# changelog

author: Viktor Ashirov <vashirov@redhat.com> - 3.0.6-1
changelog:
  - Update to 3.0.6
  - Resolves: RHEL-1681 - [RFE] Log buffering for all log types
  - Resolves: RHEL-5141 - [RFE] For each request, a ldap client can assign an
    identifier to be added in the logs
  - Resolves: RHEL-38917 - dscreate interactive install shows a traceback
    when mdb is selected
  - Resolves: RHEL-42485 - [RFE] pbkdf2 hardcoded parameters should be turned
    into configuration options
  - Resolves: RHEL-59513 - [RFE] Port logconv.pl to python
  - Resolves: RHEL-61253 - Make online import more robust
  - Resolves: RHEL-69819 - "Duplicated DN detected" errors when creating
    indexes or importing entries. [rhel-10.0]
  - Resolves: RHEL-70122 - Crash in attrlist_find() when the Account Policy
    plugin is enabled.
  - Resolves: RHEL-74149 - backup/restore broken
  - Resolves: RHEL-74154 - If an entry RDN is identical to the suffix, then
    Entryrdn gets broken during a reindex
  - Resolves: RHEL-74159 - Crash during bind when acct policy plugin does not
    have "alwaysrecordlogin" set
  - Resolves: RHEL-74164 - On replica consumer, account policy plugin fails
    to manage the last login history
  - Resolves: RHEL-76020 - IPA LDAP error code T3 when no exceeded time limit
    from a paged search result [rhel-10]
  - Resolves: RHEL-76838 - Unlocked and locked users having same error output
  - Resolves: RHEL-76841 - Healthcheck tool should warn admin about creating
    a substring index on membership attribute


author: Viktor Ashirov <vashirov@redhat.com> - 3.0.6-2
changelog:
  - Bump version to 3.0.6-3
  - Resolves: RHEL-5141 - [RFE] For each request, a ldap client can assign an
    identifier to be added in the logs
  - Resolves: RHEL-77948 - ns-slapd crashes with data directory ≥ 2 days old
    [rhel-10]
  - Resolves: RHEL-78342 - During import of entries without nsUniqueId, a
    supplier generates duplicate nsUniqueId (LMDB only)


author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-2
changelog:
  - Resolves: RHEL-5117 - ns-slapd crash in
    dbmdb_import_prepare_worker_entry()
  - Resolves: RHEL-31959 - [RFE] add plugin origin or source in security's
    log msg info
  - Resolves: RHEL-35241 - ns-slapd crashes in referral mode
  - Resolves: RHEL-61327 - Incomplete messages about replication in the
    errors log.
  - Resolves: RHEL-61353 - dbscan  on replication changelog does not display
    MOD_TYPE
  - Resolves: RHEL-62874 - dsidm: issue when renaming users
  - Resolves: RHEL-65660 - DSIDM: Re-enabling user accounts that reached
    inactivity limit fails with error
  - Resolves: RHEL-67003 - dsconf backend replication monitor fails if
    replica id starts with 0
  - Resolves: RHEL-67006 - dsconf  utility  should let you configure the
    "uniqueness-exclude-subtrees" parameter of the Attribute Uniqueness plug-
    in
  - Resolves: RHEL-67019 - Crash in __strlen_sse2 when using the nsRole
    filter rewriter.
  - Resolves: RHEL-67022 - Password modify extended operation should skip
    password policy checks when executed by root DN
  - Resolves: RHEL-70117 - Unify how group description can be added to a new
    group in WebUI and CLU
  - Resolves: RHEL-74085 - Increased memory consumption caused by NDN cache
  - Resolves: RHEL-74270 - [RFE] Implement "list-dn" option for dsidm tool in
    Directory Server
  - Resolves: RHEL-76832 - Wrong backend database name syntax causes "Red Hat
    Directory Server" => "Databases" menu blank in Cockpit
  - Resolves: RHEL-76837 - dsidm Error: float() argument must be a string or
    a number, not 'NoneType'
  - Resolves: RHEL-76840 - Monitoring tab should use dsconf monitor
  - Resolves: RHEL-77490 - Complete remove the parameter "nsslapd-subtree-
    rename-switch" from DS-12
  - Resolves: RHEL-79080 - Json option does not work with "dsidm account get-
    by-dn" command
  - Resolves: RHEL-80252 - [RFE] Structured (JSON) logging option for RHDS
    access and error logs
  - Resolves: RHEL-80253 - RHDS hangs when having online backup running
    together with automember_rebuild task executing
  - Resolves: RHEL-80497 - Can't rename users member of automember rule
    [rhel-10]
  - Resolves: RHEL-81277 - logconv.py fails when specific timestamps are
    provided
  - Resolves: RHEL-83850 - mdb database statistics don't work
  - Resolves: RHEL-86279 - Cannot create a nested role using "dsidm role
    create-nested"
  - Resolves: RHEL-86280 - Cannot create a filtered role using "dsidm role
    create-filtered"
  - Resolves: RHEL-86313 - RootDN Access Control Plugin with wildcards for IP
    addresses fails with an error "Invalid IP address"
  - Resolves: RHEL-86314 - dsidm failing with error "argument must be a
    string or a number"
  - Resolves: RHEL-86315 - Dsidm get_dn option fails for organizational unit,
    service and posixgroup
  - Resolves: RHEL-86316 - Dsidm uniquegroup members option does not work
  - Resolves: RHEL-86321 - dsidm role rename-by-dn does not rename a role
  - Resolves: RHEL-86322 - dsidm role subtree-status doesn't work
  - Resolves: RHEL-86323 - dsidm role get-by-dn doesn't work properly with -j
    option
  - Resolves: RHEL-86324 - Deleting a role with dsidm results in proper
    deletion message, but role is still present
  - Resolves: RHEL-86785 - dscontainer: support loading custom schema
  - Resolves: RHEL-86878 - segfault at 7ff2370010c8 ip 00007ff2339ba239 sp
    00007fed321fe100 error 6 in liblmdb.so.0.0.0
  - Resolves: RHEL-89748 - Nested group does not receive memberOf attribute
  - Resolves: RHEL-89774 - Improve the "result" field of ipa-healthcheck if
    replicas are busy [rhel-10]
  - Resolves: RHEL-89776 - RHDS12.2 NSMMReplicationPlugin - release_replica
    Unable to parse the response
  - Resolves: RHEL-95441 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip
    00007ff734050cdb sp 00007ff6de9f1430 error 6 in
    libslapd.so.0.1.0[7ff733ec0000+1b3000]
  - Resolves: RHEL-95761 - Improve  error message when bulk import connection
    is closed
  - Resolves: RHEL-97565 - On RHDS 12.6 The user password policy for a user
    was created, but the pwdpolicysubentry attribute for this user
    incorrectly points to the People OU password policy instead of the
    specific user policy.
  - Resolves: RHEL-101926 - ipa-backup failed with error : 'No such file or
    directory: '/usr/sbin/dsctl'


author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-3
changelog:
  - Resolves: RHEL-80252 - [RFE] Structured (JSON) logging option for RHDS
    access and error logs
  - Resolves: RHEL-95441 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip
    00007ff734050cdb sp 00007ff6de9f1430 error 6 in
    libslapd.so.0.1.0[7ff733ec0000+1b3000]


author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-4
changelog:
  - Resolves: RHEL-73032 - segfault - error 4 in libpthread-2.28.so
  - Resolves: RHEL-79079 - Failure to get Server monitoring data when NDN
    cache is disabled.
  - Resolves: RHEL-87352 - ns-slapd crashed when we add nsslapd-referral
  - Resolves: RHEL-92054 - Memory leak in
    roles_cache_create_object_from_entry [rhel-10]
  - Resolves: RHEL-107001 - ipa-restore fails to restore SELinux contexts,
    causes ns-slapd AVC denials on /dev/shm after restore. [rhel-10]
  - Resolves: RHEL-107028 - CWE-284 dirsrv log rotation creates files with
    world readable permission
  - Resolves: RHEL-107035 - CWE-532 Created user password hash available to
    see in audit log
  - Resolves: RHEL-107037 - CWE-778 Log doesn't show what user gets password
    changed by administrator


author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-5
changelog:
  - Resolves: RHEL-101727 - The numSubordinates value is not matching the
    number of direct children.
  - Resolves: RHEL-101783 - RHDS12: Web console doesn't show Server Version
  - Resolves: RHEL-109018 - Allow Uniqueness plugin to search uniqueness
    attributes using custom matching rules
  - Resolves: RHEL-111224 - Error showing local password policy on web UI
  - Resolves: RHEL-112675 - Statistics about index lookup report a wrong
    duration
  - Resolves: RHEL-112689 - Crash if repl keep alive entry can not be created
  - Resolves: RHEL-112722 - Exception thrown by dsconf instance repl get_ruv
  - Resolves: RHEL-113969 - AddressSanitizer: memory leak in
    memberof_add_memberof_attr


