 [OLK-5.10] Fix CVE-2026-31698
  - !22190 [OLK-5.10] Fix CVE-2025-39952
  - !20712 [OLK-5.10] Fix CVE-2025-39759
  - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
  - !23483  CVEs
  - openvswitch: cap upcall PID array size and pre-size vport replies
  - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
  - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
  - !23426 Fix HWPSIRT-2026-70484
  - !23223 Fix CVE-2026-45870
  - !23221 Fix CVE-2026-45964
  - !23171 Fix CVE-2026-43383
  - slip: bound decode() reads against the compressed packet length
  - KVM: arm64: Skip device pfn in kvm_set_spte_gfn()
  - dm-thin: fix metadata refcount underflow
  - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
  - !23003 Fix CVE-2026-43499
  - xfrm: esp: restore combined single-frag length gate
  - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
  - RDMA/rxe: Reject unknown opcodes before ICRC processing
  - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
  - net: stmmac: fix integer underflow in chain mode
  - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb()
  - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions
  - dlm: validate length in dlm_search_rsb_tree
  - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
  - gpio: omap: do not register driver in probe()
  - nfsd: never defer requests during idmap lookup
  - xsk: tighten UMEM headroom validation to account for tailroom and min frame
  - netfilter: x_tables: guard option walkers against 1-byte tail reads
  - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
  - netfilter: reject zero shift in nft_bitwise
  - nfc: nci: complete pending data exchange on device close
  - net: strparser: fix skb_head leak in strp_abort_strp()
  - udf: fix partition descriptor append bookkeeping
  - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
  - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
  - net/tcp-md5: Fix MAC comparison to be constant-time
  - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
  - netrom: fix double-free in nr_route_frame()
  - net/rds: No shortcut out of RDS_CONN_ERROR
  - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
  - KVM: SVM: Move GHCB unmapping to fix RCU warning
  - fbdev: rivafb: fix divide error in nv3_arb()
  - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
  - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
  - dm mirror: fix integer overflow in create_dirty_log()
  - rtmutex: Use waiter::task instead of current in remove_waiter()
  - batman-adv: hold claim backbone gateways by reference
  - netfilter: ctnetlink: ensure safe access to master conntrack
  - batman-adv: prepare for const netdev->dev_addr
  - nfc: pn533: allocate rx skb before consuming bytes
  - NFC: pn533: bound the UART receive buffer
  - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
  - netfilter: xt_tcpmss: check remaining length before reading optlen
  - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
  - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
  - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
  - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
  - nfc: llcp: add missing return after LLCP_CLOSED checks
  - mm/kasan: fix double free for kasan pXds
  - scsi: leapraid: update driver to v2.0.1.2
  - btrfs: fix NULL dereference on root when tracing inode eviction
  - soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
  - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
  - nfc: rawsock: cancel tx_work before socket teardown
  - wifi: rsi: Fix memory corruption due to not set vif driver data size
  - nfc: nci: free skb on nci_transceive early error paths
  - minix: Add required sanity checking to minix_check_superblock()
  - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
  - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
  - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
  - can: ucan: Fix infinite loop from zero-length messages
  - nfc: pn533: properly drop the usb interface reference on disconnect
  - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
  - wifi: libertas: fix use-after-free in lbs_free_adapter()
  - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
  - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
  - usbip: validate number_of_packets in usbip_pack_ret_submit()
  - gve: Fix stats report corruption on queue count change
  - RDMA/siw: Fix potential NULL pointer dereference in header processing
  - romfs: check sb_set_blocksize() return value
  - f2fs: fix out-of-bounds access in sysfs attribute read/write
  - f2fs: fix to avoid UAF in f2fs_write_end_io()
  - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
  - dmaengine: lpc18xx-dmamux: fix device leak on route allocation
  - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
  - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
  - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
  - spi: tegra: Fix a memory leak in tegra_slink_probe()
  - spi: tegra: Fix missing IRQ check in tegra_slink_probe()
  - mptcp: fallback earlier on simult connection
  - staging: most: remove broken i2c driver
  - iio: accel: bmc150: Fix irq assumption regression
  - wifi: wilc1000: avoid buffer overflow in WID string configuration
  - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
  - ACPI: processor: idle: Set timer broadcast state on C3 for KH-50000


