# changelog

author: Paul Howarth <paul@city-fan.org> - 1.6.12-1
changelog:
  - Update to 1.6.12
    - Populate metro and area code when performing lookups in IPv6 City
      databases; previously this was only done when using IPv4 City
      databases


author: Paul Howarth <paul@city-fan.org> - 2018.06-1
changelog:
  - IPv6 databases are still seeing updates in June 2018
  - IPv4 databases are unchanged from previous release


author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-32
changelog:
  - Prevent UnicodeDecodeError when parsing wp-cli output (CLPRO-1288)
  - Fix php version could not be obtained due to extra slash in docroot (CLPRO-1884)


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-33
changelog:
  - Remove SmartAdvice plugin after disabling AWP in WHM (CLPRO-775)
  - Fix the cloudlinux-awp-user get unility for case when features are hidden (CLPRO-2694)


author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-34
changelog:
  - Analyze and fix issues reported by sentry event "Documentroot s is missing in user information" (CLPRO-2018)
  - Implemented hooks on WP sites cloning for sync AccelerateWP modules with original website (CLPRO-2678)
  - Fixed conflict between redis and alt-redis (CLPRO-2751)
  - Fix failure when website in the Multisite mode with the plugin status "active-network" (CLPRO-2750)
  - Update wp cli to version 2.12.0 (CLPRO-1281)


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-36
changelog:
  - Refactored Critical CSS module for WP2 to improve availability (CLPRO-2782)
  - Add display_error=1 in wp-cli-wrapped to simplify troubleshooting (CLPRO-2630)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.10-1
changelog:
  - Improve installation of redis and other PHP extension needed for AccelerateWP (CLPRO-2127)
  - Added MAx Cache cli commands (MAXWS-926)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> - 1.10-2
changelog:
  - AWP set-suite take too long due to daemon-reload (CLPRO-2925)
  - Avoid saving unnecessary WordPress backup files when activating Redis Object Cache (Synced from 1.9-39)


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 1.10-5
changelog:
  - CLPRO-3045: Improved Redis configuration generation, daemon communication, and upgrade task handling


author:
  Ruslan Koliada <rkoliada@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 1.10-8

changelog:
  - CLPRO-3177: Reliability and robustness improvements in AccelerateWP utilities and helper scripts
  - CLOS-4494: Fix enable_redis_for_alt_php.py crash when an alt-php directory has no PHP binary


author:
  Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, oshyshatskyi <oshyshatskyi@cloudlinux.com> 1.6-2

changelog:
  - AWP-636: Implement ability for server admins to disable and enable Object Cache Pro banners
  - AWP-701: Speed up loading AccelerateWP: cache php inforamtion in get utility
  - AWP-724: Fix handler not supported on LiteSpeed webserver
  - AWP-703: Speed up loading AccelerateWP: cache wp-cli commands which read website configuration


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.6-3
changelog:
  - AWP-703: Cache wp-cli commands which read website configuration
  - AWP-708: Add a new metric to summary
  - CLPRO-432: Add possibility to track AccelerateWP upgrade URL
  - AWP-714: Ignore disallowed users when counting active plugins


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.6-4
changelog:
  - CLPRO-561: Fix the AccelerateWP CLN report generation in case of more than one feature included in suite


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 1.6-5
changelog:
  - AWP-752: Update /usr/bin/cloudlinux-awp-user in cagefs when updating accelerate-wp
  - CLPRO-408: Implement ability to hide specific feature


author:
  oshyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 1.7-1

changelog:
  - CLPRO-1071: Fix common bugs reported by Sentry
  - CLPRO-1071: Raised minimum supported PHP version for Object Caching to 7.2
  - CLPRO-779: Create custom acceleratewp ini with needed extensions
  - CLPRO-436: Renamed variables to ensure better consistency and clarity
  - AWP-765: Fix CLN billing report failed on user disk quota


author: oshyshatskyi <oshyshatskyi@cloudlinux.com> 1.7-2
changelog:
  - Automatically enable php extensions (json, igbinary, redis) when object cache becomes visible (CLPRO-1136)


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 1.8-1
changelog:
  - Migrate codebase to Python3.11 (CLPRO-1124)
  - Fix getting upgrade url for AccelerateWP Premium and AccelerateWP CDN (CLPRO-1182)


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 1.8-2
changelog:
  - Add Solo/Admin editions support (CLPRO-1081)
  - Fix getting custom ini path in enable_redis_for_alt_php script (CLPRO-1235)
  - Fix issues reported by Sentry (CLPRO-1237)
  - Don't scan user websites when AWP is turned off (CLPRO-1227)


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.8-3
changelog:
  - Implement email cancellation in cloudlinux-awp-admin (CLPRO-1191)
  - Improving processing of json wp-cli command output when there is excess output (CLPRO-796)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.8-4
changelog:
  - Fix sending sentry events on empty scanning report status (CLPRO-1334)
  - Fix AccelerateWP activation fails on users with disk quota exceeded (CLPRO-781)
  - Setup xray-user-agent if AccelerateWP is enabled (CLPRO-730)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-1
changelog:
  - Implement DirectAdmin support to AccelerateWP (CLPRO-1395, CLPRO-1403)
  - Add --skip-dns-check options to ignore site resolving results (CLPRO-1422)
  - Speed up enabling AccelerateWP feature (CLPRO-1423)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-1
changelog:
  - Implement DirectAdmin support to AccelerateWP (CLPRO-1395, CLPRO-1403)
  - Add --skip-dns-check options to ignore site resolving results (CLPRO-1422)
  - Speed up enabling AccelerateWP feature (CLPRO-1423)
  - Add AccelerateWP feature-flags into new metrics discovery system (CLPRO-1282)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-2
changelog:
  - Fix wp-cli commands fail on installed 3rd WordPress plugins (CLPRO-1379)
  - Fix getting php version via clwpos_monitoring daemon (CLPRO-1490)
  - Fix broken utilities output due to syslog configuration (CLPRO-1491)


author: Martin Krcho <mkrcho@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-3
changelog:
  - Improve selection of required PHP extensions in WP CLI wrapper script (CLPRO-1431)
  - Disable open_basedir restrictions for WP-CLI wrapper script (CLPRO-1525)
  - Improved handling of broken sites in WP CLI wrapper script (CLPRO-1468, CLPRO-1478)


author: alutsiuk <alutsiuk@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 1.9-4
changelog:
  - Add new types of incompatibilities on website scanning (CLPRO-1544)
  - Improve error reporting in WP CLI wrapper (CLPRO-1558)


author: Daniil Danilkin <ddanilkin@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 1.9-5
changelog:
  - Fix clwpos CLI errors if WordPress version.php is missing (CLPRO-1430)
  - Improve error reporting in WP CLI wrapper (CLPRO-1594)


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-6
changelog:
  - Add user syncing on --allowed-for-all option (CLPRO-1608)
  - Replace edition specific check with universal cpapi feature supported (CLPRO-1531)
  - Activating AccelerateWP via Plesk extension for users with multiple subscriptions (CLPRO-1643)
  - Manage configs same way across all CloudLinux Editions (CLPRO-1658)
  - Fix disk quota exceeded issue on creating user .clwpos directory (CLPRO-1666)


author:
  Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 1.9-7

changelog:
  - Activating AccelerateWP via Plesk extension for users with multiple subscriptions (CLPRO-1643, CLPRO-1668)
  - Activating AccelerateWP on requests from WHMCS (CLPRO-1694)
  - Unify suites defaults across all editions (CLPRO-1657)
  - Update website incompatibilities when AWP daemon is not running (CLPRO-1689)
  - Fix the way of returning the WP CLI wrapper value (CLPRO-1744)
  - Add ability to make suite visible per user (CLPRO-1746)
  - Backup AccelerateWP configs on activation via WHMCS (CLPRO-1768)
  - Send analytics on allow suite from WHMCS (CLPRO-1738)
  - Extend Plesk Extension with new methods (CLPRO-1733)
  - Add more logs to analyze "'int' object is not iterable" sentry issue (CLPRO-1739)
  - Fix get-stat not accounting default states of suites (CLPRO-1781)


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-8
changelog:
  - CLN sync - log list of affected unique_ids when authentication fails (CLPRO-1709)
  - Automatic installation and update the extension for Plesk for interaction of the CloudLinux Advantage WHMCS addon with AccelerateWP commands (CLPRO-1731)
  - Fix backup AccelerateWP configs (CLPRO-1882)


author: alutsiuk <alutsiuk@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 1.9-9
changelog:
  - Automatically uninstall SmartAdvice plugins and turn off notifications if they were enabled automatically (CLPRO-1926)
  - Added option to disable SmartAdvice WordPress plugins (CLPRO-1924)
  - Added Smart Advice plugin installation metric to statistics (CLPRO-1928)
  - Make set-suite command process multiple users (CLPRO-1902)
  - Added restore AccelerateWP backup command (CLPRO-1852)
  - Turn off AccelerateWP suites during erase of AccelerateWP (CLPRO-1915)


author: alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 1.9-10
changelog:
  - Fix tracebacks when control panel returns controversial information about user (CLPRO-1898, CLPRO-1843)
  - Fix alt-php redis configurator to consider msgpack extension (CLPRO-1958)
  - Fix clwpos_collect_information script to create needed directory (CLPRO-1897)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-11

changelog:
  - Add support of translations in AccelerateWP (CLPRO-1858)
  - Add whmcs statistics endpoint in cloudlinux-awp-admin tool
  - The execution of commands for interaction with WHMCS has been accelerated. Restoring backups from WHMCS for server settings only. Added deprecated status for backup folders. (CLPRO-1905, CLPRO-1994)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-11

changelog:
  - Add support of translations in AccelerateWP (CLPRO-1858)
  - Add whmcs statistics endpoint in cloudlinux-awp-admin tool (CLPRO-2005)
  - Improved backup recovery for WHMCS, added commands to Plesk extension (CLPRO-1905, CLPRO-1994)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com> - 1.9-13
changelog:
  - Disable error logging when running wp-cli (CLPRO-1779)
  - Fix inability to turn off smart advice notification during yum transaction with no license (CLRPO-2026)


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-18
changelog:
  - Fix sending empty report with AccelerateWP features to CLN (CLPRO-2239)
  - Make AccelerateWP Premium Object Cache free (CLPRO-2279, CLPRO-2281)
  - Fix AccelrateWP port create user hook for reseller user (CLPRO-2091)
  - Fix folder with AccelrateWP backup folder not found (CLPRO-2266)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-20
changelog:
  - Remove legacy "source" key from configs (CLPRO-2268)
  - Fix restoring Object Cache feature upon AccelerateWP Premium suite activation (CLPRO-2041)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-21
changelog:
  - Fix redis is unreachable when enabling Object Cache feature (CLPRO-2243)
  - Fix removing AccelerateWP hooks upon package removal (CLPRO-2293)
  - Fix AccelerateWP end-user info loading when wp-cli is malformed for site (CLPRO-1845)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-22
changelog:
  - Add caching for getting supported suites by license (CLPRO-2339)
  - Fix redis processes are not started after reboot (CLPRO-1667)


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-23
changelog:
  - Improved wp-cli commands work with WordPress sites (CLPRO-2478)
  - Fix AccelerateWP suite activation slows down account creation (CLPRO-2446)


author: Yehor Komarov <ykomarov@cloudlinux.com> - 1.9-25
changelog:
  - Fix BytesWarning: str() on a bytes instance issue in collect_information script (CLPRO-2244)
  - Added support for Ubuntu 22 (CLPRO-2533)


author: alutsiuk <alutsiuk@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-26
changelog:
  - Implement all features deactivation for all user websites (CLPRO-2562)
  - Fix getting user owner for ftp users on Plesk (CLPRO-2526)