author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-6
changelog:
  - Resolves: RHEL-117764 - Replication online reinitialization of a large
    database gets stalled. [rhel-10.1.z]
  - Resolves: RHEL-117773 - When the server restarts after a crash, the RFE
    assumes memberof should be recomputed. It triggers a memberof fixup task,
    dirsrv became unresponsive. [rhel-10.1.z]
  - Resolves: RHEL-123233 - Improve the way to detect asynchronous operations
    in the access logs [rhel-10.1.z]
  - Resolves: RHEL-123246 - Attribute uniqueness is not enforced upon modrdn
    operation [rhel-10.1.z]
  - Resolves: RHEL-123260 - Typo in errors log after a Memberof fixup task.
    [rhel-10.1.z]
  - Resolves: RHEL-123274 - LDAP high CPU usage while handling indexes with
    IDL scan limit at INT_MAX [rhel-10.1.z]
  - Resolves: RHEL-123281 - The new ipahealthcheck test
    ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue
    [rhel-10.1.z]
  - Resolves: RHEL-123370 - IPA health check up script shows time skew is
    over 24 hours [rhel-10.1.z]
  - Resolves: RHEL-123768 - 389-ds-base OpenScanHub Leaks Detected
    [rhel-10.1.z]
  - Resolves: RHEL-123854 - Units for changing MDB max size are not
    consistent across different tools [rhel-10.1.z]
  - Resolves: RHEL-123895 - Improve output dsctl dbverify when backend does
    not exist [rhel-10.1.z]
  - Resolves: RHEL-123898 - [WebUI] Replication tab crashes after enabling
    replication as a consumer [rhel-10.1.z]
  - Resolves: RHEL-126554 - RHDS 12.6 doesn't handle 'ldapsearch' filter with
    space char in DN name correctly [rhel-10.1.z]
  - Resolves: RHEL-129560 - Online initialization of consumers fails with
    error -23 [rhel-10.1.z]
  - Resolves: RHEL-129581 - Fix paged result search locking [rhel-10.1.z]
  - Resolves: RHEL-138484 - Memory leak observed in ns-slapd with 389-ds-
    base-2.6.1-12 [rhel-10.1.z]
  - Resolves: RHEL-138487 - RetroCL plugin generates invalid LDIF
    [rhel-10.1.z]
  - Resolves: RHEL-140091 - Upgrading IDM  to latest version: 389-ds-base and
    ipa-server breaks replication  [rhel-10.1.z]
  - Resolves: RHEL-140277 - ipa-healthcheck is complaining about missing or
    incorrectly configured system indexes. [rhel-10.1.z]


author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-7
changelog:
  - Bump version to 3.1.3-7
  - Resolves: RHEL-117764 - Replication online reinitialization of a large
    database gets stalled. [rhel-10.1.z]
  - Resolves: RHEL-123274 - LDAP high CPU usage while handling indexes with
    IDL scan limit at INT_MAX [rhel-10.1.z]
  - Resolves: RHEL-123281 - The new ipahealthcheck test
    ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue
    [rhel-10.1.z]
  - Resolves: RHEL-123370 - IPA health check up script shows time skew is
    over 24 hours [rhel-10.1.z]
  - Resolves: RHEL-129560 - Online initialization of consumers fails with
    error -23 [rhel-10.1.z]
  - Resolves: RHEL-137071 - CVE-2025-14905 389-ds-base: Remote Code Execution
    and Denial of Service via heap buffer overflow [rhel-10.1.z]
  - Resolves: RHEL-138484 - Memory leak observed in ns-slapd with 389-ds-
    base-2.6.1-12 [rhel-10.1.z]
  - Resolves: RHEL-140091 - Upgrading IDM to latest version: 389-ds-base and
    ipa-server breaks replication  [rhel-10.1.z]
  - Resolves: RHEL-142981 - Scalability issue of replication online
    initialization with large database [rhel-10.1.z]
  - Resolves: RHEL-146896 - memory corruption in alias entry plugin
    [rhel-10.1.z]
  - Resolves: RHEL-147213 - Access logs are not getting deleted as
    configured. [rhel-10.1.z]
  - Resolves: RHEL-150908 - Remove memberof_del_dn_from_groups from MemberOf
    plugin [rhel-10.1.z]


author: Andreas Schneider <asn@redhat.com> - 1.1.7-1
changelog:
  - Update to version 1.1.7
    * Update ignore list for source tarball generation
    * Added new assert macros to compare 2 double given an epsilon
    * Added meson build system
    * Added header with version to TAP13 output
    * Fixed issues with MSVC
    * Fixed TAP output for skipped tests
    * Fixed issue with fail_msg
    * CMake generated configs for find_package(cmocka)
    * Documentation improvements


author: Ales Nezbeda <anezbeda@redhat.com> - 0.8.8-49
changelog:
  - Fix SPDX license tag based on further research
  - https://gitlab.com/fedora/legal/fedora-license-data/-/issues/396#note_1976038980
  - Related: RHEL-37885


author: Than Ngo <than@redhat.com> - 2:1.12.0-3
changelog:
  - Fix Non-reproducible file names in doxygen output
  - Fix broken markdown links to anchors
  Related: RHEL-58045


author: Parag Nemade <pnemade AT redhat DOT com> - 20230101-14
changelog:
  - Resolves: RHEL-138159
    CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow
  - Resolves: RHEL-138144
    CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow
  - Resolves: RHEL-138126
    CVE-2025-15269 SFD File Parsing Use-After-Free


author: Marek Kasik <mkasik@redhat.com> - 2:3.10.3-3
changelog:
  - Initialize function pointers after resource allocation
  - Fixes CVE-2025-4478
  - Resolves: RHEL-91583


author: Ondrej Holy <oholy@redhat.com> - 2:3.10.3-5.1
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-142413, RHEL-142397, RHEL-142381, RHEL-142365, RHEL-142349
    Resolves: RHEL-142333, RHEL-142317


author: Ondrej Holy <oholy@redhat.com> - 2:3.10.3-5.2
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-147912, RHEL-148815, RHEL-148859, RHEL-148892, RHEL-148973


author: Eduard Abdullin <eabdullin@almalinux.org> - 2.39-58.7.alma.1
changelog:
  - Overwrite target for x86_64_v2
  - Update patch-git.lua to handle AlmaLinux branches correctly
  - Add support for AlmaLinux import UBI format


author: Takao Fujiwara <tfujiwar@redhat.com> - 2018.1-17
changelog:
  - Resolve RHELPLAN-170235 Fix OpenScanHub report
  - Fix deprecated g_spawn_check_exit_status with -Wdeprecated-declarations
  - Fix uninitialized n_failed with -Wanalyzer-use-of-uninitialized-value
  - Fix to check return value of g_setenv() with CWE-252


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
changelog:
  - Update get_bundle_versions.sh to match other scripts
  - * get_bundle_versions.sh: Add license
  - * get_bundle_versions.sh: Set compile-command in Emacs
  - * get_bundle_versions.sh: Use different error codes for different failures
  - * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
  - * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
  - * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
  - Add OpenJDK 8u support to get_bundle_versions.sh
  - Print bundle updates and backouts at end of openjdk_news.sh output
  - Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
  - Related: RHEL-103211


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.2-0.1.ea
changelog:
  - Update to jdk-21.0.8+2 (EA)
  - Update release notes to 21.0.8+2
  - Sync the copy of the portable specfile with the latest update
  - Add timezone data update check to openjdk_news.sh
  - Add duplicate check to openjdk_news.sh
  - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
  - Related: RHEL-101803
  - Resolves: RHEL-103211


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.8-0.1.ea
changelog:
  - Update to jdk-21.0.8+8 (EA)
  - Update release notes to 21.0.8+8
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-101803


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1
changelog:
  - Update to jdk-21.0.8+9 (GA)
  - Update release notes to 21.0.8+9
  - Switch to GA mode
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-102295


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-1
changelog:
  - Update to jdk-21.0.9+10 (GA)
  - Update release notes to 21.0.9+10
  - Bump harfbuzz version to 11.2.0 following JDK-8355528
  - Add NEWS corrections from Thomas
  - Use double spacing consistently in notes for this release
  - Correct 11u release reference to corresponding 21u release as pointed out by Kieran
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
  - Resolves: RHEL-118771
  - Resolves: RHEL-119468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-2
changelog:
  - Bump rpmrelease for CentOS build
  - Add scripts to handle tagging of portable-based RPMs
  - Related: RHEL-118771
  - Related: RHEL-119468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-1
changelog:
  - Update to jdk-21.0.10+7 (GA)
  - Update release notes to 21.0.10+7
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-142857
  - Resolves: RHEL-139565
  - Resolves: RHEL-131428
  - Resolves: RHEL-131441
  - Resolves: RHEL-142861
  - Resolves: RHEL-142815
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.7.0.6-3
changelog:
  - Recommend PipeWire on RHEL 9 and later for java.awt.Robot screenshots under Wayland
  - Resolves: RHEL-102686