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-320.0.0.222
changelog:
  - !24064 [OLK-5.10] CVE-2026-46331
  - net/sched: act_pedit: free pedit keys on bail from offset check
  - net/sched: fix pedit partial COW leading to page cache corruption
  - net/sched: act_pedit: Parse L3 Header for L4 offset
  - net/sched: act_pedit: rate limit datapath messages
  - net/sched: act_pedit: check static offsets a priori
  - net/sched: act_pedit: remove extra check for key type
  - net/sched: simplify tcf_pedit_act
  - net/sched: transition act_pedit to rcu and percpu stats
  - net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys
  - !24072  libceph: make decode_pool() more resilient against corrupted osdmaps
  - !24073  hfs: validate record offset in hfsplus_bmap_alloc
  - hfs: validate record offset in hfsplus_bmap_alloc
  - libceph: make decode_pool() more resilient against corrupted osdmaps
  - !24027  fuse: reject oversized dirents in page cache
  - !24028  xfs: delete attr leaf freemap entries when empty
  - !24024  ntfs: ->d_compare() must not block
  - !23901 net/hinic5: Fix high-risk interfaces in the sdk
  - net/hinic5: Fix high-risk interfaces in the sdk
  - xfs: delete attr leaf freemap entries when empty
  - fuse: reject oversized dirents in page cache
  - ntfs: ->d_compare() must not block
  - !24006 [OLK-5.10] Fix CVE-2026-46322
  - !23992 fbdev: fix potential buffer overflow in do_register_framebuffer()
  - tun: free page on build_skb failure in tun_xdp_one()
  - !23754 Fix CVE-2026-46112
  - fbdev: fix potential buffer overflow in do_register_framebuffer()
  - !23751 CVE-2026-46174
  - RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
  - !23898 RDMA/hns: Fix log flood after cmd_mbox failure
  - !23902  dm: fix a buffer overflow in ioctl processing
  - !23819  bonding: alb: fix UAF in rlb_arp_recv during bond up/down
  - !23820  xfrm: ah: account for ESN high bits in async callbacks
  - dm: fix a buffer overflow in ioctl processing
  - !23643 [OLK-5.10] Fix CVE-2026-46098
  - !23498 [OLK-5.10] Fix CVE-2026-43437
  - !23592 [OLK-5.10] Fix CVE-2026-43382
  - !23440 Fix CVE-2026-43207
  - !23433 Fix CVE-2026-43132
  - !22538 [OLK-5.10] Fix CVE-2026-23420
  - !23684 NFC: nxp-nci: allow GPIOs to sleep
  - !23720 [OLK-5.10] Fix CVE-2026-31580
  - !23716 [OLK-5.10] Fix CVE-2026-31656
  - !22615 [OLK-5.10] Fix CVE-2026-31603
  - !23605 [OLK-5.10] Fix CVE-2026-43295
  - !22611 [OLK-5.10] Fix  CVE-2026-31599
  - !22607 [OLK-5.10] CVE-2026-31598
  - !22591 [OLK-5.10] Fix CVE-2026-31597
  - !23788 [OLK-5.10] Fix CVE-2025-71272
  - !22588 [OLK-5.10] Fix CVE-2026-31596
  - !22583 [OLK-5.10] Fix  CVE-2026-31585
  - !23024 Fix CVE-2026-43183
  - !22578 [OLK-5.10] Fix CVE-2026-31583
  - !23027 Fix CVE-2026-43184
  - !23783 [OLK-5.10] Fix CVE-2026-31627
  - !23782 [OLK-5.10] Fix CVE-2026-31626
  - !23198 [OLK-5.10] Fix CVE-2026-31485
  - !23135 [OLK-5.10] Fix CVE-2026-23058
  - !23683 nfc: nci: fix circular locking dependency in nci_close_device
  - !23681 drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
  - !23553 [OLK-5.10] Fix CVE-2026-31507
  - !23677 dmaengine: omap-dma: fix dma_pool resource leak in error paths
  - !23666 net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
  - !21861 net: marvell: prestera: fix NULL dereference on devlink_alloc() failure
  - !20918 nilfs2: Fix potential block overflow that cause system hang
  - !22390 [OLK-5.10] Fix CVE-2025-71199
  - !22387 [OLK-5.10] Fix CVE-2025-71192
  - !23870  mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
  - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
  - !23234 Fix CVE-2026-46099
  - !23236 Fix CVE-2026-46027
  - !23843  jbd2: limit checkpoint buffers scanned per j_list_lock hold during shrink
  - jbd2: limit checkpoint buffers scanned per j_list_lock hold during shrink
  - RDMA/hns: Fix log flood after cmd_mbox failure
  - most: core: fix leak on early registration failure
  - most: core: fix resource leak in most_register_interface error paths
  - most: remove usage of the deprecated ida_simple_xx() API
  - !23797  scsi/hiraid: Support new RAID features and bug fixes
  - i2c: s3c24xx: check the size of the SMBUS message before using it
  - xfrm: ah: account for ESN high bits in async callbacks
  - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
  - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
  - scsi/hiraid: Support new RAID features and bug fixes
  - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
  - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
  - bcache: fix uninitialized closure object
  - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
  - bcache: fix cached_dev.sb_bio use-after-free and crash
  - NFC: nxp-nci: allow GPIOs to sleep
  - nfc: nci: fix circular locking dependency in nci_close_device
  - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
  - ASoC: tegra: Fix Master Volume Control
  - dmaengine: omap-dma: fix dma_pool resource leak in error paths
  - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
  - net: caif: clear client service pointer on teardown
  - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
  - batman-adv: Avoid double-rtnl_lock ELP metric worker
  - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
  - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
  - ALSA: pcm: fix wait_time calculations
  - media: mtk-mdp: Fix error handling in probe function
  - dm-verity: correctly handle dm_bufio_client_create() failure
  - net/smc: avoid early lgr access in smc_clc_wait_msg
  - spi: spi-fsl-lpspi: fix teardown order issue (UAF)
  - spi: lpspi: Simplify some error message
  - spi: lpspi: release requested DMA channels
  - spi: lpspi: Silence error message upon deferred probe
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
  - rnbd-srv: Zero the rsp buffer before using it
  - media: cx25821: Fix a resource leak in cx25821_dev_setup()
  - staging: sm750fb: fix division by zero in ps_to_hz()
  - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
  - ocfs2: fix possible deadlock between unlink and dio_end_io_write
  - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
  - ocfs2: handle invalid dinode in ocfs2_group_extend
  - media: vidtv: fix nfeeds state corruption on start_streaming failure
  - media: em28xx: fix use-after-free in em28xx_v4l2_open()
  - wifi: wlcore: Fix a locking bug
  - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
  - ALSA: ac97: fix a double free in snd_ac97_controller_register()
  - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure
  - nilfs2: Fix potential block overflow that cause system hang