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-27
changelog:
  - Fix clwpos_monitoring service does not re-create redis service automatically (CLPRO-2597)
  - Added CloudLinux MAx WebServer support for WordPress plugin (AP2NGX-222)


author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-28
changelog:
  - Implement automatical creation of missed /var/clwpos/uids/UID directories for all users (CLPRO-2491)
  - Fix cloudlinux-awp-user get/enable/disable does not work with ftp user on Plesk (CLPRO-2602)
  - Fix AWP check conflicting PHP module on FS instead PHP loaded modules (CLPRO-1952)


author: Roman Krompets <rkrompets@cloudlinux.com> - 1.9-30
changelog:
  - Unbind accelerate-wp from X-Ray (CLPRO-2201)
  - Fix redis to become inactive after clonning WP site with create a new domain (CLPRO-2670)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-19.1
changelog:
  - ALTPHP-1501: Update to 7.1.1-19
  - Updated libwebp to 1.3.2
  - Added package with libraries for static linking
  - Build with newer libraries for RHEL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-43.1
changelog:
  - ALTPHP-1896: Update to 7.1.1-43
  - ALTPHP-1920: Update libwebp to 1.5.0
  - ALTPHP-1932: Fix perfomance issues


author: Robert-André Mauchin <zebob.m@gmail.com> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Close: rhbz#1954337
  - Security fix for CVE-2021-30473
  - Fix: rhbz#1961375
  - Fix: rhbz#1961376
  - Security fix for CVE-2021-30475
  - Fix: rhbz#1968017
  - Fix: rhbz#1968018


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.11.0-2
changelog:
  - don't add link to ldap in *.pc file if ldap.pc doesn't exist
  - don't add link to mit-krb5-gssapi in *.pc file if mit-krb5-gssapi.pc.pc doesn't exist


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.19.0-2
changelog:
  - ALTPHP-2119: patch to allow building alt-curlssl11 with OpenSSL 1.1
    (curl 8.19.0 dropped OpenSSL < 3.0 support upstream)
  - Fix OPENSSL_VERSION_STRING -> OPENSSL_VERSION for OpenSSL 1.1 compat
  - Fix doc file references: FAQ -> FAQ.md, TODO -> TODO.md, KNOWN_BUGS -> KNOWN_BUGS.md
  - Disable flaky tests 763, 1501, 1583


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 8.19.0-3
changelog:
  - ALTPHP-2106: pin alt-nghttp2 runtime requirement to the version we built
    against, to avoid undefined-symbol errors when an older alt-nghttp2 is
    installed alongside a freshly built alt-curlssl11


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.19.0-4
changelog:
  - Restore short "OpenSSL/1.1.1w" SSL version string (drop the duplicated
    "OpenSSL " prefix and trailing release date introduced when working
    around OPENSSL_VERSION_STRING for alt-openssl11)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 2.1.28-1
changelog:
  - Update to 2.1.28 to match system cyrus-sasl on EL10 (fixes
    "ldap_int_sasl_init: SASL library version mismatch: expected 2.1.28,
    got 2.1.27" when system libldap loads alt libsasl2 via php RPATH)
  - Drop cyrus-sasl-pr559-RC4-openssl.patch (merged upstream in 2.1.28)
  - Add rpath to own libdir so sbin tools find the bundled libsasl2
    without the system cyrus-sasl-lib package installed
  - Drop cyrus-sasl-2.1.23-man.patch (testsaslauthd.8 man page is shipped
    upstream in 2.1.28; applying the patch would duplicate its content)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 57.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow): not applied
    for v57 yet (see TODO.md)
  - Drop SOURCE100/101 dep filters, use alt_default_filter
  - Drop downstream ".cloudlinux.1" release suffix; align Release with
    other ICU lines


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 65.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Run %check as two top-level make calls (source/test + xcheck-local)
    to dodge ICU's broken nested-make jobserver pattern; tests now run
    strictly without "||:"


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 71.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Release bumped to align with other ICU lines


author: Mosaab Alzoubi <moceap@hotmail.com> - 0.7.0-4
changelog:
  - First build on EPEL8
  - Use one branch to build on Fedora and EPEL
  - Use python3 as BR except EPEL7
  - Use LC_ALL=en_US.UTF-8 in EPEL7


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.11.1-4
changelog:
  - ALTPHP-2484: Fix CVE-2026-55200 (transport.c OOB write), CVE-2026-55199
    (EXT_INFO handler DoS), CVE-2025-15661 (sftp_symlink OOB read)


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-14
changelog:
  - ALMODP-143: httpd24-alt-mod-passenger installation paths for mod_passenger.so and mod_passenger.conf changed


author: Andrei Zheregelia <azheregelia@cloudlinux.com> 6.0.26-3
changelog:
  - CLOS-3362: Migrate alt-mod-passenger to use cloudlinux-venv provided Python instead of alt-python37


author: Haluk Yilmaz <hyilmaz@cloudlinux.com> 6.0.26-4
changelog:
  - CLOS-3500: Add CL10 support for passenger by adding the required compilation flag for successful build


author: Andrei Zheregelia <azheregelia@cloudlinux.com> 6.0.26-5
changelog:
  - CLOS-3629: Bring an override for httpd systemd service to change PrivateHome from "read-only" to "no"


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 6.0.26-6
changelog:
  - CLOS-4148: Security hardening and eliminate race condition
  - CLOS-4148: Switch build dependency to alt-ruby33 (drop alt-ruby21/alt-ruby22 requirements)


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 6.0.26-7
changelog:
  - CLOS-4285: Improved Passenger-related handling, validation, and robustness across multiple areas
  - CLOS-4148: Restore .htaccess scope for selector directives (regression fix)


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 6.0.26-8
changelog:
  - CLOS-4364: Allow PassengerAppLogFile in user .htaccess so cloudlinux-selector --passenger-log-file works for end users


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-8
changelog:
  - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering
    with Hash class internals in policy mechanism


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-10
changelog:
  - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits()
    that could lead to remote denial of service when malformed input is processed


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-11
changelog:
  - CVE-2022-32213: fix missing CR validation in header separators to prevent
    HTTP request smuggling via malformed headers
  - CVE-2022-32214: fix Transfer-Encoding header validation to reject invalid
    and repeated chunked encoding values
  - CVE-2022-32215: fix Transfer-Encoding header parsing to prevent smuggling
    attacks via conflicting encoding declarations
  - CVE-2022-35256: fix header overflow calculation to properly detect and
    reject oversized HTTP headers


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-13
changelog:
  - CVE-2023-46809: fix a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-14
changelog:
  - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource
    exhaustion during decompression


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-15
changelog:
  - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection
    on abrupt socket close


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 12.22.12-16
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism that could expose uninitialized memory when using vm module with
    timeout options, preventing potential information disclosure


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-17
changelog:
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-2.tuxcare.els6
changelog:
  - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that
    could lead to remote denial of service when malformed input is processed


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-4
changelog:
  - CVE-2023-32559: disable process.binding() when policy is enabled,
    update deprecations and errors docs, add new tests ensuring denial behavior,
    include new policy + app test fixtures


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-5
changelog:
  - CVE-2023-30589: fix llhttp parser to properly validate LF after CR
    in HTTP header fields, add lenient flag checks before allowing CR without LF,
    add test file to verify the fix prevents request smuggling attacks


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-11
changelog:
  - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1.1.1p-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free on empty digestAlgorithms)
  - Build on CL8 again: drop ExcludeArch: x86_64 (ELS-2378)


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 16.20.2-8
changelog:
  - CVE-2023-45143: clear Cookie and Host headers on cross-origin redirects to
    prevent sensitive data leakage


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 16.20.2-12
changelog:
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 16.20.2-13
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism preventing race condition that could expose uninitialized memory


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 16.20.2-16
changelog:
  - Obsolete alt-nodejs16-openssl{,-devel,-libs} < 1.1.1e on el8+ to prevent
    OPENSSL_1_1_1e symbol version mismatch when stale alt OpenSSL in RPATH
    shadows system OpenSSL


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 18.20.8-5
changelog:
  - CVE-2026-21637: wrap pskCallback and ALPNCallback invocations in try-catch
    blocks to route exceptions through error handlers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: Areg Gasparyan <agasparyan@cloudlinux.com> - 1:1.1.1w-3
changelog:
  - CVE-2025-68160: fix heap buffer overflow in BIO_f_linebuffer when next BIO
    performs short writes
  - CVE-2025-69418: fix OCB AES-NI/HW stream path leaving trailing bytes
    unauthenticated/unencrypted by advancing pointers after stream processing
  - CVE-2025-69419: fix out-of-bounds write in OPENSSL_uni2utf8 and do_buf
    by checking return code of UTF8_putc/bmp_to_utf8
  - CVE-2025-69420: fix missing ASN1_TYPE validation in TS_RESP_verify_response
    for signing certificate attributes
  - CVE-2025-69421: fix NULL pointer dereference in PKCS12_item_decrypt_d2i
    by adding NULL check for oct parameter
  - CVE-2026-22795: fix ASN1_TYPE validation in PKCS12 parsing (p12_kiss.c)
    and s_client.c before accessing union members
  - CVE-2026-22796: fix ASN1_TYPE type confusion in PKCS7_digest_from_attributes
    by validating type before accessing as OCTET_STRING


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.2
changelog:
  - CVE-2023-5678: fix excessive time in DH check/generation with large Q
    parameter by adding bounds checks in DH_check_pub_key and DH_generate_key
  - CVE-2024-0727: fix PKCS12 decoding NULL pointer dereference by adding NULL
    checks where ContentInfo data can be NULL


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.3
changelog:
  - CVE-2026-28387: fix use-after-free in DANE client code by using X509_free()
    instead of OPENSSL_free() to properly release reference-counted X509 objects
  - CVE-2026-28388: fix NULL pointer dereference when processing a delta CRL
    that has a Delta CRL Indicator but lacks a CRL Number extension
  - CVE-2026-28389: fix NULL pointer dereference in CMS KeyAgreeRecipientInfo
    processing when KeyEncryptionAlgorithmIdentifier omits the optional
    parameter field, by using safe X509_ALGOR_get0() extraction
  - CVE-2026-28390: fix NULL pointer dereference in CMS KeyTransportRecipientInfo
    processing when RSA-OAEP SourceFunc parameters are missing, by using safe
    X509_ALGOR_get0() extraction and OPENSSL_memdup() for label data


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.4
changelog:
  - CVE-2026-45447: fix use-after-free in PKCS7_verify triggered by a crafted
    PKCS#7 / S-MIME message with an empty digestAlgorithms ASN.1 SET, which made
    OpenSSL free a caller-owned BIO; free the BIO chain explicitly and stop at
    the caller-supplied indata BIO


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-46
changelog:
  - rewrite code for versions comparing in multiphp_reconfigure.py script
  - rewrite alt-php-mysql-reconfigure.py for ubuntu support


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-50
changelog:
  - ALTPHP-1376: fix detecting libmysqlclient.so version
  - ALTPHP-1396: restore alt-php.cfg if it's broken


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-54
changelog:
  - ALTPHP-1582: add support cl-MariaDB1011
  - ALTPHP-1626: return mysqli.so for alt-php >= 82
  - ALTPHP-1637: rebuild with system python from BaseOS repo


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-63
changelog:
  - do not create symlinks to mysqli on plesk
  - hardcode x86_64-linux-gnu to lib path in alt-php-mysql-reconfigure
    script


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-64
changelog:
  - for plesk panel create symlinks:
      mysqli.so -> nd_mysqli.so
      pdo_mysql.so -> nd_pdo_mysql.so
  - for plesk panel do not create any symlinks for ini configs


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-65
changelog:
  - ALTPHP-2180: Fixed processing mysql.so (for PHP 5x) in Plesk environment
  - ALTPHP-2180: Call alt-php-mysql-reconfigure in Plesk environment wthout installed bindings


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.4.33-4
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.4.33-7
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-10
changelog:
  - ALTPHP-1531: add provides alt-php-handler-lsphp and alt-php81-handler-lsphp
  - remove changes from ALTPHP-1508


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.4.33-12
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Daniil Danilkin <ddanilkin@cloudlinux.com> - 0.4-4
changelog:
  - Adds explicit error if user's CL isn't registered (CLPRO-1487)
  - Enable/disable SSO twice isn't a error anymore for CLI (CLPRO-1553)


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.4-5
changelog:
  - Replace edition specific check with universal cpapi feature supported (CLPRO-1531)
  - Increase string length parameter during Sentry init (CLPRO-1578)


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> - 0.4-7
changelog:
  - Improve report email templates (CLPRO-1055)
  - Extend logging with detection of WP2 environment (CLPRO-1899)
  - Simplified the code of building SSA extensions (CLPRO-1946)
  - Added alt-php82 support for CL6 (CLPRO-1947)
  - Added ea-php83 support (CLPRO-1948)


author: Denis Komandyr <dkomandyr@cloudlinux.com> - 0.4-8
changelog:
  - Fixed SSA service when ssa.conf is empty (CLPRO-566)
  - Added special characters escaping in database query (CLPRO-2043)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.4-10
changelog:
  - Fixed an error on DirectAdmin that lead to the 'xray.so' extension was not placed to extensions dir (CLPRO-1409)


author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 0.4-16
changelog:
  - CLPRO-1623: Fix Database error for PHP Slow Site Analyzer
  - CLPRO-2695: Add linefeed in clos_ssa.ini


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.4-18
changelog:
  - CLPRO-2911: Prevent the creation of clos_php.ini files for PHP versions that are not yet supported by alt-php-ssa.