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.8+1 (EA)
  - Update release notes to 21.0.8+1
  - Bump freetype version to 2.13.3 following JDK-8348596
  - Bump harfbuzz version to 10.4.0 following JDK-8348597
  - Bump lcms2 version to 2.17.0 following JDK-8348110
  - Bump libpng version to 1.6.47 following JDK-8348598
  - Switch to EA mode
  - Drop JDK-8351500 local patch which is now available in 21.0.8+1 upstream
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-101803


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:22.0.2.0.9-1
changelog:
  - Update to jdk-22.0.2+9 (GA)
  - Update release notes with features of JDK 22
  - Remove 21u FIPS patch and disable use until we are ready for the 25 version
  - Adjust CLDR expectations in TestTranslations.java after JDK-8317979 started using tzdata values
  - Adjust TestTranslations.java to expect the same short name throughout for fr_FR and de_DE (bug?)
  - Sync the copy of the portable specfile with the latest update
  - Remove references to libsystemconf.so and nss.fips.cfg from the 21u FIPS patch
  - Include static libraries in the vm_variant subdirectory after JDK-8307858 (libjvm.a)
  - Flip equals test in TestSecurityProperties.java to handle null values from Security.getProperty
  - Introduce crypto_policy_active to designate whether we should expect policy adherence in testing
  - Flip crypto_policy_active to false while the crypto policy & FIPS patch is not present
  - Handle new libsimdsort.so introduced on x86_64 only by JDK-8309130
  - Related: RHEL-100678


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:23.0.2.0.7-1
changelog:
  - Update to jdk-23.0.2+7 (GA)
  - Update release notes with features of JDK 23
  - Sync the copy of the portable specfile with the latest update
  - Remove lible.so handling following its removal in JDK-8327476: "Upgrade JLine to 3.26.1"
  - Install jaxp-strict.properties.template added by JDK-8330542: "Template for Creating Strict JAXP Configuration File"
  - Related: RHEL-120553


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:24.0.2.0.12-1
changelog:
  - Update to jdk-24.0.2+12 (GA)
  - Update release notes with features of JDK 24
  - alt-java man page installation is now handled by the OpenJDK build
  - Adjust TestTranslations.java with updated German translations from CLDR 46 (JDK-8333582) (Mountain->Mountains)
  - Run javap with the disassembled code (-c) option now required for -l by JDK-8345145
  - Sync the copy of the portable specfile with the latest update
  - Remove default.policy and java.policy following JDK-8338411: "Permanently Disable the Security Manager"
  - Make man page handling dependent on pandoc being available during the portable build
  - Handle new CDS archive variants (*_coh*) added by Compact Object Headers (JDK-8305895)
  - Add missing man page alternatives for jdeprscan, jfr, jhsdb, jimage, jlink & jmod and fix alphabetical ordering
  - Support jnativescan added by JDK-8317611: "Add a tool like jdeprscan to find usage of restricted methods"
  - Add recent native libraries to _privatelibs (libjsvml.so, libsimdsort.so, libsyslookup.so)
  - Support libsleef on AArch64 & RISC-V added by JDK-8329816, JDK-8320500 (RISC-V) & JDK-8312425 (AArch64)
  - Related: RHEL-120553


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-1
changelog:
  - Update to jdk-25.0.1+8 (GA)
  - Update release notes with features of JDK 25
  - Mention finalisation JEP for features finalised in JDK 22, 23 & 24
  - Drop fakefeaturever now we have reached OpenJDK 25
  - Update release notes to 25.0.1+8
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-120553


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-2
changelog:
  - Remove superfluous backslashes that cause two alternative commands to be combined
  - Related: RHEL-120553


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.1.0.8-3
changelog:
  - Add libnssadapter.so
  - Add FIPS crypto-policies configuration
  - Remove obsolete security.useSystemPropertiesFile setup
  - Update TestSecurityProperties.java test and calling convention
  - Resolves: RHEL-128413
  - Resolves: RHEL-128409


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.1.0.8-4
changelog:
  - Add java-25-openjdk-crypto-adapter subpackage
  - Update library setting in create-redhat-properties-files.bash
  - Resolves: RHEL-131896


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-5
changelog:
  - Incorporate new FIPS patch for 25u
  - Drop static libjvm.a following adjusted build target for portable build
  - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image
  - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS
  - Patch the nssadapter build to recognise LDFLAGS
  - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly
  - Resolves: RHEL-133733
  - Resolves: RHEL-133735
  - Resolves: RHEL-133763


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-6
changelog:
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-133733
  - Related: RHEL-133735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-1
changelog:
  - Update to jdk-25.0.2+10 (GA)
  - Update release notes to 25.0.2+10
  - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch
  - Test for java.security's existence in create-redhat-properties-files.bash
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-139579
  - Resolves: RHEL-131430
  - Resolves: RHEL-131443
  - Resolves: RHEL-142855
  - Resolves: RHEL-142799


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1
changelog:
  - Create java-25-openjdk package based on java-21-openjdk
  - Introduce fakefeaturever to pretend we are java-25-openjdk ahead of time
  - Sync the copy of the portable specfile with the latest update
  - Update README file for java-25-openjdk
  - Make sure this is not the default/system JDK providing 'java', 'jre', 'java-devel' ,etc.
  - Related: RHEL-100678


author: Martin Osvald <mosvald@redhat.com> - 2.6.3-1
changelog:
  - New version 2.6.3
  - Fix for: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803
  - kea.conf: Remove /tmp/ from socket-name for existing configurations
  - kea.conf: Set pseudo-random password for default config to secure fresh
    install and allow CA startup without user intervention
  - kea.conf: Restrict directory permissions
  - Sync service files with upstream
  - Fix leases ownership when switching from root to kea user


author: Martin Osvald <mosvald@redhat.com> - 3.0.0-1
changelog:
  - New version 3.0.0
  - Remove broken keactrl in favor of systemd unit files
  - kea.spec: General cleanup and removal of lines that have no effect
  - kea-msg-compiler was moved from kea to kea-devel


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.26-1
changelog:
  - New upstream release
  - Improve TX performance and use less CPU
  - minor other improvements
  - Build system update


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.27-1
changelog:
  - New upstream release
  - Fix potential startup race condition (corosync use case)
  - Fix crypto config check
  - Minor API cleanup
  - Test suite fixes


author: Dodji Seketeli <dodji@redhat.com> - 2.5-1
changelog:
  - Update to upstream 2.5 tarball
  - Drop patches (as they are now upstream):
    0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch
    0002-suppression-Add-has_strict_flexible_array_data_membe.patch
  - Enable abidb
  - Add BuildRequires: python3-devel
  - Add libabigail.so.4 and libabigail.so.4.0.0 to the RPM


author: Dodji Seketeli <dodji@redhat.com> - 2.6-1
changelog:
  - Update to upstream 2.6 tarball
  - Update to changing SONAME (libabigail.so.5.0.0)
  - Add BuildRequires xxhash-devel


author: Dodji Seketeli <dodji@redhat.com> - 2.8-1
changelog:
  - Update to upstream 2.8 tarball
  - Remove 0001-Fix-fedabipkgdiff-configure-check-for-Python-3.12.patch
    that is applied upstream.
  - Update to changing SONAME (libabigail.so.7.0.0)
  - Add xxhash-devel as BuildRequires and inlined-xxhash to avoid
    depending on it at runtime