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-321.0.0.223
changelog:
  - !24256  fix null pointer in bpf_get_local_storage
  - !24243 net: hns3: fix querying pfc-prevention-tout mismatch issue
  - bpf, verifier: Correct tail_call_reachable for bpf prog
  - bpf: Check for helper calls in check_subprogs()
  - !24205 Fix CVE-2026-52946
  - !24239 Fix CVE-2026-53037
  - !24238 Fix CVE-2026-53071
  - !24224  bpf: Tighten cgroup storage cookie checks for prog arrays
  - net: hns3: fix querying pfc-prevention-tout mismatch issue
  - net: hns3: add support to query/set pfc_prevention_tout for ethtool
  - !24227  smb: client: require a full NFS mode SID before reading mode bits
  - !24124 [OLK-5.10] CVE-2026-31414
  - HID: usbhid: fix deadlock in hid_post_reset()
  - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
  - smb: client: require a full NFS mode SID before reading mode bits
  - bpf: Tighten cgroup storage cookie checks for prog arrays
  - !24189  vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
  - !24208 v2  xfs: remove xfs_attr_leaf_hasname
  - xfs: remove xfs_attr_leaf_hasname
  - !24190  fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
  - !24191  xfs: fix undersized l_iclog_roundoff values
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
  - xfs: fix undersized l_iclog_roundoff values
  - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
  - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
  - !24078  ext4: don't cache extent during splitting extent
  - !24139  CVE-2026-45892
  - !24138  Fix CVE-2026-45899
  - !24150 [OLK-5.10] net/sched: act_pedit: fix action bind logic
  - net/sched: act_pedit: fix action bind logic
  - !24052  xfs: stop reclaim before pushing AIL during unmount
  - !24051  Fix CVE-2026-31453
  - !24067 Fix CVE-2026-46149
  - !24068  nvmet-tcp: fix race between ICReq handling and queue teardown
  - !24071  xfs: fix freemap adjustments when adding xattrs to leaf blocks
  - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
  - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
  - ext4: subdivide EXT4_EXT_DATA_VALID1
  - ext4: drop extent cache when splitting extent fails
  - ext4: fix inode tree inconsistency caused by ENOMEM
  - !19943  wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
  - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
  - netfilter: nf_conntrack_expect: preserve kABI for new expectation fields
  - !21207 drm/cirrus: Fix ERR_PTR dereference in cirrus_fb_blit_rect
  - !20781  tracing: Fix soft lockup when lseeking trace file
  - !24045 [OLK-5.10] backport important bugfix for nvme driver from upstream linux-5.10.y
  - !23375  sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
  - netfilter: nf_conntrack_expect: restore helper propagation via expectation
  - netfilter: ctnetlink: ignore explicit helper on new expectations
  - netfilter: nf_conntrack_expect: store netns and zone in expectation
  - netfilter: nf_conntrack_sip: get helper before allocating expectation
  - netfilter: nf_conntrack_expect: use expect->helper
  - netfilter: nf_conntrack_expect: honor expectation helper field
  - netfilter: nf_conntrack: use rcu accessors where needed
  - ext4: don't cache extent during splitting extent
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks
  - nvmet-tcp: fix race between ICReq handling and queue teardown
  - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
  - xfs: stop reclaim before pushing AIL during unmount
  - xfs: save ailp before dropping the AIL lock in push callbacks
  - xfs: avoid dereferencing log items after push callbacks
  - Revert "xfs: fix a UAF when inode item push"
  - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
  - drm/cirrus: Fix ERR_PTR dereference in cirrus_fb_blit_rect
  - tracing: Fix soft lockup when lseeking trace file
  - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-323.0.0.224
changelog:
  - !24610 Fix CVE-2026-53357
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
  - !24304 Fix CVE-2026-53249
  - !24302 Fix CVE-2026-53245
  - !24301 Fix CVE-2026-53238
  - !24269 Fix CVE-2026-52986
  - !24502 x86/hw-vuln:Adjust CPU mitigations MSR handling for newer models
  - !24327 Fix CVE-2026-53269
  - !24307 Fix CVE-2026-53266
  - !24325 Fix CVE-2026-53268
  - !24568  ALSA: usb-audio: Bound MIDI endpoint descriptor scans
  - !24329 Fix CVE-2026-53270
  - !24293 [OLK-5.10] Fix CVE-2026-53320
  - !24517 Fix CVE-2026-53236