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.4-19
changelog:
  - Added PHP 8.5 support for Slow Site Analyzer (CLPRO-2910)
  - Fix conflicts between X-Ray and Slow Site Analyzer modules on PHP85 (CLPRO-2929)


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.4-26
changelog:
  - CLPRO-3068: Improved SSA agent input handling, manager operation logging, and configuration validation


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.4-27
changelog:
  - CLPRO-3077: Bound SSA agent memory during daily maintenance on large databases
  - CLPRO-3076: Improved disable-ssa to fully stop and disable the agent's systemd units
  - CLPRO-3118: Raise ssa-agent TasksMax, pin numpy BLAS threads to one, and keep the accept loop alive when thread creation fails
  - CLPRO-3175: Fixed ssa-agent.service failing to start on servers without CageFS installed


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Dasha Kavchuk <dkavchuk@cloudlinux.com> - 0.3-8
changelog:
  - CLPRO-228: Add support of CL9
  - XRAY-711: Fix copying clos_ssa extensions for DirectAdmin
  - XRAY-721: Enable autotracing, but block it from working in case of malfunctions present


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 0.5-28
changelog:
  - Avoid 500 error when /opt/alt/php-xray restricted to access from PHP in WP SmartAdvice (CLPRO-579)


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 0.6-2

changelog:
  - Don't scan user websites when AWP is turned off (CLPRO-1227)
  - Added alt-php83 support (CLPRO-1163)
  - Added support for php 5.4, 5.5 for php profiler (CLPRO-1246)
  - Send Sentry event when mail or analytics sending failed (CLPRO-1245, CLPRO-1180)


changelog: - Implemented SmartAdvice reminders (CLPRO-1184, CLPRO-1188, CLPRO-1191, CLPRO-1304)
author:
  Dmitriy Leonov <dmleonov@cloudlinux.com>, Martin Krcho <mkrcho@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-3


author: Martin Krcho <mkrcho@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 0.6-5
changelog:
  - Added support for variable advice driven texts in the UI and email (CLPRO-1156)
  - Improve open_basedir setting handling on Plesk (CLPRO-1347)
  - Add fuzziness to execution time of the wordpress-plugin-install cron job (CLPRO-1328)


author: Martin Krcho <mkrcho@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 0.6-6
changelog:
  - Add stack trace to Sentry events in SmartAdvice WP plugin (CLPRO-1267)
  - Remove CL logo from SmartAdvice email footer (CLPRO-1375)


author:
  Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com>, Martin Krcho <mkrcho@cloudlinux.com> - 0.6-9

changelog:
  - Adding environment variable to the Sentry events (CLPRO-1317)
  - Extend advice data fields with variants in cl-smart-advice utilities (CLPRO-1155)
  - Adapt Smart Advice plugin to support DireactAdmin (CLPRO-1405)
  - Add tracking of purchase related events (CLPRO-1159)
  - Track failure to report to analytics API from JS to Sentry (CLPRO-1354)


author: Martin Krcho <mkrcho@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-10
changelog:
  - Improve logging for notification status checks and advice filtering (CLPRO-1449)
  - Displaying text variant for advice in the plugin (CLPRO-1471)
  - Avoid downtime when autocomplete tasks cron executed (CLPRO-1408)
  - Add details to SmartAdvice plugin installation errors (CLPRO-1479, CLPRO-1506)


author:
  Martin Krcho <mkrcho@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 0.6-11

changelog:
  - Add optional toggle making X-Ray to automatically enable extension for all php versions (CLPRO-587)
  - Add auto-fixing for incorrect open_basedir setting values for Plesk (CLPRO-1480)
  - Cover Wordpress Admin notices (SmartAdvice) with telemetry (CLPRO-1510)


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 0.6-12
changelog:
  - Added response status code to the analytics call (CLPRO-1473)
  - Update incompatibilities list for existing advices (CLPRO-1544)


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-13

changelog:
  - Fix advice sync with Wordpress plugin (CLPRO-1549, CLPRO-1572)
  - Add new two events (advice_synced, advice_sync_failed) to the analytics (CLPRO-1545)
  - Rewrite run.sh script logic to the Python (CLPRO-1554)
  - Reminder emails will never be sent with cached smart advice data (CLPRO-1546)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 0.6-15
changelog:
  - Added support for MyImunify Account protection advice (CLPRO-1489, CLPRO-1641)
  - Fixed E_NOTICE error in SmartAdvice plugin (CLPRO-1605)
  - Fixed error checking advice for the site in the SmartAdvice plugin (CLPRO-1606)
  - Fix checking advice_id variable (CLPRO-1622)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com>, Martin Krcho <mkrcho@cloudlinux.com> - 0.6-16

changelog:
  - Add ability to sync multiple users with microservice (CLPRO-1608)
  - Improve WP SmartAdvice installing and advice sync processes (CLPRO-1638)
  - Avoid problem with creating symlink to plugin file during installation of Smart Advice WP plugin (CLPRO-1637)


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Martin Krcho <mkrcho@cloudlinux.com> - 0.6-17

changelog:
  - Add alternative way of retriving php version through phpinfo (CLPRO-1574)
  - Replace edition specific check with universal cpapi feature supported (CLPRO-1531)
  - Use package version for WordPress plugins (CLPRO-1602)
  - Limit number of simultaneously running threads in XRay agent (CLPRO-1634)


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Martin Krcho <mkrcho@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 0.6-18

changelog:
  - Improve quality and usefulness of sentry reports (CLPRO-1516, CLPRO-1669)
  - Improve Sentry logging of analytics sending failures (CLPRO-1516)
  - Increase string length parameter during Sentry init (CLPRO-1578)
  - Fix disk quota exceeded on installing Smart Advice Plugin (CLPRO-1665)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-19

changelog:
  - Update website incompatibilities when AWP daemon is not running (CLPRO-1689)
  - Unify enabling End-User X-ray plugin across all editions (CLPRO-1657)
  - Extend analytics report for tracking upgrade url usage (CLPRO-1738, CLPRO-1769)


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-20
changelog:
  - Give WordPress plugin info and upload the zip archive to the site temp folder (CLPRO-1492)
  - Improve the analysis of errors in applying advice (CLPRO-713, CLPRO-1786)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 0.6-21
changelog:
  - Improve error handling in the SmartAdvice plugin (CLPRO-1816)
  - Bypass open_basedir restriction in WP SmartAdvice (CLPRO-1777)
  - Fix xray-continuous cron sends emails on errors (CLPRO-1871)


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com - 0.6-22
changelog:
  - Install Smart Advice WordPress plugin only if allowed by administrator (CLPRO-1924)
  - Added wordpress-plugin-uninstall which removes all installed Smart Advice plugins (CLPRO-1926)


author: alutsiuk <alutsiuk@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com> - 0.6-24
changelog:
  - Add support of translations in XRAY (CLPRO-1858)
  - Fixed php version detection in cPanel when selector is enabled (CLPRO-1457)


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-25
changelog:
  - Adding Imunify advice to the SmartAdvice plugin (CLPRO-2106, CLPRO-2107, CLPRO-2130, CLPRO-2108, CLPRO-1962, CLPRO-2157, CLPRO-2142)
  - Filter out advices for non-exist WordPress sites (CLPRO-2129)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> - 0.6-27
changelog:
  - Fixed an error on DirectAdmin "Unable to load dynamic library 'clos_ssa.so'" (CLPRO-1409)
  - Fix the display of the argument for CDN in the SmartAdvice plugin (CLPRO-2196)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Denis Komandyr <dkomandyr@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-28

changelog:
  - Fix SmartAdvice plugin installation when AccelerateWP is not active (CLPRO-2269)
  - Fix user count tracking in Sentry events (CLPRO-2238)
  - Improved SmartAdvice plugin update (CLPRO-2300)


author: Denis Komandyr <dkomandyr@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 0.6-29
changelog:
  - Added alt-php84 support (CLPRO-2398)
  - Fix getting advice list if there is advice for non-existing domain (CLPRO-2207)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-33
changelog:
  - Implement automatically creation of missed /usr/share/alt-php-xray-tasks/UID directories for all users (CLPRO-2491)
  - Fixed creation of wrong cron files (CLPRO-2622)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-34
changelog:
  - Removed accelerate-wp from dependencies of alt-php-xray (CLPRO-2201)
  - Fix saving tracing task url with comma (CLPRO-1796)


author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 0.6-35
changelog:
  - Domain with "www" prefix not recognized because "www" part is removed from its name that result in error (CLPRO-2752)
  - Optimization of the cl-smart-advice utility (CLPRO-2740)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-36
changelog:
  - Fixed issue when X-Ray is recognizing JTL-Shop or Shopware (eCommerce platforms) as WordPress sites (CLPRO-2154)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-41
changelog:
  - Added PHP 8.5 support for X-Ray (CLPRO-2916)
  - Part 2 of fix processes killed due to the xray.so module issue (CLPRO-2844)
  - Fix conflicts between X-Ray and Slow Site Analyzer modules on PHP85 (CLPRO-2929)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-46
changelog:
  - CLPRO-3015, CLPRO-3023: Security fixes for X-Ray
  - CLPRO-3055: Enable ea-php xray.so builds for CloudLinux 10


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-46
changelog:
  - CLPRO-3015, CLPRO-3023: Improved Smart Advice operations, helper scripts, and local service communication
  - CLPRO-3055: Enable ea-php xray.so builds for CloudLinux 10


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-47
changelog:
  - CLPRO-3049, CLPRO-3059: Improved PHP configuration handling, analytics processing, and local service communication


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-48
changelog:
  - CLPRO-3079: Improved Smart Advice operations, trace data processing, and local service communication


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.6-49
changelog:
  - CLPRO-3145: Improved trace data export, tracing task and PHP profiler data processing, and Smart Advice operations
  - CLPRO-3144: Implementation improvements and internal maintenance updates
  - CLPRO-3143: Improved Smart Advice operations and runtime configuration handling


author: Martin Krcho <mkrcho@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.5-27
changelog:
  - Improve sentry events (CLPRO-654, CLPRO-651)
  - Added CLI to activate advanced metrics (CLPRO-1080)


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.2.17-193
changelog:
  - Fix for hardened PHP
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.2.17-198
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-201
changelog:
  - Security fixes
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-203
changelog:
  - Security fixes
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-206
changelog:
  - Security fixes
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-207
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    injection


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-208
changelog:
  - Security fixes
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-210
changelog:
  - Security fixes
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-211
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-212
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-214
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-215
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-221
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.2 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-223
changelog:
  - ELS-2362: build litespeed SAPI with devtoolset-7 on CL6 (lsapi uses C11 __atomic builtins requiring gcc >= 4.7)