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.9.1.el10_1]
changelog:
  - platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (CKI Backport Bot) [RHEL-123290]
  - smb: client: fix file open check in __cifs_unlink() (Paulo Alcantara) [RHEL-122417]
  - smb: client: fix data loss due to broken rename(2) (Paulo Alcantara) [RHEL-122417]
  - smb: client: fix compound alignment with encryption (Paulo Alcantara) [RHEL-122417]
  - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-122417]
  - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-122417]
  - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-121702] {CVE-2025-38498}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-121702] {CVE-2025-38498}
  - cgroup/psi: Set of->priv to NULL upon file release (CKI Backport Bot) [RHEL-119143] {CVE-2025-39881}
  - kernfs: Fix UAF in polling when open file is released (CKI Backport Bot) [RHEL-119143] {CVE-2025-39881}
  - redhat: rpminspect: update emptyrpm list for kernel variants (Alexandra Hájková)
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119132] {CVE-2025-39841}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118462] {CVE-2025-39817}
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117585] {CVE-2025-39849}
  - xfs: do not propagate ENODATA disk errors into xattr code (Carlos Maiolino) [RHEL-115733]
  - ipv6: sr: Fix MAC comparison to be constant-time (CKI Backport Bot) [RHEL-116387] {CVE-2025-39702}
  - s390/ism: fix concurrency management in ism_cmd() (CKI Backport Bot) [RHEL-114500]
  - s390/hypfs: Enable limited access during lockdown (CKI Backport Bot) [RHEL-114431]
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (CKI Backport Bot) [RHEL-114431]
  - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86 (Waiman Long) [RHEL-114276]
  - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114276] {CVE-2025-40300}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114276] {CVE-2025-40300}
  - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114276] {CVE-2025-40300}
  - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
  - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
  - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114276] {CVE-2025-40300}
  - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
  - RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-114931]
  - net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-114931]
  - net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-114931]
  - net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-114931]
  - net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-114931]
  - net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-114931]
  - mm: swap: fix potential buffer overflow in setup_clusters() (CKI Backport Bot) [RHEL-114862] {CVE-2025-39727}
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114852] {CVE-2025-39751}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114693] {CVE-2025-38729}
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114693]
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114693] {CVE-2025-39757}
  - ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (Mamatha Inamdar) [RHEL-114439]
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mamatha Inamdar) [RHEL-114439]
  - ibmvnic: Add stat for tx direct vs tx batched (Mamatha Inamdar) [RHEL-114439]
  - vsock/virtio: Validate length in packet header before skb_put() (CKI Backport Bot) [RHEL-114301] {CVE-2025-39718}
  - NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113861] {CVE-2025-39697}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.10.1.el10_1]
changelog:
  - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122880] {CVE-2025-39864}
  - selftests: tls: test skb copy under mem pressure and OOB (CKI Backport Bot) [RHEL-120380] {CVE-2025-39946}
  - tls: make sure to abort the stream if headers are bogus (CKI Backport Bot) [RHEL-120380] {CVE-2025-39946}
  - ixgbe: fix ixgbe_orom_civd_info struct layout (Michal Schmidt) [RHEL-119079]
  - ice: fix Rx page leak on multi-buffer frames (Petr Oros) [RHEL-116543]
  - eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111055] {CVE-2025-38614}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.11.1.el10_1]
changelog:
  - of_numa: fix uninitialized memory nodes causing kernel panic (Charles Mirabile) [RHEL-123154] {CVE-2025-39903}
  - redhat: use the same cert as UKI's to sign addons (Li Tian) [RHEL-124734]
  - ibmveth: Add multi buffers rx replenishment hcall support (Mamatha Inamdar) [RHEL-116193]
  - net: ibmveth: Reset the adapter when unexpected states are detected (Mamatha Inamdar) [RHEL-116193]
  - ibmvnic: Increase max subcrq indirect entries with fallback (Mamatha Inamdar) [RHEL-116189]
  - redhat: enable TDX host config (Paolo Bonzini) [RHEL-27145]
  - KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Paolo Bonzini) [RHEL-27145]
  - x86/virt/tdx: Update the kexec section in the TDX documentation (Paolo Bonzini) [RHEL-27145]
  - x86/virt/tdx: Remove the !KEXEC_CORE dependency (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Paolo Bonzini) [RHEL-27145]
  - x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Paolo Bonzini) [RHEL-27145]
  - x86/sme: Use percpu boolean to control WBINVD during kexec (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Consolidate relocate_kernel() function parameters (Paolo Bonzini) [RHEL-27145]
  - x86/paravirt: Remove the WBINVD callback (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Use typedef for relocate_kernel_fn function prototype (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Cope with relocate_kernel() not being at the start of the page (Paolo Bonzini) [RHEL-27145]
  - kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Mark machine_kexec() with __nocfi (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Use correct swap page in swap_pages function (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Ensure preserve_context flag is set on return to kernel (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Disable global pages before writing to control page (Paolo Bonzini) [RHEL-27145]
  - x86: Fix build regression with CONFIG_KEXEC_JUMP enabled (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Mark relocate_kernel page as ROX instead of RWX (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Clean up register usage in relocate_kernel() (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Drop page_list argument from relocate_kernel() (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Add data section to relocate_kernel (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Move relocate_kernel to kernel .data section (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Invoke copy of relocate_kernel() instead of the original (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Copy control page into place in machine_kexec_prepare() (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Allocate PGD for x86_64 transition page tables separately (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Only swap pages for ::preserve_context mode (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Clean up and document register use in relocate_kernel_64.S (Paolo Bonzini) [RHEL-27145]
  - x86/kexec: Restore GDT on return from ::preserve_context kexec (Paolo Bonzini) [RHEL-27145]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.12.1.el10_1]
changelog:
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120672]
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120672] {CVE-2025-39955}
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113613] {CVE-2025-39730}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.13.1.el10_1]
changelog:
  - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia) [RHEL-127623]
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia) [RHEL-127623]
  - Revert "SUNRPC: Don't allow waiting for exiting tasks" (Scott Mayhew) [RHEL-110051]
  - smb: client: get rid of d_drop() in cifs_do_rename() (Paulo Alcantara) [RHEL-124955]
  - smb: client: fix wrong index reference in smb2_compound_op() (Paulo Alcantara) [RHEL-124955]
  - smb: client: handle unlink(2) of files open by different clients (Paulo Alcantara) [RHEL-124955]
  - smb: client: fix filename matching of deferred files (Paulo Alcantara) [RHEL-124955]
  - fs/smb: Fix inconsistent refcnt update (Paulo Alcantara) [RHEL-124955] {CVE-2025-39819}
  - ice: don't leave device non-functional if Tx scheduler config fails (Petr Oros) [RHEL-116535]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-124.13.1
changelog:
  - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
  - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
  - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla4xxx: bring back deprecated PCI ids
  - lpfc: bring back deprecated PCI ids
  - be2iscsi: bring back deprecated PCI ids
  - kernel/rh_messages.h: enable all disabled pci devices by moving to
    unmaintained