  - !24333 Fix CVE-2026-53275
  - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
  - !24355  bus: fsl-mc: use generic driver_override infrastructure
  - !24253 Fix CVE-2026-53072
  - tcp: restrict SO_ATTACH_FILTER to priv users
  - net: use sk_is_tcp() in more places
  - bpf, sockmap: Use stricter sk state checks in sk_lookup_assign
  - x86/hw-vuln:Adjust CPU mitigations MSR handling for newer models
  - !24360 Fix CVE-2026-52991
  - !24291 Fix CVE-2026-53002
  - !24289 Fix CVE-2026-52998
  - !24267 Fix CVE-2026-52970
  - !24265 Fix CVE-2026-52943
  - !23919 [OLK-5.10] Fix CVE-2026-46019
  - !23912 [OLK-5.10] Fix CVE-2026-46022
  - !23852 [OLK-5.10] Fix CVE-2026-43491
  - !23452 Fix CVE-2026-43206
  - !23850 [OLK-5.10] Fix CVE-2026-43111
  - !23854 [OLK-5.10] Fix CVE-2026-43327
  - !23807 [OLK-5.10] Fix CVE-2026-43110
  - !23806 [OLK-5.10] Fix CVE-2026-43480
  - !23794 [OLK-5.10] Fix CVE-2026-43103
  - !23791 [OLK-5.10] Fix CVE-2026-43104
  - !23790 [OLK-5.10] Fix CVE-2026-43105
  - !23789 [OLK-5.10] Fix CVE-2026-43113
  - !23114 [OLK-5.10] Fix CVE-2026-43159
  - !22993 [OLK-5.10] Fix CVE-2026-31658
  - !23802 [OLK-5.10] Fix CVE-2026-31623
  - !24363  ipc: limit next_id allocation to the valid ID range
  - netfilter: nf_conntrack_sip: don't use simple_strtoul
  - netfilter: conntrack: remove sprintf usage
  - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
  - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
  - !24368  USB: serial: kl5kusb105: fix bulk-out buffer overflow
  - !24274  signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
  - !24312 Fix CVE-2026-53208
  - !24310 Fix CVE-2026-53252
  - USB: serial: kl5kusb105: fix bulk-out buffer overflow
  - ipc: limit next_id allocation to the valid ID range
  - sched/psi: fix race between file release and pressure write
  - bus: fsl-mc: use generic driver_override infrastructure
  - !24323  gfs2: add some missing log locking
  - !24339 Fix CVE-2026-53195
  - !24334  wifi: mac80211: check tdls flag in ieee80211_tdls_oper
  - !24276 net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use
  - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
  - wifi: mac80211: check tdls flag in ieee80211_tdls_oper
  - ipv6: mcast: Fix use-after-free when processing MLD queries
  - ipvs: clear the svc scheduler ptr early on edit
  - netfilter: synproxy: add mutex to guard hook reference counting
  - netfilter: conntrack_irc: fix possible out-of-bounds read
  - gfs2: add some missing log locking
  - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
  - Bluetooth: fix memory leak in error path of hci_alloc_dev()
  - netfilter: bridge: make ebt_snat ARP rewrite writable
  - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
  - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
  - netlabel: validate unlabeled address and mask attribute lengths
  - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
  - netfilter: conntrack: remove sprintf usage
  - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
  - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use
  - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
  - netfilter: nft_ct: fix missing expect put in obj eval
  - net: skbuff: fix missing zerocopy reference in pskb_carve helpers
  - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
  - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
  - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
  - net: qrtr: ns: Limit the maximum server registration per node
  - USB: dummy-hcd: Fix locking/synchronization error
  - net: qrtr: ns: Change servers radix tree to xarray
  - HID: roccat: fix use-after-free in roccat_report_event
  - drm/vc4: Fix memory leak of BO array in hang state
  - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
  - net: lapbether: replace comparison to NULL with "lapbeth_get_x25_dev"
  - net: lapbether: remove trailing whitespaces
  - wifi: wl1251: validate packet IDs before indexing tx_frames
  - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
  - wifi: brcmfmac: validate bsscfg indices in IF events
  - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
  - net: lapbether: Close the LAPB device before its underlying Ethernet device closes
  - drm/vc4: Fix a memory leak in hang state error path
  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
  - staging: rtl8723bs: fix null dereference in find_network
  - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()