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.2.17-39
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql50, mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.
  - ALTPHP-1769: Build for RHEL 9.


author: Sergey Fokin <sfokin@cloudlinux.com> - 3-11
changelog:
  - add mysqlnd dependency for pdo_mysql for alt-php83
  - replace and backup ini with new if it was changed
  - rebuild alt-php.ini in posttrans section for alt-php >= 83


author: Eduard Chiganov <echiganov@cloudlinux.com> - 3-12
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.


author: Anatholy Scryabin <ascryabin@cloudlinux.com> 1-13
changelog:
  - update File_MARC to 1.4.1
  - update Mail_Mime to 1.10.11
  - update Net_SMTP to 1.10.0
  - update Net_Sieve to 1.4.5


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-121
changelog:
  - Updated gnupg to 1.5.1
  - Updated uploadprogress to 1.1.4
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-123
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved geos to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-125
changelog:
  - Moved timezonedb to separate package
  - Moved imagick to separate package
  - Added dependency to new xdebug extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-129
changelog:
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-131
changelog:
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-132
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-134
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-135
changelog:
  - ALTPHP-2013: Moved APC, ares, bcompiler, bloomy, big_int, bz2_filter, coin_acceptor to separate packages; add runtime requires


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-137
changelog:
  - ALTPHP-2016: Moved out extensions: SPL_Types, mongo, quickhash, radius, rsync, stem, stomp, translit, xrange, zendopcache


author: Eduard Chiganov <echiganov@cloudlinux.com> 2.1.0-1
changelog:
  - ALTPHP-1654: Newer version of memcached for alt-php 74-82.
  - EA4D-454: Create alt-phpXX-pecl-memcached.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.2.8-11
changelog:
  - ALTPHP-2283: Fix test crash from missing require_once files; fix testObject for Redis 7+ listpack.
  - ALTPHP-2283: Add PHP 5.2 early-exit to avoid running tests requiring 5.3+ features.


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-167
changelog:
  - ALTPHP-953: restart lsphp when update its binary
  - ALTPHP-1573: update LiteSpeed to 8.1
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-1713: add ext/curl/php_curl.h to devel sub-package


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-173
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-175
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-178
changelog:
  - Security fixes
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-179
changelog:
  - Security fixes
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-185
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.3.29-186
changelog:
  - ALTPHP-2049: Change method of creating php_handlers for plesk.
  - ALTPHP-2060: Rename alt-phpXY-fpm to alt-phpXY-php-fpm.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.3.29-189
changelog:
  - ALTPHP-2341: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.3.29-190
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php53/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-193
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.3 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.3 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Shawn Iwinski <shawn.iwinski@gmail.com> 2.1.2-1
changelog:
  - Updated to upstream version 2.1.2
  - PHP minimum version 5.3.3 instead of 5.3.2
  - Added PEAR package.xml modifications
  - Added patch for tests' bootstrap.php
  - Added tests (%check)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-155
changelog:
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-156
changelog:
  - ALTPHP-1778: Moved APM to separate package
  - ALTPHP-1779: Moved weakref to separate package
  - ALTPHP-1780: Moved solr to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-157
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-158
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-159
changelog:
  - ALTPHP-1087: Removed non-functional amqp package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-161
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-162
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-164
changelog:
  - ALTPHP-2014: Moved out extensions: crack, doublemetaphone, functional, haru, hidef, huffman, idn, inclued


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-165
changelog:
  - ALTPHP-2016: Moved out extensions: SPL_Types, libevent, mongo, ncurses, quickhash, radius, rsync, stem, stomp, translit, uri_template, xrange, zendopcache


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 4.3.0-11
changelog:
  - ALTPHP-2283: Fix testObject for Redis 7+ listpack encoding.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 4.1.6-1
changelog:
  - ALTPHP-1935: Support for tideways_xhprof for alt-php84.
  - ALTPHP-1957: Create alt-phpXX-pecl-xhprof-extension.


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.4.45-162
changelog:
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.4.45-173
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php54/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.4.45-178
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.4 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.4 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 0.14.2-1
changelog:
  - ALTPHP-2268: rebuild as PECL brotli extension
  - ALTPHP-2268: rename package to alt-php*-pecl-brotli


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-144
changelog:
  - Updated gnupg to 1.5.1
  - Updated uploadprogress to 1.1.4
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - Updated imagick to 3.7.0


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-150
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-151
changelog:
  - ALTPHP-1778: Moved APM to separate package
  - ALTPHP-1779: Moved weakref to separate package
  - ALTPHP-1780: Moved solr to separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-154
changelog:
  - ALTPHP-1087: Moved amqp to separate package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package
  - ALTPHP-1822: Moved oci8 to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-156
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1953: Moved libsodium to separate package


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-126
changelog:
  - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest
  - Remove generated zend_language files from tarball
  - Expand allowed version list for bison package


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-131
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.5.38-141
changelog:
  - Security fixes
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.5.38-153
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php55/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.5.38-155
changelog:
  - ALTPHP-2340: Add Conflicts with zend-guard-loader < 7.0.0-9 to opcache
    subpackage to block co-install with broken old zend-guard-loader versions


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-159
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.5 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.5 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.5.38-160
changelog:
  - Add caching_sha2_password authentication support to mysqlnd (backport from PHP 7.4),
    allowing connections to MySQL 8.0/8.4 servers using the default auth plugin
  - Add remaining utf8mb4_0900 collation ids 304-323 to mysqlnd charset table (MySQL 8.0.x/8.4)


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.5.38-161
changelog:
  - CLOS-4506: Fix lsphp site-isolation ctor overwriting per-vhost DOCUMENT_ROOT
  - ALTPHP-2448: Gate %postun per-user PHP Selector reset on Elevate upgrade markers


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-133
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved grpc to separate package
  - Moved geos to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-138
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-146
changelog:
  - ALTPHP-2016: Moved out extensions: SPL_Types, libevent, mongo, ncurses, quickhash, radius, rsync, stem, stomp, translit, uri_template, xrange


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 7.0.0-10
changelog:
  - ALTPHP-2340: Remove self-Obsoletes and Conflicts to fix DNF resolver conflict
    with old 7.0.0-8 still present in stable repos
  - ALTPHP-2340: Strip invalid RPATH from ZendGuardLoader.so to fix CL10 build
  - ALTPHP-2340: Exclude alt-php55-zend-guard-loader from RHEL >= 10 (no alt-php55-devel)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.6.40-108.1
changelog:
  - ALTPHP-2148: Remove erroneous HAVE_UNIX_H from php_config.h
  - ALTPHP-2132: remove php_handler header from /etc/psa/php_versions.d/alt-php*.conf


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-110
changelog:
  - ALTPHP-2132: update plesk's handler conf file
  - ALTPHP-2131: leave only one php.fpm config
  - EA4D-687: set error_log env in php.ini


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.6.40-117
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php56/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.6.40-122
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.6 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.6 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.6.40-80
changelog:
  - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest
  - Remove generated zend_language files from tarball
  - Constraint max version for bison package


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.6.40-14
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql50, mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.


author: Huseyn Hajizada <hhajizada@cloudlinux.com> 3.1.3-3
changelog:
  - Remove failing eio tests (custom_basic, grp_add, open_error, seek) on CL10 due to floating-point related issues in eio environment


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-113
changelog:
  - Moved timezonedb to separate package
  - Moved imagick to separate package
  - Moved xdebug to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-116
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension
  - ALTPHP-1790: Moved msgpack to separate package


author: Huseyn Hajizada <hhajizada@cloudlinux.com> 4.2.0-3
changelog:
  - Skip test 065phpt (Directory streams with RecursiveDirectoryIterator).
  PECL RAR dir_readdir returns full paths instead of single path components,
  so RecursiveDirectoryIterator only lists 4 files instead of 10. Proper fix
  belongs in rar_stream.c (php_rar_dir_ops_read).


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-92
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: Heap buffer overflow via str_repeat


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-96
changelog:
  - Security fixes
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-97
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-99
changelog:
  - Security fixes
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-103
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-110
changelog:
  - ALTPHP-2132: update plesk's handler conf file
  - ALTPHP-2131: leave only one php.fpm config
  - EA4D-687: set error_log env in php.ini
  - ALTPHP-2080: Refactor debian spec


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-112.2
changelog:
  - Security fixes
  - CVE-2015-9253: fix PHP-FPM exhaustion CPU and memory issue causing denial
    of service


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.0.33-118
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php70/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-124
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri
  - CVE-2026-7261: soap SoapServer use-after-free after header parsing failure
    when SOAP_PERSISTENCE_SESSION is set
  - CVE-2026-7568: metaphone() signed integer overflow when called with >INT_MAX
    byte input on 64-bit builds


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.0.33-125
changelog:
  - Add caching_sha2_password authentication support to mysqlnd (backport from PHP 7.4),
    allowing connections to MySQL 8.0/8.4 servers using the default auth plugin


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.0.33-69
changelog:
  - Fix for harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.0.33-71
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string
  - Fix build dependencies


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-86
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-93
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-96
changelog:
  - Moved swoole to separate package
  - Moved gender to separate package
  - Moved uuid to separate package
  - Moved rar to separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-98
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1755: Moved sqlsrv to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-99
changelog:
  - ALTPHP-1778: Added APM in separate package
  - ALTPHP-1779: Added weakref in separate package
  - ALTPHP-1780: Moved solr to separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-100
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-101
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1798: Added dependency to new apcu-bc extension
  - ALTPHP-1802: Moved rrd to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-103
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-104
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1953: Moved libsodium to separate package
  - ALTPHP-1958: Moved psr to separate package
  - ALTPHP-1961: Moved vips to separate package, now vips is supported on CL8 and CL9


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.81.0-1
changelog:
  - ALTPHP-2450: Update to 1.81.0 version
  - Build with GCC 10 on Ubuntu 20.04 (default GCC 9 ICEs on grpc 1.81.0)
  - Exclude PHP 8.4/8.5 on Ubuntu 16.04 (no alt-php84/85 for Xenial)


author: Eduard Chiganov <echiganov@cloudlinux.com> 3.2.15-1
changelog:
  - EA4D-454: Create alt-phpXX-pecl-igbinary.
  - ALTPHP-1686: Newer version of igbinary for alt-php 70-83.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 5.3.7-11
changelog:
  - ALTPHP-2283: Fix testObject for Redis 7+ listpack encoding.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.
  - ALTPHP-2283: Merge older-OS test skips into main patch; apply unconditionally.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 0.13.0-2
changelog:
  - ALTPHP-2282: EL10+ support for PHP <= 7.4:
    - PHP 7.0 still needs pcre1 (its own php_pcre.h #includes "pcre.h");
      use alt-pcre-devel from /opt/alt/pcre/ on EL10+
    - PHP 7.1-7.3 on EL10+ compile cleanly against pcre2-devel
      (pcre1 removed from EL10 base repos)
    - QA_RPATHS=0x0002 to allow /opt/alt/pcre/ rpath under EL10's
      stricter brp-check-rpaths (matches alt-pcre.spec itself)
    - Apply altea-2282-pcre-test-compat.patch: switch the affected
      phpt EXPECT/EXPECTF patterns to %A-anchored EXPECTF so they
      pass on both pcre1 (EL7-9) and pcre2 (EL10+) builds. Covers
      cookies_encryption_warning/*, broken_configuration/encrypt_regexp_cookies_bad_regexp,
      and upload_validation/upload_validation


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.1.33-62
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: heap buffer overflow via str_repeat


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-65
changelog:
  - Security fixes
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.1.33-66
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-70
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.33-84
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php71/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.33-92
changelog:
  - ALTPHP-2406: use alt-libicu65 for all OS
  - ALTPHP-2406: fix unversioned alt-libicu rpath on rhel<=8


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-83
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - ALTPHP-1507: Updated swoole to 4.8.13
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-84
changelog:
  - Moved uploadprogress to separate package
  - Moved newrelic to separate package
  - Added dependency to new scoutapm extension in separate package