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.14.1.el10_1]
changelog:
  - ublk: make sure ubq->canceling is set when queue is frozen (Ming Lei) [RHEL-99436] {CVE-2025-22068}
  - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123127] {CVE-2025-39898}
  - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123811]
  - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123811] {CVE-2025-39968}
  - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123811] {CVE-2025-39969}
  - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123811] {CVE-2025-39970}
  - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123811] {CVE-2025-39971}
  - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123811] {CVE-2025-39972}
  - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123811] {CVE-2025-39973}
  - nvme-multipath: Skip nr_active increments in RETRY disposition (Ewan D. Milne) [RHEL-123689]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.15.1.el10_1]
changelog:
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125623] {CVE-2025-38724}
  - wifi: mt76: free pending offchannel tx frames on wcid cleanup (Jose Ignacio Tornos Martinez) [RHEL-123070]
  - wifi: mt76: do not add non-sta wcid entries to the poll list (Jose Ignacio Tornos Martinez) [RHEL-123070]
  - wifi: mt76: fix linked list corruption (Jose Ignacio Tornos Martinez) [RHEL-123070] {CVE-2025-39918}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.16.1.el10_1]
changelog:
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Xin Long) [RHEL-125759]
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CKI Backport Bot) [RHEL-119161] {CVE-2025-39883}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.17.1.el10_1]
changelog:
  - x86/hyperv: Fix kdump on Azure CVMs (Li Tian) [RHEL-129777]
  - tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart) [RHEL-113919]
  - io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CKI Backport Bot) [RHEL-124974] {CVE-2025-40047}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.18.1.el10_1]
changelog:
  - ice: ice_adapter: release xa entry on adapter allocation failure (CKI Backport Bot) [RHEL-128472] {CVE-2025-40185}
  - cifs: Fix oops due to uninitialised variable (CKI Backport Bot) [RHEL-120562] {CVE-2025-38737}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.19.1.el10_1]
changelog:
  - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix sparse errors (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix possible UAFs (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
  - Bluetooth: hci_sync: fix set_local_name race condition (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
  - Bluetooth: MGMT: set_mesh: update LE scan interval and window (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
  - Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CKI Backport Bot) [RHEL-124134] {CVE-2025-39983}
  - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124110] {CVE-2025-39925}
  - can: j1939: implement NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124110] {CVE-2025-39925}
  - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CKI Backport Bot) [RHEL-123824] {CVE-2025-39982}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.20.1.el10_1]
changelog:
  - iommu/vt-d: Disallow dirty tracking if incoherent page walk (CKI Backport Bot) [RHEL-125482] {CVE-2025-40058}
  - net/mlx5: fs, fix UAF in flow counter release (Michal Schmidt) [RHEL-124432] {CVE-2025-39979}
  - dpll: zl3073x: Fix output pin registration (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Handle missing or corrupted flash configuration (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Refactor DPLL initialization (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (Ivan Vecera) [RHEL-114795]
  - dpll: Make ZL3073X invisible (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Fix build failure (Ivan Vecera) [RHEL-114795]
  - redhat/configs: enable CONFIG_ZL3073X* (Ivan Vecera) [RHEL-114795]
  - redhat/configs: enable CONFIG_I2C_MUX_PCA954x on x86 (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Add support to get fractional frequency offset (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Add support to adjust phase (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Implement phase offset monitor feature (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Add support to get phase offset on connected input pin (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Add support to get/set esync on pins (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Add support to get/set frequency on pins (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Implement input pin state setting in automatic mode (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Add support to get/set priority on input pins (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Implement input pin selection in manual mode (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Register DPLL devices and pins (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Read DPLL types and pin properties from system firmware (Ivan Vecera) [RHEL-114795]
  - dpll: zl3073x: Fetch invariants during probe (Ivan Vecera) [RHEL-114795]
  - dpll: Add basic Microchip ZL3073x support (Ivan Vecera) [RHEL-114795]
  - dt-bindings: dpll: Add support for Microchip Azurite chip family (Ivan Vecera) [RHEL-114795]
  - dt-bindings: dpll: Add DPLL device and pin (Ivan Vecera) [RHEL-114795]
  - idpf: set mac type when adding and removing MAC filters (CKI Backport Bot) [RHEL-123372]
  - crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Fix SNP panic notifier unregistration (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Fix dereferencing uninitialized error pointer (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Fix __sev_snp_shutdown_locked (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Move SEV/SNP Platform initialization to KVM (Lenny Szubowicz) [RHEL-76557]
  - KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Add new SEV/SNP platform shutdown API (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Register SNP panic notifier only if SNP is enabled (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Reset TMR size at SNP Shutdown (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (Lenny Szubowicz) [RHEL-76557]
  - crypto: ccp - Abort doing SEV INIT if SNP INIT fails (Lenny Szubowicz) [RHEL-76557]
  - s390/pci: Do not try re-enabling load/store if device is disabled (CKI Backport Bot) [RHEL-114448]
  - s390/pci: Fix stale function handles in error handling (CKI Backport Bot) [RHEL-114448]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.21.1.el10_1]
changelog:
  - CVE-2025-38499 kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Abhi Das) [RHEL-129282] {CVE-2025-38499}
  - net: tun: Update napi->skb after XDP process (CKI Backport Bot) [RHEL-122247] {CVE-2025-39984}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.22.1.el10_1]
changelog:
  - ASoC: Intel: sof_sdw: Add quirks for Lenovo P1 and P16 (CKI Backport Bot) [RHEL-130550]
  - tls: wait for pending async decryptions if tls_strp_msg_hold fails (CKI Backport Bot) [RHEL-128866] {CVE-2025-40176}
  - sched/deadline: Fix RT task potential starvation when expiry time passed (CKI Backport Bot) [RHEL-124660]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.23.1.el10_1]
changelog:
  - redhat: use RELEASE_LOCALVERSION also for dist-get-tag (Jan Stancek)
  - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)
  - iommufd: Fix race during abort for file descriptors (Eder Zulian) [RHEL-123789] {CVE-2025-39966}
  - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-126227]
  - mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125522] {CVE-2025-39843}
  - dpll: zl3073x: Increase maximum size of flash utility (Ivan Vecera) [RHEL-116157]
  - dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (Ivan Vecera) [RHEL-116157]
  - dpll: zl3073x: Implement devlink flash callback (Ivan Vecera) [RHEL-116157]
  - dpll: zl3073x: Add firmware loading functionality (Ivan Vecera) [RHEL-116157]
  - dpll: zl3073x: Add low-level flash functions (Ivan Vecera) [RHEL-116157]
  - dpll: zl3073x: Add functions to access hardware registers (Ivan Vecera) [RHEL-116157]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.24.1.el10_1]
changelog:
  - audit: fix out-of-bounds read in audit_compare_dname_path() (Richard Guy Briggs) [RHEL-119185] {CVE-2025-39840}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.25.1.el10_1]
changelog:
  - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-134010] {CVE-2025-40240}
  - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (CKI Backport Bot) [RHEL-128281]
  - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CKI Backport Bot) [RHEL-124610] {CVE-2025-39806}
  - inetpeer: do not get a refcount in inet_getpeer() (Guillaume Nault) [RHEL-115287]
  - inetpeer: update inetpeer timestamp in inet_getpeer() (Guillaume Nault) [RHEL-115287]
  - inetpeer: remove create argument of inet_getpeer() (Guillaume Nault) [RHEL-115287]
  - inetpeer: remove create argument of inet_getpeer_v[46]() (Guillaume Nault) [RHEL-115287]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.26.1.el10_1]
changelog:
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CKI Backport Bot) [RHEL-137150] {CVE-2025-68287}
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134431] {CVE-2025-40277}
  - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (CKI Backport Bot) [RHEL-129812] {CVE-2025-39905}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.27.1.el10_1]
changelog:
  - arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE (Waiman Long) [RHEL-120684]
  - arm64: cputype: Add Cortex-A720AE definitions (Waiman Long) [RHEL-120684]
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Waiman Long) [RHEL-120684]
  - arm64: Add support for HIP09 Spectre-BHB mitigation (Waiman Long) [RHEL-120684]
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Waiman Long) [RHEL-120684]
  - arm64: cputype: Add MIDR_CORTEX_A76AE (Waiman Long) [RHEL-120684]
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Waiman Long) [RHEL-120684]
  - kmem/tracing: add kmem name to kmem_cache_alloc tracepoint (Charles Haithcock) [RHEL-129882]
  - mm: memory-tiering: fix PGPROMOTE_CANDIDATE counting (Rafael Aquini) [RHEL-128383]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.28.1.el10_1]
changelog:
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137403] {CVE-2025-68285}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.29.1.el10_1]
changelog:
  - gitlab-ci: use rhel10.1 builder image (Michael Hofmann)
  - mm/vmalloc: fix data race in show_numa_info() (Waiman Long) [RHEL-137997] {CVE-2025-38383}
  - vmalloc: use for_each_vmap_node() in purge-vmap-area (Waiman Long) [RHEL-137997]
  - vmalloc: switch to for_each_vmap_node() helper (Waiman Long) [RHEL-137997]
  - vmalloc: add for_each_vmap_node() helper (Waiman Long) [RHEL-137997]
  - smb: client: fix refcount leak in smb2_set_path_attr (Paulo Alcantara) [RHEL-128581]
  - smb: client: fix potential UAF in smb2_close_cached_fid() (Paulo Alcantara) [RHEL-128581]
  - smb: client: fix potential cfid UAF in smb2_query_info_compound (Paulo Alcantara) [RHEL-128581]
  - smb: client: Fix refcount leak for cifs_sb_tlink (Paulo Alcantara) [RHEL-128581]
  - cifs: parse_dfs_referrals: prevent oob on malformed input (Paulo Alcantara) [RHEL-128581]
  - smb: client: remove cfids_invalidation_worker (Paulo Alcantara) [RHEL-128581]
  - smb client: fix bug with newly created file in cached dir (Paulo Alcantara) [RHEL-128581]
  - smb: client: short-circuit negative lookups when parent dir is fully cached (Paulo Alcantara) [RHEL-128581]
  - smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (Paulo Alcantara) [RHEL-128581]
  - smb: client: remove pointless cfid->has_lease check (Paulo Alcantara) [RHEL-128581]
  - smb: client: remove unused fid_lock (Paulo Alcantara) [RHEL-128581]
  - smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (Paulo Alcantara) [RHEL-128581]
  - smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (Paulo Alcantara) [RHEL-128581]
  - smb: client: account smb directory cache usage and per-tcon totals (Paulo Alcantara) [RHEL-128581]
  - smb: client: add drop_dir_cache module parameter to invalidate cached dirents (Paulo Alcantara) [RHEL-128581]
  - smb: client: show lease state as R/H/W (or NONE) in open_files (Paulo Alcantara) [RHEL-128581]
  - smb: client: show negotiated cipher in DebugData (Paulo Alcantara) [RHEL-128581]
  - smb: client: add new tracepoint to trace lease break notification (Paulo Alcantara) [RHEL-128581]
  - smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show() (Paulo Alcantara) [RHEL-128581]
  - coredump: Only sort VMAs when core_sort_vma sysctl is set (Herton R. Krzesinski) [RHEL-113364]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.30.1.el10_1]
changelog:
  - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jeff Moyer) [RHEL-129623] {CVE-2025-38453}
  - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139490] {CVE-2025-68301}
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139465] {CVE-2025-68305}
  - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139287] {CVE-2025-40248}
  - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129087] {CVE-2025-40170}
  - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129026] {CVE-2025-40135}
  - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128991] {CVE-2025-40158}
  - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-129026]
  - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-129026]
  - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-129026]
  - eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138041] {CVE-2025-38349}
  - fs/proc: fix uaf in proc_readdir_de() (CKI Backport Bot) [RHEL-137101] {CVE-2025-40271}
  - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136972] {CVE-2025-40294}
  - Bluetooth: hci_event: validate skb length for unknown CC opcode (CKI Backport Bot) [RHEL-136951] {CVE-2025-40301}
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CKI Backport Bot) [RHEL-136836] {CVE-2025-38568}
  - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CKI Backport Bot) [RHEL-136259] {CVE-2025-40318}
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CKI Backport Bot) [RHEL-134926] {CVE-2025-40251}
  - mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134451] {CVE-2025-40258}
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CKI Backport Bot) [RHEL-131989] {CVE-2025-37819}
  - drm/xe: Fix vm_bind_ioctl double free bug (Anusha Srivatsa) [RHEL-122312] {CVE-2025-38731}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.31.1.el10_1]
changelog:
  - i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121647]
  - devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121647]
  - i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121647]
  - KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace (Donald Dutile) [RHEL-134763]
  - scsi: st: Skip buffer flush for information ioctls (Ewan D. Milne) [RHEL-136289]
  - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (Ewan D. Milne) [RHEL-136289]
  - scsi: st: Don't set pos_unknown just after device recognition (Ewan D. Milne) [RHEL-136289]
  - scsi: st: New session only when Unit Attention for new tape (Ewan D. Milne) [RHEL-136289]
  - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (Ewan D. Milne) [RHEL-136289]
  - scsi: st: Don't modify unknown block number in MTIOCGET (Ewan D. Milne) [RHEL-136289]
  - xfs: rework datasync tracking and execution (CKI Backport Bot) [RHEL-126599]
  - xfs: rearrange code in xfs_inode_item_precommit (CKI Backport Bot) [RHEL-126599]
  - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Luiz Capitulino) [RHEL-133336]
  - s390: mm: add stub for hugetlb_optimize_vmemmap_key (Luiz Capitulino) [RHEL-133336]
  - x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers (Ricardo Robaina) [RHEL-129452]
  - x86/kaslr: Reduce KASLR entropy on most x86 systems (Ricardo Robaina) [RHEL-129452]
  - x86/boot/compressed: Remove unused header includes from kaslr.c (Ricardo Robaina) [RHEL-129452]
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CKI Backport Bot) [RHEL-134363] {CVE-2025-38022}
  - uprobes: Fix race in uprobe_free_utask (Jay Shin) [RHEL-133456]
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129115] {CVE-2025-40154}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.31.1.el10_1]
changelog:
  - i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121647]
  - devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121647]
  - i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121647]
  - KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace (Donald Dutile) [RHEL-134763]
  - scsi: st: Skip buffer flush for information ioctls (Ewan D. Milne) [RHEL-136289]
  - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (Ewan D. Milne) [RHEL-136289]
  - scsi: st: Don't set pos_unknown just after device recognition (Ewan D. Milne) [RHEL-136289]
  - scsi: st: New session only when Unit Attention for new tape (Ewan D. Milne) [RHEL-136289]
  - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (Ewan D. Milne) [RHEL-136289]
  - scsi: st: Don't modify unknown block number in MTIOCGET (Ewan D. Milne) [RHEL-136289]
  - xfs: rework datasync tracking and execution (CKI Backport Bot) [RHEL-126599]
  - xfs: rearrange code in xfs_inode_item_precommit (CKI Backport Bot) [RHEL-126599]
  - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Luiz Capitulino) [RHEL-133336]
  - s390: mm: add stub for hugetlb_optimize_vmemmap_key (Luiz Capitulino) [RHEL-133336]
  - x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers (Ricardo Robaina) [RHEL-129452]
  - x86/kaslr: Reduce KASLR entropy on most x86 systems (Ricardo Robaina) [RHEL-129452]
  - x86/boot/compressed: Remove unused header includes from kaslr.c (Ricardo Robaina) [RHEL-129452]
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CKI Backport Bot) [RHEL-134363] {CVE-2025-38022}
  - uprobes: Fix race in uprobe_free_utask (Jay Shin) [RHEL-133456]
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129115] {CVE-2025-40154}
  - kabi: stabilize struct alt_instr (Čestmír Kalina) [RHEL-122759]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.32.1.el10_1]
changelog:
  - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138024] {CVE-2025-38415}
  - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138024] {CVE-2025-38415}
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137686] {CVE-2025-40304}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (CKI Backport Bot) [RHEL-136945] {CVE-2025-40322}