author: lingsheng <lingsheng1@h-partners.com> - 3.5.2-9
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: Yu Peng <yupeng@kylinos.cn> - 1.2.0-323
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix ctr snapshot mount produce invalid mount command for empty option.


author: lingsheng <lingsheng1@h-partners.com> - 2.86-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Update DNS records after pruning DHCP leases
         Fix potential memory leak
         Fix possible SIGSEGV in bpf.c
         adapt bugfix allow binding mac with ipv6


author: luoguocui <luoguocui@h-partners.com> - 2.86-12
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:Fix bad reply to DHCPCONFIRM messages (wrong message type)
         Fix reply confirm packet when binding-mac-with-ip6 on


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.86-13
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix bounds checking in check_ia()
         Fix SEGV in Dbus code
         More fixes for DHCP ops in Dbus when DHCP not configured


author: zhaoyonghao10 <zhaoyonghao10@h-partners.com> - 2.86-15
changelog:
  - Type:security
  - CVE:CVE-2026-4890 CVE-2026-4891 CVE-2026-4892 CVE-2026-4893
  - SUG:NA
  - DESC:Fix NSEC bitmap parsing infinite loop
         Fix rdlen field validation in RRSIG packets
         Fix buffer overflow in helper with large CLIDs
         Fix broken client subnet validation


author: fly_fzc <2385803914@qq.com> - 2.4.1-27
changelog:
  - fix CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407
        CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412