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-22
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-23
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-47
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: heap buffer overflow via str_repeat
  - Fix #74267: segfault with streams and invalid data


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.2.34-50
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.2.34-52
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.2.34-66
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php72/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-87
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - alt-ImageMagick is linked statically now
  - Updated swoole to 4.8.13
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-90
changelog:
  - Moved swoole to separate package
  - Moved gender to separate package
  - Moved uuid to separate package
  - Added dependency to new rar extension in separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-93
changelog:
  - ALTPHP-1778: Added APM in separate package
  - ALTPHP-1779: Added weakref in separate package
  - ALTPHP-1780: Added solr in separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-98
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1958: Moved psr to separate package
  - ALTPHP-1961: Moved vips to separate package, now vips is supported on CL8 and CL9
  - ALTPHP-1956: Moved mcrypt to separate package
  - ALTPHP-1959: Moved pthreads to separate package (zts only)
  - Added missing links to zts extensions


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.0.7-2
changelog:
  - ALTPHP-2396: Add explicit Requires: libmcrypt so yum pulls libmcrypt
    from alt-common on CL10 instead of ea-libmcrypt (cPanel) which installs
    outside the system LD path.


author: Levon Matshkalyan <levon.matshkalyan@cloudlinux.com> - 5.0.4-3
changelog:
  - ALTPHP-2268: Add Provides/Obsoletes for zts in tideways-zts subpackage to support rename and avoid file conflicts


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-23
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-33
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-36
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.3.33-52
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php73/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-47
changelog:
  - ALTPHP-1269: Update xdebug to 3.1.4 version
  - Update timezonedb to version 2021.5
  - Update mongodb to version 1.13.0
  - Update swoole to version 4.8.9
  - Update pdo_sqlsrv to version 5.10.1
  - Update sqlsrv to version 5.10.1
  - Update imagick to version 3.7.0


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-66
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Added dependency to new bitset extension
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added dependency to new htscanner extension
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Moved leveldb to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-67
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1958: Moved psr to separate package
  - ALTPHP-1961: Moved vips to separate package, now vips is supported on CL8 and CL9
  - ALTPHP-1956: Moved mcrypt to separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-3
changelog:
  - ALTPHP-1355: fix linksafe for all sub-packages
  - fix rpath for zip extension
  - add alt-php74-imunify-leveldb provides


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-18
changelog:
  - ALTPHP-953: restart lsphp when update its binary
  - ALTPHP-1573: update LiteSpeed to 8.1
  - ALTPHP-1665: pack fpm as sub-package


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-28
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.4.33-43
changelog:
  - ALTPHP-2168: Add include= to php-fpm.conf
  - ALTPHP-2168: Make the paths in php-fpm.conf and logrotate even


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.4.33-49
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php74/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-53
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Added dependency to new bitset extension
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added dependency to new htscanner extension
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Added dependency to new leveldb extension


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.3.0-10
changelog:
  - ALTPHP-2283: Update to 6.3.0 version (fixes testServerInfo on Redis 8 / Valkey; upstream PR phpredis#2656).


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.3.0-11
changelog:
  - ALTPHP-2283: Fix test suite failures: add Redis version guards for tests requiring Redis 6.0+/6.2+.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.
  - ALTPHP-2283: Disable testIgnoreNumbers, testExists, testServerInfo, testPackHelpers (fail on older Redis / PHP 8.5).


author: Dmitriy Popov <dpopov@cloudlinux.com> - 8.0.30-8
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug
    causing password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-11
changelog:
  - Actually apply php-8.0-CVE-2024-3096.patch and php-8.0-CVE-2024-2756.patch
    for Ubuntu < 22.04 and Debian < 11 systems


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 8.0.30-23
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - fix regression in CVE-2024-11234 patch


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-25
changelog:
  - Security fixes
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix
  - CVE-2025-1220: fix null byte termination in hostnames


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.0.30-37
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php80/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.0.30-42
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
  - CVE-2025-14179: pdo_firebird SQL injection via NUL bytes in quoted strings
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri
  - CVE-2026-7259: mbstring NULL pointer dereference in php_mb_check_encoding()
    via mb_ereg_search_init() with Oniguruma-only encodings (iso-8859-11, UJIS,
    KOI8-R, ...)
  - CVE-2026-7261: soap SoapServer use-after-free after header parsing failure
    when SOAP_PERSISTENCE_SESSION is set
  - CVE-2026-7568: metaphone() signed integer overflow when called with >INT_MAX
    byte input on 64-bit builds


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-24
changelog:
  - update inotify to 3.0.0
  - update timezonedb to 2020.4
  - update xdebug to 3.1.4
  - update yaf to 3.3.5
  - ALTPHP-1313: Updated MongoDB to 1.14.0


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1-28
changelog:
  - ALTPHP-1402: update mailparse to 3.1.4
  - ALTPHP-1408: Redis extension updated to 5.3.7
  - yaz updated to 1.2.4


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1-28
changelog:
  - ALTPHP-1402: update mailparse to 3.1.4
  - ALTPHP-1408: Redis extension updated to 5.3.7
  - ALTPHP-1507: Swoole extension updated to 5.0.3
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - yaz updated to 1.2.4


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-31
changelog:
  - Fixed requires
  - Brought back yaf and gnupg
  - Updated uploadprogress to 2.0.2
  - Updated gnupg to 1.5.1
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-33
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved grpc to separate package
  - Moved redis to separate package
  - Added dependency to new geos ext


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-34
changelog:
  - Moved swoole to separate package
  - Moved uuid to separate package
  - Added dependency to new rar extension in separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-36
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1754: Moved xmlrpc to separate package
  - ALTPHP-1755: Moved sqlsrv to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-38
changelog:
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-39
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1802: Moved rrd to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-40
changelog:
  - ALTPHP-1087: Moved amqp to separate package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.9.3-2
changelog:
  - ALTPHP-2268: Fix building for PHP 8.5 (php_smart_string.h removed)
  - ALTPHP-2268: Fix building for PHP 8.5 (zend_exception_get_default() replaced with zend_ce_exception)
  - ALTPHP-2268: Fix BuildRequires for CL10 (pcre-devel removed, use pcre2-devel only)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.1.34-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php81/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.1.34-15
changelog:
  - ALTPHP-2406: use alt-libicu71 for all OS
  - ALTPHP-2406: drop duplicated 71 in PKG_CONFIG_PATH on rhel<=8


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-19
changelog:
  - Fixed requires
  - Updated mcrypt to 1.0.6
  - Updated vips to 1.0.13
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.2.5-2
changelog:
  - ALTPHP-1487: add opcache.jit_buffer_size=100M as default value to opcache.ini
  - rebuild without ffi for rhel < 7
  - add provides and obsoletes for alt-php-internal-sqlite3


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.2.16-1
changelog:
  - update to 8.2.16
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-953: restart lsphp wheb update its binary


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.2.30-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php82/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-20
changelog:
  - Fixed requires
  - Updated mcrypt to 1.0.6
  - Updated vips to 1.0.13
  - Updated yaml to 2.2.3
  - Updated igbinary to 3.2.14
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-31
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Moved leveldb to separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.3-1
changelog:
  - update to 8.3.3
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-953: restart lsphp wheb update its binary


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.3.30-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php83/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.30-1
changelog:
  - ALTPHP-2281: update to 8.3.30
  - build percona5.7 without stick to version of alt-php
  - rollback building mysql5.6 for CL9


author: Eduard Chiganov <echiganov@cloudlinux.com> - 8.4.0-0.rc3
changelog:
  - ALTPHP-1880: Updated to RC3.
  - ALTPHP-1860: Remove deprecated sid_length and sid_bits settings.
  - Disabled thread safety by default.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.4.18-3
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php84/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.4.17-1
changelog:
  - ALTPHP-2280: Update to 8.4.17 version
  - build percona5.7 without stick to version of alt-php
  - rollback building mysql5.6 for CL9


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-3
changelog:
  - ALTPHP-1935: Added xhprof in separate package
  - ALTPHP-1946: Added bitset in separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added htscanner in separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Added leveldb in separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-4
changelog:
  - ALTPHP-2043: add to requires:
      alt-php84-newrelic
      alt-php84-pecl-gender
      alt-php84-pecl-propro


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1-4.1
changelog:
  - ALTPHP-2053: Added alt-php84-pspell to requires.
  - Added libssh2-devel for requires, becase ssh2 module requires it.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-5
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1953: Moved libsodium to separate package
  - ALTPHP-1958: Moved psr to separate package
  - ALTPHP-1961: Moved vips to separate package, now vips is supported on CL8 and CL9
  - ALTPHP-1956: Moved mcrypt to separate package
  - ALTPHP-2063: Removed unsupported propro extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 4.2.6-3
changelog:
  - Use PECL version instead of testing one
  - ALTPHP-2063: Add obsoletes for alt-php-pecl-propro on PHP8


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.5.3-4
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php85/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 2.1-11
changelog:
  - KMODLVE-553 liblve debian packaging fix
  - CAG-1221: make CageFS namespaces persistent
  - KMODLVE-549 secureio symbol visible fixes
  - KMODLVE-548 lto build fix
  - KMODLVE-536  lto support
  - KMODLVE-544: make lve* functions work without LVE
  - KMODLVE-521 cl9 support
  - CAG-1208: implement entering CageFS without LVE
  - CAG-1208: implement CageFS without LVE


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, nkeshelava <nkeshelava@cloudlinux.com> - 2.2-1

changelog:
  - CLOS-3672: Implementation for website isolation feature
  - CLOS-3755: Apply per user mounts to website isolation
  - CLOS-3719: Setup /tmp for website isolation feature
  - CLOS-3772: Optimize mount calls for website isolation
  - CLOS-3764: Add caching of website isolation namespaces
  - CLOS-3717: Drop capabilities only when present


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 2.2-2
changelog:
  - CLOS-3912: Add NULL pointer validation in jail functions to prevent crashes
  - CLOS-3942: Fix failure on Solo when process cannot enter CageFS


author:
  Oleksandr Shyshatkyi <oshyshatskyi@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 2.2-4

changelog:
  - CLOS-3996: Consolidate domain ID registry into universal C module with Python bindings
  - CLOS-3964: Implemented hierarchical LVP support in lve-kmod


author: Georgy Lepsaya <glepsaya@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> - 2.2-6
changelog:
  - CLOS-4382: Skip cgroup-v1 mount loop in lve-kmod.sh on cgroup-v2 systems
  - CLOS-4343: Fix per-site namespace cache directory permissions in jail.c after a non-isolated request


author: Dmitry Shibut <dshibut@cloudlinux.com> 3.3.0-1
changelog:
  - CLOS-1868: Improve may_detach_mounts kernel option detection process
  - CLOS-1599: Migrate to Python 3.11


author:
  Roman Krompets <rkrompets@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 3.3.1-1

changelog:
  - CLPRO-436: Renamed variables to ensure better consistency and clarity
  - AWP-755: Implement Custom Panel integration support by AccelerateWP


author: Roman Prilipskii <rprilipskii@cloudlinux.com> 3.3.3-1
changelog:
  - CLOS-1952: Fix MySQL localhost connection issues when using sockets
  - CLOS-1880: Improve package modification hook calling mechanism


author:
  oshyshatskyi <oshyshatskyi@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.3.7-1

changelog:
  - CLPRO-1395, CLPRO-1396: Add DirectAdmin support to AccelerateWP
  - CLPRO-1343: Fix bug in handling additional Plesk domains