author: Julio Faracco <jfaracco@redhat.com> [6.12.0-124.33.1.el10_1]
changelog:
  - io_uring/net: commit partial buffers on retry (Jeff Moyer) [RHEL-137333] {CVE-2025-38730}
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131394] {CVE-2025-39933}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.34.1.el10_1]
changelog:
  - ice: prevent NULL deref in ice_lag_move_new_vf_nodes() (Michal Schmidt) [RHEL-143255]
  - svcrdma: use rc_pageoff for memcpy byte offset (CKI Backport Bot) [RHEL-142793] {CVE-2025-68811}
  - exec: Make sure task->comm is always NUL-terminated (Luiz Capitulino) [RHEL-141711]
  - lib/buildid: use __kernel_read() for sleepable context (Waiman Long) [RHEL-141229]
  - net: bonding: update the slave array for broadcast mode (Hangbin Liu) [RHEL-138325]
  - net: bonding: add broadcast_neighbor netlink option (Hangbin Liu) [RHEL-138325]
  - net: bonding: add broadcast_neighbor option for 802.3ad (Hangbin Liu) [RHEL-138325]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.35.1.el10_1]
changelog:
  - ice: Fix kernel panic due to page refcount underflow (CKI Backport Bot) [RHEL-139734]
  - mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Davide Caratti) [RHEL-129044] {CVE-2025-40133}
  - mptcp: Call dst_release() in mptcp_active_enable(). (Davide Caratti) [RHEL-129044]
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137703] {CVE-2025-38403}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.36.1.el10_1]
changelog:
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140263] {CVE-2025-68349}
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Myron Stowe) [RHEL-132908] {CVE-2023-53034}
  - erofs: avoid using multiple devices with different type (CKI Backport Bot) [RHEL-137977] {CVE-2025-38172}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136912] {CVE-2025-40269}
  - Bluetooth: ISO: Fix possible UAF on iso_conn_free (CKI Backport Bot) [RHEL-128899] {CVE-2025-40141}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.37.1.el10_1]
changelog:
  - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141876]
  - bpf: Do not audit capability check in do_jit() (Jay Shin) [RHEL-135138]
  - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126896] {CVE-2025-40064}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.38.1.el10_1]
changelog:
  - scsi: storvsc: Process unsupported MODE_SENSE_10 (Li Tian) [RHEL-147288]
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144335] {CVE-2026-22998}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.39.1.el10_1]
changelog:
  - exfat: fix double free in delayed_free (CKI Backport Bot) [RHEL-146406] {CVE-2025-38206}
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143196] {CVE-2025-68800}
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125464] {CVE-2025-40096}
  - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130020] {CVE-2025-40168}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.40.1.el10_1]
changelog:
  - s390/mm: Fix __ptep_rdp() inline assembly (Mete Durlu) [RHEL-143715]
  - ice: PTP: fix missing timestamps on E825 hardware (CKI Backport Bot) [RHEL-148168]
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Xin Long) [RHEL-144984]
  - tools: ynl: Specify --no-line-number in ynl-regen.sh. (Xin Long) [RHEL-144984]
  - gue: Fix skb memleak with inner IP protocol 0. (Xin Long) [RHEL-144984]
  - netlink: specs: fou: replace underscores with dashes in names (Xin Long) [RHEL-144984]
  - redhat: enable FOU modules in kernel-modules-extra (Xin Long) [RHEL-144984]
  - net/smc: Remove validation of reserved bits in CLC Decline message (CKI Backport Bot) [RHEL-143717]
  - scsi: s390: zfcp: Ensure synchronous unit_add (CKI Backport Bot) [RHEL-143733]
  - smb: client: Add tracepoint for krb5 auth (Paulo Alcantara) [RHEL-145511]
  - smb: client: improve error message when creating SMB session (Paulo Alcantara) [RHEL-145511]
  - smb: client: relax session and tcon reconnect attempts (Paulo Alcantara) [RHEL-145511]
  - cifs: #include cifsglob.h before trace.h to allow structs in tracepoints (Paulo Alcantara) [RHEL-145511]
  - ALSA: hda/realtek - Enable Mute LED for Lenovo platform (Jaroslav Kysela) [RHEL-141440]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.41.1.el10_1]
changelog:
  - vfs: check dentry is still valid in get_link() (Ian Kent) [RHEL-134853]
  - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150116] {CVE-2026-23156}
  - KVM: x86: Apply runtime updates to current CPUID during KVM_SET_CPUID{,2} (Igor Mammedov) [RHEL-148458]
  - printk: Use console_is_usable on console_unblank (CKI Backport Bot) [RHEL-148303]
  - printk: Avoid irq_work for printk_deferred() on suspend (CKI Backport Bot) [RHEL-148303]
  - printk: Avoid scheduling irq_work on suspend (CKI Backport Bot) [RHEL-148303]
  - printk: Allow printk_trigger_flush() to flush all types (CKI Backport Bot) [RHEL-148303]
  - printk: Check CON_SUSPEND when unblanking a console (CKI Backport Bot) [RHEL-148303]
  - printk: nbcon: Allow reacquire during panic (CKI Backport Bot) [RHEL-148303]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147270] {CVE-2026-23097}
  - io_uring/sqpoll: don't put task_struct on tctx setup failure (Jeff Moyer) [RHEL-137992]
  - io_uring: consistently use rcu semantics with sqpoll thread (Jeff Moyer) [RHEL-137992]
  - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() (Jeff Moyer) [RHEL-137992] {CVE-2025-38106}
  - io_uring/sqpoll: fix sqpoll error handling races (Jeff Moyer) [RHEL-137992]
  - gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() (CKI Backport Bot) [RHEL-145597] {CVE-2025-40249}
  - gpio: cdev: make sure the cdev fd is still active before emitting events (CKI Backport Bot) [RHEL-145597] {CVE-2025-40249}
  - macvlan: fix possible UAF in macvlan_forward_source() (CKI Backport Bot) [RHEL-144128] {CVE-2026-23001}
  - dm: use READ_ONCE in dm_blk_report_zones (Benjamin Marzinski) [RHEL-137953]
  - dm: fix unlocked test for dm_suspended_md (Benjamin Marzinski) [RHEL-137953]
  - dm: fix dm_blk_report_zones (CKI Backport Bot) [RHEL-137953] {CVE-2025-38141}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.42.1.el10_1]
changelog:
  - dpll: zl3073x: Fix ref frequency setting (Ivan Vecera) [RHEL-139828]
  - dpll: Prevent duplicate registrations (Ivan Vecera) [RHEL-139828]
  - dpll: zl3073x: Remove unused dev wrappers (Ivan Vecera) [RHEL-139828]
  - dpll: zl3073x: Cache all output properties in zl3073x_out (Ivan Vecera) [RHEL-139828]
  - dpll: zl3073x: Cache all reference properties in zl3073x_ref (Ivan Vecera) [RHEL-139828]
  - dpll: zl3073x: Cache reference monitor status (Ivan Vecera) [RHEL-139828]
  - dpll: zl3073x: Split ref, out, and synth logic from core (Ivan Vecera) [RHEL-139828]
  - dpll: zl3073x: Store raw register values instead of parsed state (Ivan Vecera) [RHEL-139828]
  - dpll: zl3073x: fix kernel-doc name and missing parameter in fw.c (Ivan Vecera) [RHEL-139828]
  - dpll: zl3073x: Specify phase adjustment granularity for pins (Ivan Vecera) [RHEL-139828]
  - dpll: add phase-adjust-gran pin attribute (Ivan Vecera) [RHEL-139828]
  - dpll: fix device-id-get and pin-id-get to return errors properly (Ivan Vecera) [RHEL-139828]
  - dpll: spec: add missing module-name and clock-id to pin-get reply (Ivan Vecera) [RHEL-139828]
  - dpll: zl3073x: Allow to configure phase offset averaging factor (Ivan Vecera) [RHEL-139828]
  - dpll: add phase_offset_avg_factor_get/set callback ops (Ivan Vecera) [RHEL-139828]
  - dpll: add phase-offset-avg-factor device attribute to netlink spec (Ivan Vecera) [RHEL-139828]
  - dpll: fix clock quality level reporting (Ivan Vecera) [RHEL-139828]
  - dpll: add reference sync get/set (Ivan Vecera) [RHEL-139828]
  - dpll: add reference-sync netlink attribute (Ivan Vecera) [RHEL-139828]
  - dpll: remove documentation of rclk_dev_name (Ivan Vecera) [RHEL-139828]
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143548] {CVE-2025-71085}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137370] {CVE-2025-39760}
  - sched_ext: Fix scx_kick_pseqs corruption on concurrent scheduler loads (Phil Auld) [RHEL-124637]
  - sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc() (Phil Auld) [RHEL-124637]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.43.1.el10_1]
changelog:
  - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CKI Backport Bot) [RHEL-142253] {CVE-2025-39818}
  - drm/xe: Make dma-fences compliant with the safe access rules (Mika Penttilä) [RHEL-122272] {CVE-2025-38703}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.44.1.el10_1]
changelog:
  - dpll: expose fractional frequency offset in ppt (Ivan Vecera) [RHEL-146354]
  - dpll: zl3073x: Implement device mode setting support (Ivan Vecera) [RHEL-151824]
  - dpll: add dpll_device op to set working mode (Ivan Vecera) [RHEL-151824]
  - dpll: add dpll_device op to get supported modes (Ivan Vecera) [RHEL-151824]
  - net: vxlan: prevent NULL deref in vxlan_xmit_one (Antoine Tenart) [RHEL-133362]
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Olga Kornievskaia) [RHEL-144916]
  - s390/pci: Allow automatic recovery with minimal driver support (CKI Backport Bot) [RHEL-118883]