author: markeryang <yanglongkang@h-partners.com> - 2.37.2-44
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport community patches
         [add] backport-lslogins-remove-possible-memory-leaks-coverity-scan.patch
               backport-mkfs.bfs-fix-memory-leaks-and-weak-code.patch
               backport-cfdisk-fix-memory-leak-and-possible-NULL-dereference.patch
               backport-swapoff-clean-up-tag-resolution.patch
               backport-libblkid-befs-fix-underflow.patch


author: cenhuilin <cenhuilin@kylinos.cn> - 2.37.2-46
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:lsblk: fix memory leak [coverity scan]
         lsblk: fix possible use-after-free


author: yixiangzhike <yixiangzhike007@163.com> - 2.37.2-48
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport community patches
           fix off-by-one in maximum last sector calculation


author: <alex.chen@huawei.com> - 10:6.2.0-105
changelog:
  - target/i386: Add EPYC-Genoa model to support Zen 4 processor series
  - target/i386: Add VNMI and automatic IBRS feature bits
  - target/i386: Add missing feature bits in EPYC-Milan model
  - target/i386: Add feature bits for CPUID_Fn80000021_EAX
  - target/i386: Add a couple of feature bits in 8000_0008_EBX
  - target/i386: Add new EPYC CPU versions with updated cache_info
  - target/i386: allow versioned CPUs to specify new cache_info


author: <fengjiabo1@huawei.com> - 10:6.2.0-106
changelog:
  - hw/nvme: Remove redundant dma_blk_write
  - tests/avocado/machine_s390_ccw_virtio: Adapt test to new default resolution
  - edid: set default resolution to 1280x800 (WXGA)
  - iotests/308: Fix for CAP_DAC_OVERRIDE
  - hvf: remove unused but set variable
  - vvfat: Fix vvfat_write() for writes before the root directory
  - hw/misc/nrf51_rng: Don't use BIT_MASK() when we mean BIT()
  - hw/pci: Remove unused pci_irq_pulse() method
  - ui/gtk: fix leaks found wtih fuzzing
  - target/i386: fix size of EBP writeback in gen_enter()
  - tests/qtest/fuzz: fix memleak in qos_fuzz.c
  - hw/core/loader: gunzip(): fix memory leak on error path
  - migration: fix a typo
  - scsi: fetch unit attention when creating the request
  - raw-format: Fix error message for invalid offset/size
  - tcg: Reset data_gen_ptr correctly
  - Fix calculation of minimum in colo_compare_tcp
  - hw/intc: Don't clear pending bits on IRQ lowering
  - target/arm: Drop user-only special case in sve_stN_r
  - usb-hub: Fix handling port power control messages
  - target/ppc: Set ctx->opcode for decode_insn32()
  - linux-user: Add proper strace format strings for getdents()/getdents64()
  - linux-user: Fix TARGET_PROT_SEM for XTENSA
  - linux-user/hppa: Set TASK_UNMAPPED_BASE to 0xfa000000 for hppa arch
  - linux-user/hppa: Dump IIR on register dump
  - tests: Fix typo in check-help output
  - qdev-core.h: Fix wrongly named reference to TYPE_SPLIT_IRQ
  - hw/scsi/megasas: Simplify using the ldst API
  - gqa-win: get_pci_info: Clean dev_info if handle is valid
  - target/ppc: Fix 7448 support
  - vvfat: Fix size of temporary qcow file
  - docs: Correct 'vhost-user-blk' spelling
  - jackaudio: use ifdefs to hide unavailable functions
  - simplebench: Fix Python syntax error (reported by LGTM)
  - python: update type hints for mypy 0.930
  - Python/aqmp: fix type definitions for mypy 0.920
  - tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc()
  - hw/ppc/e500: Prefer QOM cast
  - hw/ppc/e500: Remove unused "irqs" parameter
  - hw/ppc/e500: Add missing device tree properties to i2c controller node
  - linux-user: Show timespec on strace for futex()
  - linux-user: Add strace for clock_nanosleep()
  - linux-user: Fix strace of chmod() if mode == 0
  - linux-user: Log failing executable in EXCP_DUMP()
  - linux-user: Add pidfd_open(), pidfd_send_signal() and pidfd_getfd() syscalls