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, oshyshatskyi <oshyshatskyi@cloudlinux.com> 3.3.8-1
changelog:
  - CLPRO-1405: Added method to return panel link to AccelerateWP page
  - CLPRO-1282: Implement automatic metrics discovery


author: Daniil Danilkin <ddanilkin@cloudlinux.com>, oshyshatskyi <oshyshatskyi@cloudlinux.com> 3.3.9-1
changelog:
  - CLPRO-1377: Fixes MySQL UDS resolution from configs
  - CLPRO-1440: Remove 5-minute "edition checking" cron


author:
  Daniil Danilkin <ddanilkin@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 3.3.11-1

changelog:
  - CLPRO-1522: Fix nginx configuration parser
  - CLPRO-1613: Add support for quotes in DocumentRoot apache directive


author: Grigory Ponomarenko <gponomarenko@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.3.12-1
changelog:
  - CLOS-1996: Adapt CL Solo / CL Admin to work on Virtuozzo
  - CLPRO-1585: Add ability to activate AccelerateWP Premium from Centralized Monitoring
  - CLPRO-1531: Extend universal features list with required for unification


author: alutsiuk <alutsiuk@cloudlinux.com> 3.3.14-1
changelog:
  - CLPRO-1658: Improve remove cagefs mountpoint helper
  - CLPRO-1666: Extend clcaptain utility with AccelerateWP paths


author:
  Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com> 3.3.15-1

changelog:
  - CLPRO-1668: Added method for searching username by Plesk subscription
  - CLPRO-1657: Unify UI icons display defaults across all editions
  - CLOS-2227: Make Python/Nodejs Selector work on CL Solo
  - CLOS-2375: Add support for Apache mod_lsapi PRO on CL Solo


author: Aleksey Petryankin <apetryankin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.2.47-1
changelog:
  - AWP-403: Implement caching of cpapi method get_domains_php_info for cPanel
  - LVEMAN-1890: Enable Python/NodeJs selectors for VZ container


author:
  Dmitry Shibut <dshibut@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 3.2.48-1

changelog:
  - PTCLLIB-256: Improve RPM DB consistency checking procedure
  - PTCLLIB-257: Improve passenger package name retrieval
  - LVES-1098: Assign a Message ID to alert email messages automatically if none was provided
  - LU-3815: public API version 1.3 -- supported features list extended with AccelerateWP and CL Wizard


author: Dmitry Shibut <dshibut@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.2.49-1
changelog:
  - LU-3700: Move userland projects to cl.sentry.cloudlinux.com
  - AWP-738: Filter out invalid php installed strings on Plesk


author: Roman Krompets <rkrompets@cloudlinux.com> 3.4.0-1
changelog:
  - CLPRO-1559: Added new panel features required for unification
  - CLPRO-1607: Added methods to detect if customer hitting hosting accounts limit
  - CLPRO-1825: Fixed permission issue for server flags directory
  - CLPRO-1872: Change ordering of edition features check
  - CLPRO-1823: Fix new autotracing feature is required on Vendor Panels


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 3.4.1-1

changelog:
  - CLPRO-1055: Extend CPAPI with suspended users list
  - CLPRO-1899: Added Sentry tag to detect WP2 environments
  - CLOS-2350: Add fault tolerance inside lvectl for when a UID cannot be found
  - CLPRO-1873: Internal refactoring: simplify code which detects supported features
  - CLPRO-1843: Improve logging of unexpected errors in code that gathers php data


author:
  Timur Kalimullin <tkalimullin@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 3.4.2-2

changelog:
  - CLPRO-1905: Add the ability to run the set-suite command asynchronously in configure_accelerate_wp
  - CLPRO-1996: Automatically clean DirectAdmin domains cache on changes in control panel


author: Vladimir Lebedev <vlebedev@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 3.4.3-1
changelog:
  - CLOS-2260: CL Shared Pro license is being detected as Solo on the server
  - CLOS-1860: Complete migration to Python 3.11


author: Vladimir Lebedev <vlebedev@cloudlinux.com> 3.4.4-1
changelog:
  - CLOS-1600: Handle UnicodeDecodeError when parsing configs containing broken utf-8
  - CLOS-2576: Make "secureio" module lazy-loadable and importable even in case of shared libraries absence


author: Mykola Ishchenko <mishchenko@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com> 3.4.7-1
changelog:
  - CLOS-2597: Fix issue with MySQL connections on Ubuntu due to failing to find the socket file
  - CLPRO-1564: Fix get_domains_php_info on DirectAdmin when httpd.conf is huge


author: Denis Komandyr <dkomandyr@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 3.4.12-1
changelog:
  - CLPRO-2238: Fix user count tracking in Sentry events
  - CLOS-2902: Ignore decimal points in CPU limits


author: alutsiuk <alutsiuk@cloudlinux.com>, Denis Komandyr <dkomandyr@cloudlinux.com> 3.4.13-1
changelog:
  - CLPRO-2238: Fix logging to stderr when failed to obtain machine ip and hostname
  - CLPRO-2292: Optimize wp cache plugin search


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Averianov <taverianov@cloudlinux.com> 3.4.15-1
changelog:
  - CLOS-3024: Fix MySQLConnector closing issues
  - CLPRO-2240: Turn off aggressive debug info for CMT requests


author: Dmitry Shibut <dshibut@cloudlinux.com> 3.4.16-1
changelog:
  - CLOS-2907: Improve error handling during the server flag statistics gathering process
  - CLPRO-2301: Fix getting php version for aliases on DirectAdmin


author:
  Dzmitry Ryzhykau <dryzhykau@cloudlinux.com>, Tamar Tsotniashvili <ttsotniashvili@cloudlinux.com> 3.4.17-1

changelog:
  - CLOS-2865: Remove fallback edition value when detecting current CL edition; return None when edition cannot be detected
  - CLOS-2896: Fix error in retrieving dblogin-username pairs on DirectAdmin when ONLY_FULL_GROUP_BY is active


author: Denis Komandyr <dkomandyr@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 3.4.18-1
changelog:
  - CLPRO-2480: Skip activation of Accelerate WP Free by Vendor config
  - CLOS-2083: Adapt cllib CL version retreival to handle Ubuntu versions


author: Roman Prilipskii <rprilipskii@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.4.19-1
changelog:
  - CLOS-3122: Fix package presence detection logic on Ubuntu
  - CLPRO-2527: Fix cloudlinux-summary WordPress statistics collection


author: alutsiuk <alutsiuk@cloudlinux.com> 3.4.20-1
changelog:
  - CLPRO-2566: Unlocked CLPRO features for Ubuntu
  - CLPRO-2566: Fix alt-php modules dir detection
  - CLPRO-2533: Adapt accelerate-wp installation for Ubuntu22


author: Dzmitry Ryzhykau <dryzhykau@cloudlinux.com> 3.4.24-1
changelog:
  - CLOS-2881: Fix CageFS detection (clcommon.clcagefs.in_cagefs) when /var/.cagefs exists in the real file system


author: Roman Krompets <rkrompets@cloudlinux.com> 3.4.26-1
changelog:
  - CLPRO-2201: Unbind accelerate-wp from X-Ray
  - CLOS-3323: Revert to previous in_cagefs() logic based on /var/.cagefs check


author: Danila Vershinin <dvershinin@icloud.com>, Roman Suvorov <rsuvorov@cloudlinux.com> 3.4.27-1
changelog:
  - MAXWS-480: Add parameter "environment" to function clsentry.init_sentry_sdk_client
  - MAXWS-448: Added useraddondomains() for cPanel


author: mikalai <mvoina@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.4.29-1
changelog:
  - CLOS-2699: Fix traceback in physical_hosting_updated after modifying a domain on Plesk
  - MAXWS-598: add hooks interface for account suspension/unsuspension


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 3.4.30-1
changelog:
  - CLOS-3303: Spread the load of 5-minute cron jobs to prevent resource usage spikes
  - CLOS-3523: Modify the OS detection logic to identify CL10 machines correctly


author: Roman Prilipskii <rprilipskii@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> 3.4.34-1
changelog:
  - CLOS-3849: Correct LVE availability detection under user environments in cagefs
  - CLPRO-2819: Fix performance issue in _docroot_under_root


author:
  Andrei Zheregelia <azheregelia@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 3.4.40-1

changelog:
  - CLOS-4128, CLOS-4280: internal bugfixes
  - CLOS-4470: Fix hook name/domain validation failures for Unicode inputs on Plesk


author: Eduard Chiganov <echiganov@cloudlinux.com> - 3.10.13-1
changelog:
  - ALTPYTH-486: Updated to 3.10.12
  - ALTPYTH-478: fixed pam authentication through ssl
  - ALTPYTH-481: Updated to 3.10.13


author: Davit Sargsyan <dsargsyan@cloudlinux.com> - 3.14.3-1
changelog:
  - ALTPYTH-587: Update to Python 3.14.3
  - CVE-2025-15367: fix poplib command injection
  - CVE-2025-15366: Reject control characters in IMAP commands


author: Davit Sargsyan <dsargsyan@cloudlinux.com> - 0.45.1-1
changelog:
  - ALTPYTH-587: Update to upstream wheel 0.45.1 for Python 3.14
  - CVE-2026-24049 : fix path traversal in wheel unpack


author: Eduard Abdullin <eabudllin@cloudlinux.com> - 3.7.11-4
changelog:
  - ALTPYTH-364: Fix build for old system
  - ALTPYTH-381: Added check for cl solo
  - ALTPYTH-380: Added cloudlinux-linksafe to Requires(post)


author: Eduard Chiganov <echiganov@cloudlinux.com> - 0.28.1-8
changelog:
  - ALTPYTH-467: Get rid of alt-python dependencies errors.
  - New linksafe post, triggerin and triggerun scripts.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1.2.2-7
changelog:
  - ALTPYTH-464: Fixed failed dependecies through update of filter.
  - New linksafe post, triggerin and triggerun scripts.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 20.2.4-5
changelog:
  - ALTPYTH-458: Fix dependency error while install alt-python37.
  - New filter for provides, new post scriplets


author: Sergey Fokin <sfokin@cloudlinux.com> 3.8.12-2
changelog:
  - ALTPYTH-413: move -fno-semantic-interposition to CFLAGS_NODIST
  - remove changing gcc to devtoolset-gcc
  - change BuildRequire from gcc-toolset to system gcc for CL8


author: Eduard Chiganov <echiganov@cloudlinux.com> - 4.2.0-3
changelog:
  - ALTPYTH-474: Change specs for alt-python for new linksafe add method.
  - Created patch for unit tests.


author: Remi Collet <remi@remirepo.net> - 6.0.9-3
changelog:
  - move configuration in /etc/redis per upstream recommendation
    see https://github.com/redis/redis/issues/8051


author: Remi Collet <remi@remirepo.net> - 6.2.0-1
changelog:
  - Redis 6.2.0 GA - Released Tue Feb 22 14:00:00 IST 2021
  - Upgrade urgency: SECURITY if you use 32bit build of redis,
    MODERATE if you used earlier versions of Redis 6.2, LOW otherwise


author: Remi Collet <remi@remirepo.net> - 6.2.2-1
changelog:
  - Redis 6.2.2 - Released Mon April 19 19:00:00 IST 2021
  - Upgrade urgency: HIGH, if you're using ACL and pub/sub,
    CONFIG REWRITE, or suffering from performance regression.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 2.4.10-15
changelog:
  - ALR-140: Fixed mistake in net-telnet version description (epoch added).
  - Conflicts dependencies added.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 2.6.10-9
changelog:
  - ALR-140: Mistake in net-telnet version description was fixed through epoch usage.
  - Conflicts dependencies added.
  - ALR-150: Updated to 2.6.10-9 release to prevent rubygems version conflicts.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 2.7.6-138
changelog:
  - ALR-140: Mistake in net-telnet version description was fixed through epoch usage.
  - ALR-149: Patch for ipaddr fixed.
  - ALR-151: Update to 2.7.6 version
  - Conflicts dependencies added.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 3.0.4-161
changelog:
  - ALR-153: Updated to 3.0.4
  - Patch 23 (Fix-stack-buffer-overflow) disabled because fixed in upstream.
  - Broken symlink in ruby-libs deleted.