author: Fedora Release Engineering <releng@fedoraproject.org> - 2:18.1.2-0.4
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
  - with python3-Cython -> python3dist(cython) < 3~~


author: Fedora Release Engineering <releng@fedoraproject.org> - 2:18.1.2-0.5
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
  - revert python3-Cython -> python3dist(cython) < 3~~


author: Kaleb S. KEITHLEY <kkeithle[at]redhat.com> - 2:18.2.1-2
changelog:
  - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from
    https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm


author: Andreas Schneider <asn@redhat.com> - 1.4.0-1
changelog:
  - Update to version 1.4.0
    * https://gitlab.com/cwrap/socket_wrapper/-/blob/socket_wrapper-1.4.0/CHANGELOG


author: Jiri Denemark <jdenemar@redhat.com> - 11.1.0-1
changelog:
  - Rebased to libvirt-11.1.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-7041, RHEL-7042, RHEL-7104, RHEL-7342, RHEL-20294
      RHEL-41264, RHEL-52493, RHEL-58933, RHEL-70656, RHEL-71042
      RHEL-71810, RHEL-72021, RHEL-72052, RHEL-72192, RHEL-72994
      RHEL-79088, RHEL-79460, RHEL-79465, RHEL-79953


author: Jiri Denemark <jdenemar@redhat.com> - 11.2.0-1
changelog:
  - Rebased to libvirt-11.2.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-7035, RHEL-24046, RHEL-40077, RHEL-58151, RHEL-68043
      RHEL-71883, RHEL-72994, RHEL-77552, RHEL-80166, RHEL-80533
      RHEL-80688, RHEL-81731, RHEL-81890, RHEL-83148, RHEL-84257
      RHEL-84688
  - cpu_map: Install Ampere-1 ARM CPU models (RHEL-71662)


author: Jiri Denemark <jdenemar@redhat.com> - 11.3.0-1
changelog:
  - Rebased to libvirt-11.3.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-27172, RHEL-79088, RHEL-82411, RHEL-84257, RHEL-85320
      RHEL-85414, RHEL-85672, RHEL-86523, RHEL-86776, RHEL-86778


author: Jiri Denemark <jdenemar@redhat.com> - 11.4.0-1
changelog:
  - Rebased to libvirt-11.4.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-79460, RHEL-84783, RHEL-85414, RHEL-86952, RHEL-87177
      RHEL-88747, RHEL-89414, RHEL-90160, RHEL-90625, RHEL-92510


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-1
changelog:
  - Rebased to libvirt-11.5.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-86592, RHEL-93775, RHEL-95749, RHEL-100109


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-2
changelog:
  - virSystemdCreateMachine: Document @maxthreds (RHEL-95361)
  - cgroup: Unexport 'virDomainCgroupInitCgroup' (RHEL-95361)
  - qemu: conf: Store 'autoShutdown' config in virDomainDriverAutoShutdownConfig (RHEL-95361)
  - hypervisor: domain: Extract logic for auto shutdown to virDomainDriverAutoShutdownActive (RHEL-95361)
  - virSystemdCreateMachine: Add flag to invert machined unit dependencies (RHEL-95361)
  - cgroup: Plumb the 'daemonDomainShutdown' parameter of 'virSystemdCreateMachine' to drivers (RHEL-95361)
  - qemu: Fix auto-shutdown of qemu VMs by the qemu driver (RHEL-95361)
  - hypervisor: Split out individual steps out of virDomainDriverAutoShutdown (RHEL-95196)
  - virDomainDriverAutoShutdownDoSave: Don't attempt to save transient VMs (RHEL-95196)
  - virDomainDriverAutoShutdown: Refactor selection logic for VMs (RHEL-95196)
  - tls: Don't require 'keyEncipherment' to be enabled altoghther (RHEL-100711)
  - kbase: tlscerts: Drop 'encryption_key' feature request (RHEL-100711)
  - tests: virnettls*test: Drop use of GNUTLS_KEY_KEY_ENCIPHERMENT (RHEL-100711)
  - qemu_tpm: Rename qemuTPMHasSharedStorage -> qemuTPMDomainHasSharedStorage (RHEL-80155)
  - qemu_tpm: Extract per-TPM functionality from qemuTPMDomainHasSharedStorage (RHEL-80155)
  - qemu_tpm: Only warn about missing locking feature on shared filesystems (RHEL-80155)


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-4
changelog:
  - qemu: fix order of VNC TLS config entries (RHEL-104382)
  - qemu: sanitize blank lines in config file (RHEL-104382)
  - qemu: add ability to set TLS priority string with QEMU (RHEL-104382)