author: <fengjiabo1@huawei.com> - 10:6.2.0-107
changelog:
  - qemu: Support specifying the cache size presented to guest
  - hw/core/machine-smp: Initialize caches_bitmap before reading
  - qapi/qom: Define cache enumeration and properties for machine
  - linux-aio: fix unbalanced plugged counter in laio_io_unplug()


author: <fengjiabo1@huawei.com> - 10:6.2.0-109
changelog:
  - migration:Extand the fdtable in the incoming phase of migration
  - qemu6.2.0: Add trace to measure hot migrate downtime


author: Pengrui Zhang <zhangpengrui@huawei.com> - 10:6.2.0-111
changelog:
  - target/i386: Add Hygon Dhyana-v3 CPU model
  - target/i386: Add new Hygon 'Dharma' CPU model
  - migration: Don't sync volatile memory after migration completes
  - hw/display/framebuffer: Add cast to force 64x64 multiply
  - vmxcap: Add 5-level EPT bit
  - i386: Add Icelake-Server-v6 CPU model with 5-level EPT support
  - vmxcap: add tertiary execution controls
  - target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE
  - target/i386: enumerate bit 56 of MSR_IA32_VMX_BASIC
  - target/i386: fix feature dependency for WAITPKG
  - target/i386: add support for LAM in CPUID enumeration
  - target/i386: add control bits support for LAM
  - target/i386: add support for FRED in CPUID enumeration
  - target/i386: mark CR4.FRED not reserved
  - vmxcap: add support for VMX FRED controls
  - target/i386: enumerate VMX nested-exception support
  - target/i386: Add get/set/migrate support for FRED MSRs
  - target/i386: Delete duplicated macro definition CR4_FRED_MASK
  - target/i386: Add VMX control bits for nested FRED support
  - target/i386: Raise the highest index value used for any VMCS encoding
  - target/i386: Add more features enumerated by CPUID.7.2.EDX
  - target/i386: pass X86CPU to x86_cpu_get_supported_feature_word
  - i386/cpuid: Remove subleaf constraint on CPUID leaf 1F
  - target/i386: Don't construct a all-zero entry for CPUID[0xD 0x3f]
  - target/i386: Enable fdp-excptn-only and zero-fcs-fds
  - target/i386: Construct CPUID 2 as stateful iff times > 1
  - target/i386: Make invtsc migratable when user sets tsc-khz explicitly
  - target/i386/cpu: Fix notes for CPU models
  - target/i386: Introduce SierraForest-v2 model
  - target/i386: Export BHI_NO bit to guests
  - target/i386: Add new CPU model ClearwaterForest
  - docs: Add GNR, SRF and CWF CPU models
  - target/i386: add sha512, sm3, sm4 feature bits
  - target/i386: add avx-vnni-int16 feature
  - net: pad packets to minimum length in qemu_receive_packet()(CVE-2025-12464)
  - block-qdict: Fix-Werror=maybe-uninitialized build failure
  - block/curl.c: Check error return from curl_easy_setopt()
  - block: Handle curl 7.55.0..7.85.0 version changes
  - amd_iommu: fix uninitialized werror
  - io: release active GSource in TLS channel finalizer
  - io: move websocket resource release to close method
  - io: fix use after free in websocket handshake code(CVE-2025-11234)


author: Pengrui Zhang <zhangpengrui@huawei.com> - 10:6.2.0-113
changelog:
  - cryptodev-builtin: Limit the maximum size(CVE-2025-14876)
  - block/vmdk: fix OOB read in vmdk_read_extent()(CVE-2026-2243)
  - lsi53c895a: keep a reference to the device while SCRIPTS execute(CVE-2024-6519)


author: Fei Xu <xufei30@huawei.com> - 10:6.2.0-114
changelog:
  - ui/vnc: fix OOB read updating VNC update frequency stats(CVE-2026-48003)
  - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914)


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


author: yaoxin <1024769339@qq.com> - 1:9.0.119-1
changelog:
  - Update to 9.0.119 for fix CVEs: CVE-2026-50229, CVE-2026-53404,
    CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956,
    CVE-2026-55957


author: xu_ping <707078654@qq.com> - 0.2.44-2
changelog:
  - Remove redundant fc-cache scriptlets, fontconfig provides global %transfiletrigger 
    to refresh font cache automatically