author: Radek Vykydal <rvykydal@redhat.com> - 34.25.3.1-1
changelog:
  - Add DNS search and ignore options from kickstart (vslavik)
    Resolves: rhbz#2065754
  - driver_updates: migrate driver_updates.py to pep8 format (jkonecny)
    Related: rhbz#2154906
  - driver_updates: adding tests for the new logging solution (jkonecny)
    Related: rhbz#2154906
  - driver_updates: add lot of debug logs for easier debugging (jkonecny)
    Related: rhbz#2154906
  - driver_updates: extend where we print log messages (jkonecny)
    Resolves: rhbz#2154906
  - Add missing documentation about OEMDRV (jkonecny)
    Related: rhbz#2171811
  - oemdrv: wait up to 5 seconds for disks to be handled (rmetrich)
    Resolves: rhbz#2171811


author: Vladimír Slávik <vslavik@redhat.com> - 34.25.3.2-1
changelog:
  - Fix kickstart proxy cmd in stage1 (jkonecny)
    Resolves: rhbz#2177219
  - Check minimal LUKS passphrase length in FIPS mode for Kickstart (vslavik)
    Resolves: rhbz#2163497
  - GUI: Require 8 chars of LUKS passwords in FIPS mode (vslavik)
    Resolves: rhbz#2163497
  - Use inst.proxy in stage1 (jkonecny)
    Resolves: rhbz#2177219
  - Change driver_updates exit info messages to debug (jkonecny)
    Related: rhbz#2154906


author: Vladimír Slávik <vslavik@redhat.com> - 34.25.3.3-1
changelog:
  - Stop infinite wait for CDROM when KS is processed (jkonecny)
    Resolves: rhbz#2209599
  - Apply --noverifyssl option for liveimg kickstart command (jstodola)
    Resolves: rhbz#2157921


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.3.4-1
changelog:
  - Warn about deprecated inst.geoloc=provider_... (vslavik)
    Resolves: rhbz#2127473
  - Improve doc strings for geolocation (vslavik)
    Related: rhbz#2127473
  - Do not run geolocation for TUI (vslavik)
    Resolves: rhbz#2127473
  - gui: Simplify invalid timezone handling. (vslavik)
    Related: rhbz#2127473
  - Try to set timezone from language on welcome spoke (vslavik)
    Resolves: rhbz#2127473
  - Always set timezone with priority (vslavik)
    Resolves: rhbz#2127473
  - Add timezone priority to module backend and interface (vslavik)
    Resolves: rhbz#2127473
  - Use existing locale in welcome spoke (vslavik)
    Resolves: rhbz#2127473
  - Apply geolocation in main process (vslavik)
    Related: rhbz#2127473
  - Add back waiting for geolocation (vslavik)
    Related: rhbz#2127473
  - Add wait_for_task() to wait for a Task with timeout (vslavik)
    Related: rhbz#2127473
  - Don't fall back to default timezone in welcome spoke (vslavik)
    Related: rhbz#2127473
  - Use directly URLs in conf geoloc provider field (vslavik)
    Related: rhbz#2127473
  - Remove unmodularized geolocation (vslavik)
    Related: rhbz#2127473
  - Use modularized geolocation instead of unmodularized (vslavik)
    Related: rhbz#2127473
  - Hide the geolocation task in Timezone's interface (vslavik)
    Related: rhbz#2127473
  - Add GeolocationTask to the Timezone module (vslavik)
    Related: rhbz#2127473
  - Add a D-Bus structure for geolocation data (vslavik)
    Related: rhbz#2127473
  - Add conf option for geolocation provider (vslavik)
    Related: rhbz#2127473
  - Retranslate welcome screen more simply (vslavik)
    Related: rhbz#2127473
  - Fix translations of the pre-release warning dialog (vponcova)
    Resolves: rhbz#2165762
    Related: rhbz#2127473
  - Split Timezone module tests for tasks to new file (vslavik)
    Related: rhbz#2127473
  - Make check for geolocation start a standalone helper (vslavik)
    Related: rhbz#2127473
  - Keep Timezone proxy in Welcome spoke (vslavik)
    Related: rhbz#2127473
  - Split starting locales in welcome spoke to a helper (vslavik)
    Related: rhbz#2127473
  - Rename constant to reflect its usage (vslavik)
    Related: rhbz#2127473
  - Fix "proxy" boot option is printing inst. warning (jkonecny)
    Related: rhbz#2177219
  - Allow showing proxy passwords on the installation source spoke (jstodola)
    Resolves: rhbz#2013190
  - Allow showing passwords on the subscription spoke (jstodola)
    Resolves: rhbz#2013190
  - Always hide the user password by default (jstodola)
    Related: rhbz#2013190
  - Always hide the root password by default (jstodola)
    Related: rhbz#2013190


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.3.5-1
changelog:
  - Add option for installing RedHat kernel (ozobal)
    Related: rhbz#2164819
    Resolves: rhbz#2214266
  - Add TUI for installing non-standard kernels (ozobal)
    Resolves: rhbz#2214266
    Resolves: rhbz#2164819
  - Add GUI option for installing 64k ARM kernel (ozobal)
    Resolves: rhbz#2214266
    Resolves: rhbz#2164819
  - Add match_available_packages to dnf_manager (ozobal)
    Related: rhbz#2214266
    Related: rhbz#2164819


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.3.6-1
changelog:
  - Remove unused variable in TUI software selection (ozobal)
    Related: rhbz#2214266
    Related: rhbz#2164819
  - Fix aarch64 architecture detection (jstodola)
    Resolves: rhbz#2164819


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.3.7-1
changelog:
  - Allow showing passphrase when unlocking LUKS device (jstodola)
    Resolves: rhbz#2013190
  - Be more indulgent when reclaiming disk space (jstodola)
    Resolves: rhbz#2187371
  - Do not print error on inst.ks=cdrom|hd (jkonecny)
    Resolves: rhbz#2077045


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.3.8-1
changelog:
  - iscsi: Allow changing iSCSI initiator name once set (vtrefny)
    Resolves: rhbz#2223977
  - Missing translation for button labels in Beta dialog
    Resolves: rhbz#2225450


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.3.9-1
changelog:
  - timezone: for kickstart allow also timezones not offered by GUI (rvykydal)
    Resolves: jira#RHEL-13150
  - Rename Organization to Organization ID on subscription screen (mkolman)
    Resolves: jira#RHEL-11167


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.2-1
changelog:
  - tests: Add a test case for the NVMe module (vtrefny)
    Resolves: RHEL-11543
    Resolves: RHEL-11544
  - Add a simple NVMe module for NVMe Fabrics support (vtrefny)
    Resolves: RHEL-11543
    Resolves: RHEL-11544
  - network: ignore BOOTIF connections when creating device configurations
    (rvykydal)
    Resolves: RHEL-4766
  - network: ignore BOOTIF connections when looking for initramfs bond ports
    (rvykydal)
    Resolves: RHEL-4766


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.3-1
changelog:
  - Fix missing emit of zfcp kickstart statements (maier)
    Related: RHEL-11384
  - DeviceTreeViewer: Add path-id attribute to zfcp-attached SCSI disks (maier)
    Related: RHEL-11384
  - Fix missing WWID values for multipath devices in advanced storage UI
    (#2046654) (maier)
    Resolves: RHEL-11384
  - rescue: Don't allow to mount systems without a root device (vponcova)
    Resolves: RHEL-14696
  - Do not crash on default None values of ostreecontainer command (rvykydal)
    Related: RHEL-2250
  - Fix wrong dracut timeout message (jkonecny)
    Resolves: RHEL-5638
  - Move rpm-ostree deps from Lorax to Anaconda (#2125655) (jkonecny)
    Related: RHEL-2250
  - Implement needs_network for rpm_ostree_container (#2125655) (jkonecny)
    Related: RHEL-2250
  - Add tests for RPM Ostree payload with source from container (#2125655)
    (rvykydal)
    Related: RHEL-2250
  - Enable RPM OSTree from container source in payload (#2125655) (rvykydal)
    Resolves: RHEL-2250
  - Add RPM OSTree source from container (#2125655) (rvykydal)
    Related: RHEL-2250


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.5-1
changelog:
  - bootupd: Use --write-uuid (walters)
    Related: RHEL-17205
  - bootloader: Detect bootupd and skip regular install (vslavik)
    Related: RHEL-17205
  - ostree: Use bootupd if installed by payload (vslavik)
    Resolves: RHEL-17205
  - bootloader: Create an installation task for collecting kernel arguments
    (vponcova)
    Related: RHEL-17205
  - bootloader: Add the collect_arguments method (vponcova)
    Related: RHEL-17205
  - bootloader: Remove the install_boot_loader function (vponcova)
    Related: RHEL-17205
  - Apply the bootloader options before the installation (vponcova)
    Related: RHEL-17205


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.6-1
changelog:
  - Disable bug reporting to Bugzilla from anaconda (kkoukiou)
    Resolves: RHEL-24419
  - Fixed file-write operation to a public directory (ataf)
    Resolves: RHEL-23345


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.4.7-1
changelog:
  - Lower log file permission in /tmp (jkonecny)
    Resolves: RHEL-23345
  - Add utility function to set file mode (jkonecny)
    Related: RHEL-23345


author: Martin Kolman <mkolman@redhat.com> - 34.25.5.9-1
changelog:
  - network: ignore kickstart configuration of nBFT devices (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: do not dump configurations of nBFT devices (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: ignore nBFT devices connections in network configuration (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: add a test for ignoring ifname=nbft* for device renaming (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: do not create empty dir for only ifname=nbft* options (rvykydal)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - network: Avoid creating link files for 'nbft' interfaces (tbzatek)
    Resolves: RHEL-30149
    Resolves: RHEL-34235
    Resolves: RHEL-32146
  - Update translations from Weblate for rhel-9 (github-actions)


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.5.10-1
changelog:
  - Fix check for biosboot partition in GRUB2.check (vtrefny)
    Resolves: RHEL-55922
  - Ignore all storage errors when trying to activate swaps (vtrefny)
    Resolves: RHEL-55922


author: Martin Kolman <mkolman@redhat.com> - 34.25.5.11-1
changelog:
  - security: call /usr/libexec/fips-setup-helper (asosedkin)
    Resolves: RHEL-58667
  - release-notes: Document support for compressed kernel modules in Driver Discs
    (peter.georg)
    Related: RHEL-9913
  - Add documentation about support for compressed kernel modules (peter.georg)
    Resolves: RHEL-9913
  - dd_extract: Update test info to reflect added support for compressed kernel
    modules (peter.georg)
    Resolves: RHEL-9913
  - dd_extract: Add test for zstd compressed kernel module (peter.georg)
    Resolves: RHEL-9913
  - dd_extract: Add test for xz compressed kernel module (peter.georg)
    Resolves: RHEL-9913
  - dd_extract: Add support for compressed kernel modules (peter.georg)
    Resolves: RHEL-9913
  - New version - 34.25.5.10 (k.koukiou)