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-4.1.el10_1
changelog:
  - tools: Secure guest check for Intel in virt-host-validate (RHEL-111863)
  - qemu: Check if INTEL Trust Domain Extention support is enabled (RHEL-111863)
  - qemucapabilitiesdata: Document '+inteltdx' variant (RHEL-111863)
  - qemucapabilitiestest: Add data for the qemu-10.1.0 dev cycle on x86_64 for the '+inteltdx' variant (RHEL-111863)
  - qemu: Add QEMU_CAPS_TDX_GUEST capability (RHEL-111863)
  - conf: Expose TDX feature in domain capabilities (RHEL-111863)
  - conf: Add tdx as launch security type (RHEL-111863)
  - conf: Validate TDX launchSecurity element mrConfigId/mrOwner/mrOwnerConfig (RHEL-111863)
  - qemu: Add command line and validation for TDX type (RHEL-111863)
  - conf: Expose TDX type in domain launch security capability (RHEL-111863)
  - qemu: Force special parameters enabled for TDX guest (RHEL-111863)
  - qemu: log the crash information for TDX (RHEL-111863)
  - qemu_firmware: Pick the right firmware for TDX guests (RHEL-111863)
  - conf: Add Intel TDX Quote Generation Service(QGS) support (RHEL-111863)
  - qemu: Add command line for TDX Quote Generation Service(QGS) (RHEL-111863)
  - qemu: Add FakeReboot support for TDX guest (RHEL-111863)
  - qemu: Support reboot command in guest (RHEL-111863)
  - qemu: Avoid duplicate FakeReboot for secure guest (RHEL-111863)
  - qemu: Send event VIR_DOMAIN_EVENT_[STOPPED|STARTED] during recreation (RHEL-111863)
  - qemu: Support domain reset command for TDX guest (RHEL-111863)
  - qemuxmlconftest: Add latest version of 'launch-security-tdx*' test data (RHEL-111863)
  - docs: domain: Add documentation for Intel TDX guest (RHEL-111863)


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-4.2.el10_1
changelog:
  - cpu_conf: Make virCPUDefFilterFeatures return void (RHEL-126094)
  - qemu_domain: Simplify qemuDomainFixupCPUs (RHEL-126094)
  - qemu_domain: Fix qemuDomainFixupCPUs (RHEL-126094)
  - qemu_process: Always fix CPUs on reconnect (RHEL-126094)
  - qemu_monitor: Filter CPU features reported by QEMU (RHEL-126094)
  - qemu: Ignore "ht" CPU feature (RHEL-126094)


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-4.5.el10_1
changelog:
  - esx: Allow disk images in subdirectories (RHEL-140865)
  - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-140465)
  - esx: URI encode inventory objects twice (RHEL-140465)


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-4.7.el10_1
changelog:
  - esx: Debug URL just before opening with curl (RHEL-142863)
  - esx: Abstract all URL-creation code into one function (RHEL-142863)
  - esx: Switch to creating URLs using virURIFormat (RHEL-142863)


author: Dominik Mierzejewski <rpm@greysector.net> - 2.16.01-1
changelog:
  - update to 2.16.01 (#2155636)
  - drop obsolete patch
  - drop rdoff subpackage (discontinued upstream)


author: Richard W.M. Jones <rjones@redhat.com> - 1.40.0-2
changelog:
  - Rebase to nbdkit 1.40.0
    related: RHEL-49594
  - Send the last error to the NBD client
    resolves: RHEL-50666


author: Richard W.M. Jones <rjones@redhat.com> - 1.44.1-2
changelog:
  - Rebase to nbdkit 1.44.1
    resolves: RHEL-78830, RHEL-101180
  - Synch the spec file with Fedora Rawhide.
  - nbdkit-ondemand-plugin moves into a new subpackage.
  - New nbdkit-count-filter & nbdkit-time-limit-filter.
  - Remove nbdkit-cacheextents-filter.
  - Add extra system call checking and debugging to nbdkit-file-plugin
    resolves: RHEL-85515
  - Allow nbdkit-file-plugin to zero and trim block devices
    resolves: RHEL-89371
  - vddk: Pre-cache the extents for readonly connections
    resolves: RHEL-94825
  - Log filename, offset and count in nbdkit-file-plugin error messages
    resolves: RHEL-95364
  - vddk: Improve statistics
    related: RHEL-94825
  - CVE-2025-47711 denial of service attack by client sending maximum size block
    status
  - CVE-2025-47712 denial of service attack by client sending large unaligned
    size block status
    resolves: RHEL-95819
  - Add support for VDDK 9.0.0.0
    resolves: RHEL-99467
  - server: Fix .zero fallback path
    resolves: RHEL-101636


author: Richard W.M. Jones <rjones@redhat.com> - 1.20.2-2
changelog:
  - Rebase to libnbd 1.20.2
  - Fix multiple flaws in TLS server certificate checking
    resolves: RHEL-49802
  - Print full NBD error from server
    resolves: RHEL-50667


author: Richard W.M. Jones <rjones@redhat.com> - 1.22.2-2
changelog:
  - Rebase to libnbd 1.22.2
  - Synch spec file with Fedora Rawhide.
    resolves: RHEL-78831
  - Fix nbdinfo with dark theme
    resolves: RHEL-7119
  - Add nbdcopy --blkhash option
    resolves: RHEL-85513
  - Log the version of libnbd / nbdcopy in virt-v2v output
    resolves: RHEL-104019


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-74
changelog:
  - Use %{buildroot} instead of $RPM_BUILD_ROOT as it is more recent
  - Use directory macros and push/popd


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-75
changelog:
  - Fix installation on OSTree by removing %ghost (rhbz#2193429)
  - Remove %ldconfig_postun as it has no effect in Fedora


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-77
changelog:
  - Sync the RHEL version and Fedora version of the specfile
  - Update sources file and config.{sub|guess}
  - Skip verification for .soc file as it will change after install


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.227-1
changelog:
  - Update to 1.227
    - New maintainer, GTERMARS
    - Add basic GitHub Actions setup for testing
    - Typo corrections in POD
    - Eliminated use of state/node files in temp directory


author: Paul Howarth <paul@city-fan.org> - 1.18-1
changelog:
  - Update to 1.18 (rhbz#2251844)
    - Address Freebsd build issue: make function checks more robust within
      shared lib (GH#35)


author: Paul Howarth <paul@city-fan.org> - 1.20-1
changelog:
  - Update to 1.20 (rhbz#2256127)
    - Remove --no-undefined from compiler test, which is not compatible with all
      platforms (GH#37)
    - Skip t/pty_get_winsize.t tests on AIX (GH#32)
    - Fix patchlevel check for util.h (GH#27)


author: Paul Howarth <paul@city-fan.org> - 0.03-48
changelog:
  - Spec tidy-up
    - Use SPDX-format license tag
    - Use author-independent source URL
    - Specify all dependencies
    - Fix permissions verbosely
    - Simplify find commands using -empty and -delete
    - Make %files list more explicit


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/7078b79)
  - fixes "CVE-2025-9566 podman: Podman kube play command may overwrite host files [rhel-10.1]"
  - Resolves: RHEL-113140


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/c5a3735)
  - fixes "Can not find network create and rm message from podman event when set --events-backend to journald - [RHEL 10.1] 0day"
  - Resolves: RHEL-110318


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-5
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/61231e1)
  - fixes "Timeouts while pushing Sigstore logs to Rekor - [RHEL 10.1] 0day"
  - Resolves: RHEL-111077


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/2791007)
  - fixes "[Minor Incident] CVE-2025-52881 podman: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-10.1.z]"
  - Resolves: RHEL-126635


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/3bf5313)
  - fixes "run 1.2.x upgrade throws error while using nocopy volume mount filesystem option - [RHEL 10.1]"
  - Resolves: RHEL-132532


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/a58af02)
  - fixes "Bump to runc v1.2.9 or v1.3.4 to get CVE and regression fixes - Podman [rhel-10.1.z]"
  - Resolves: RHEL-132825


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-10
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/0a20b84)
  - fixes "CVE-2025-47913 podman: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS [rhel-10.1.z]"
  - Resolves: RHEL-134778


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-11
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/b194cd9)
  - fixes "podman build system test easily failed with TIMEOUT"
  - Resolves: RHEL-138650


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/56f1962)
  - fixes "Work on RHEL10.1 packaging"
  - Related: RHEL-80817


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.1-0.1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6
    (https://github.com/containers/podman/commit/d46b857)
  - fixes "Can not find network create and rm message from podman event when set --events-backend to journald"
  - Related: RHEL-109790


author: Jitka Plesnikova <jplesnik@redhat.com> - 4.2.1-1
changelog:
  - Resolves: RHEL-32325
  - 4.2.1 bump
  - Fix gcc's -Wformat-security warning in R Raise function
  - OCaml 5.2.0 ppc64le fix
  - Add support for Python 3.13


author: Andreas Schneider <asn@redhat.com> - 1.3.0-1
changelog:
  - Update to version 1.3.0
    o https://gitlab.com/cwrap/uid_wrapper/-/blob/uid_wrapper-1.3.0/CHANGELOG