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.5.13-1
changelog:
  - security: require pykickstart version with %certificates support (rvykydal)
    Resolves: RHEL-61430
  - security: do not crash initramfs ks parsing on failing certificate dump
    (rvykydal)
    Resolves: RHEL-61430
  - security: add service to transfer certificates from initramfs (rvykydal)
    Resolves: RHEL-61430
  - security: import certificates in initramfs (rvykydal)
    Resolves: RHEL-61430
  - security: install certificates in pre-install phase only for dnf payload
    (rvykydal)
    Resolves: RHEL-61430
  - security: raise exception if certificate destination is unknown (rvykydal)
    Resolves: RHEL-61430
  - security: log a warning when dumping certificate over an existing file
    (rvykydal)
    Resolves: RHEL-61430
  - security: pre-install certificates before payload installation (rvykydal)
    Resolves: RHEL-61430
  - security: add API to install certificates early before payload (rvykydal)
    Resolves: RHEL-61430
  - security: install certificates on target system (rvykydal)
    Resolves: RHEL-61430
  - security: Add API for installation on target system (rvykydal)
    Resolves: RHEL-61430
  - security: import certificates early after Anaconda start (rvykydal)
    Resolves: RHEL-61430
  - security: add API to import certificates to Anaconda environment (rvykydal)
    Resolves: RHEL-61430
  - security: add API: Certificate getter (rvykydal)
    Resolves: RHEL-61430
  - kickstart: extend section specification for list of section data (rvykydal)
  - security: implement the support to install certificates to Anaconda
    (rvykydal)
    Resolves: RHEL-61430
  - translations: bump dependency to l10n repo because of branch switch
    (k.koukiou)
  - util: correct errors and suppress stderr for common cases (riehecky)
  - util: Add additional information for EFI systems (riehecky)
    Resolves: RHEL-55128


author: Radek Vykydal <rvykydal@redhat.com> - 34.25.5.15-1
changelog:
  - security: add a development note for certificates import in initramfs
    (rvykydal)
    Related: RHEL-77155
  - security: do not issue warning on existing certificate file during dump
    (rvykydal)
    Resolves: RHEL-77155
  - network: pass NM global dns configuration to the installed system (rvykydal)
    Resolves: RHEL-71824
  - network: pass global dns initrd option to the installed system (rvykydal)
    Resolves: RHEL-71824


author: Radek Vykydal <rvykydal@redhat.com> - 34.25.5.16-1
changelog:
  - network: add dnsconfd to selected packages if used in installer (rvykydal)
    Resolves: RHEL-79803
  - network: add dnsconfd to installer environment (rvykydal)
    Resolves: RHEL-79804


author: Radek Vykydal <rvykydal@redhat.com> - 34.25.5.17-1
changelog:
  - network: start dnsconfd in initramfs (rvykydal)
    Resolves: RHEL-80303
  - network: enable dnsconfd service on installed system if required (rvykydal)
    Resolves: RHEL-80023
  - network: pass 16-dns-backend.conf to target system (rvykydal)
    Resolves: RHEL-80233
  - netowrk: enable dnsconfd service in installer environment (rvykydal)
    Resolves: RHEL-80023


author: Katerina Koukiou <kkoukiou@redhat.com> - 34.25.5.1-1
changelog:
  - anaconda-diskroot: wait before dying on media check fail (awilliam)
    Resolves: RHEL-4790
  - Add ping tool to Dracut (jkonecny)
    Resolves: RHEL-5719
  - gui:Fix index error for _remove_treeinfo_repositories() (liuwenyu.0311)
    Resolves: RHEL-29561


author: Katerina Koukiou <kkoukiou@redhat.com> - 34.25.5.3-1
changelog:
  - Fix Source0 in spec to point to upstream source URL (kkoukiou)
  - Do not try to load sha256 module in intramfs (rvykydal)
    Resolves: RHEL-4747
  - Do not try to load the floppy kernel module (jstodola)
    Resolves: RHEL-4747
  - anaconda-modprobe: don't try and load cramfs (awilliam)
    Resolves: RHEL-4747


author: Katerina Koukiou <kkoukiou@redhat.com> - 34.25.5.5-1
changelog:
  - Update translations from Weblate for rhel-9
  - Do not rewrite logs in rescue mode (jstodola)
    Resolves: RHEL-4794
  - Write a warning rescue selinux (akankovs)
    Resolves: RHEL-14005
  - Fix kickstart --dhcpclass option application (rvykydal)
    Resolves: RHEL-30406


author: Katerina Koukiou <kkoukiou@redhat.com> - 34.25.5.6-1
changelog:
  - Update translations from Weblate for rhel-9
  - Change location of rescue mode flag file (jstodola)
    Resolves: RHEL-4794


author: Radek Vykydal <rvykydal@redhat.com> - 34.25.5.7-1
changelog:
  - Fix source spoke being inaccessible if payload thread errors out (mkolman)
    Resolves: RHEL-4721
  - Do not create default wired connections for bond ports (rvykydal)
    Resolves: RHEL-38451
  - Consolidate code for dumping network connections (rvykydal)
    Related: RHEL-38451


author: Martin Kolman <mkolman@redhat.com> - 34.25.5.8-1
changelog:
  - Use proxy server also for FTP .treeinfo download (jkonecny)
    Resolves: RHEL-27938
  - Update translations from Weblate for rhel-9 (github-actions)


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.7.5-1
changelog:
  - bootloader: drop write_config_console, just preserve console= (awilliam)
    Resolves: RHEL-98670
  - payload/rpm-ostree: Include program output in exception (walters)
    Resolves: RHEL-45184


author: Martin Kolman <mkolman@redhat.com> - 34.25.7.6-1
changelog:
  - Fix vconsole layout doesn't work for ostree (jkonecny)
    Resolves: RHEL-101057
  - test: make dnf substitutions test check only relevant values (rvykydal)
  - test: add new substitution members in dnf tests (rvykydal)


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.7-1
changelog:
  - pyanaconda: payload: return exception details for payload failures
    (k.koukiou)
  - ui: tui: installation_source: show error message in the TUI screen
    (k.koukiou)
    Resolves: RHEL-4705
  - storage: fix mount point assignment of non-formatted swap partitions
    (rvykydal)
    Related: RHEL-16355
  - storage: include only fstab devices in fsset swap devices property (rvykydal)
    Resolves: RHEL-16355


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.8-1
changelog:
  - Fix: UnboundLocalError: local variable 'e' referenced before assignment
    (k.koukiou)
    Related to: RHEL-4705
  - Emit authselect in KS when fingerprint is enabled (adamkankovsky)
    Resolves: RHEL-85175


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.9-1
changelog:
  - Set Authselect agruments after run in Security module (adamkankovsky)
    Resolves: RHEL-85175
  - Authselect code simplification (adamkankovsky)
    Resolves: RHEL-85175
  - custom: Reallocate partitions when removing a partition (vtrefny)
    Resolves: RHEL-114169


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.10-1
changelog:
  - Fixing authselect logical differences not resolved during backporting
    (adamkankovsky)
    Resolves: RHEL-85175


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.11-1
changelog:
  - bootloader: efi: utilize grub2-common script for handling config file
    generation (k.koukiou)
    Resolves: RHEL-36187


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.12-1
changelog:
  - Fix permissions of the ssh config created by Anaconda (ppolawsk)
    Resolves: RHEL-129787
  - pyanaconda: rpm_ostree: fix _handle_boot_if_not_mount_point method issues
    (k.koukiou)
    Related: RHEL-74145
  - ostree needs to have /boot be bindmounted into sysroot. (a.badger)
    Resolves: RHEL-74145


author: Martin Kolman <mkolman@redhat.com> - 34.25.7.1-1
changelog:
  - network: disable NM autoconnections also when BOOTIF is used (rvykydal)
    Resolves: RHEL-78272
  - network: support inst.net.noautodefault option (rvykydal)
    Related: RHEL-78272
  - security: fix dnsconfd backend option check in initramfs (rvykydal)
    Resolves: RHEL-83214
  - Support leavebootorder for bootupd (jkonecny)
    Resolves: RHEL-40897
  - bootupd: call bootupctl with --update-firmware (awilliam)
    Resolves: RHEL-40897


author: Martin Kolman <mkolman@redhat.com> - 34.25.7.2-1
changelog:
  - Fix typo in systemd service (jstodola)
    Resolves: RHEL-78272
  - s390x - enable raid1 as a stage2 device (dan)
    Resolves: INSTALLER-4148
    Resolves: RHEL-21691
  - edns: restart dnsconfd only after the first kickstart parsing (rvykydal)
    Resolves: RHEL-82694
  - edns: allow dnsconfd name resolution for kickstart fetching (rvykydal)
    Resolves: RHEL-82694


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.7.3-1
changelog:
  - Sort RPM versions via rpm.labelCompare() and not via
    packaging.version.LegacyVersion() (miro)
    Resolves: RHEL-87358
  - rpm_ostree/installation.py: fix image deployment on s390x (rvykydal)
    Resolves: RHEL-63237
  - Add additional config_get Dracut function tests (jkonecny)
    Related: RHEL-48837
  - Update the tests/README.rst file (jkonecny)
    Related: RHEL-48837
  - Move shell testing to a separated directory (jkonecny)
    Related: RHEL-48837
  - Enable dynamic bash commands disable for tests (jkonecny)
    Related: RHEL-48837
  - Add test for config_get dracut function (jkonecny)
    Related: RHEL-48837
  - Fix trailing `/` when downloading stage2 image (jkonecny)
    Resolves: RHEL-48837
  - Fix whitespace chars broke Dracut config parsing (jkonecny)
    Related: RHEL-48837


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.7.4-1
changelog:
  - Revert "s390x - enable raid1 as a stage2 device" (jkonecny)
    Reverts: RHEL-21691
  - test_module_part_blivet: fix pylint disable (jkonecny)
    Related: RHEL-85416
  - pyanaconda: module.common.task fix cyclic import (jkonecny)
    Related: RHEL-85416
  - pyanaconda: module_manager: fix ciclic import (k.koukiou)
    Related: RHEL-85416
  - pyanaconda: bootloader: fix ImportError (k.koukiou)
    Related: RHEL-85416
  - ruff: enable isort rules and autofix all isort warnings Autofixed with: ruff
    check --exclude pyanaconda/core/kickstart/commands.py --fix --select I .
    (jkonecny)
    Resolves: RHEL-85416
  - Add ruff, a very fast linter (vslavik)
    Related: RHEL-85416
  - Relabel /var/log/ and /root/original-ks.cfg (champetier.etienne)
    Resolves: RHEL-85298


author: Piotr Popieluch <piotr1212@gmail.com> - 0.4.0-4.20160219git0360811
changelog:
  - Update to latest git snapshot
  - Enable tests
  - Remove obsoleted el5 macros
  - Move license to %license
  - Add (empty) %build section
  - Add CONDUCT.md to %doc
  - Set correct interpreter in scripts


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els27]
changelog:
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
  - drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389}
  - md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
  - atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails {CVE-2025-38280}
  - ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
  - netfilter: nf_tables: do not compare internal table flags on updates {CVE-2024-27065}
  - init/main.c: Fix potential static_command_line memory overflow {CVE-2024-26988}
  - wireguard: netlink: check for dangling peer via is_dead instead of empty list {CVE-2024-26951}
  - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() {CVE-2025-38077}
  - exfat: fix double free in delayed_free {CVE-2025-38206}
  - net: openvswitch: Fix the dead loop of MPLS parse {CVE-2025-38146}
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write {CVE-2023-54286}
  - vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
  - fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
  - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
  - software node: Correct a OOB check in {CVE-2025-38342}
  - nbd: fix uaf in nbd_genl_connect() error path {CVE-2025-38443}
  - USB: usbtmc: Fix direction for 0-length ioctl control messages {CVE-2023-53761}
  - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
  - cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
  - PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
  - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
  - sctp: fix a potential overflow in sctp_ifwdtsn_skip {CVE-2023-53372}
  - md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
  - md/raid10: fix overflow of md/safe_mode_delay
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
  - lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
  - net: fec: Better handle pm_runtime_get() failing in .remove() {CVE-2023-53308}
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
  - ice: set tx_tstamps when creating new Tx rings via ethtool {CVE-2022-50710}
  - RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
  - RDMA/mlx5: Handle DCT QP logic separately from low level QP interface
  - net/mlx5e: Use correct encap attribute during invalidation {CVE-2023-54074}
  - net/mlx5: Nullify qp->dbg pointer post destruction
  - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282}
  - net: ena: fix shift-out-of-bounds in exponential backoff {CVE-2023-53272}
  - ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
  - sched/fair: Don't balance task to its current running CPU {CVE-2023-53215}
  - netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
  - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() {CVE-2022-50881}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els28]
changelog:
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit {CVE-2025-39766}
  - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
  - KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823}
  - ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
  - ext4: improve error handling from ext4_dirhash() {CVE-2023-53473}
  - rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749}
  - ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
  - fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
  - Bluetooth: ISO: Fix possible UAF on iso_conn_free {CVE-2025-40141}
  - pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
  - ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
  - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
  - libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880}
  - bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790}
  - nvmet: fix out-of-bounds access in nvmet_enable_port {CVE-2025-37825}
  - net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() {CVE-2023-54155}
  - wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
  - i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
  - fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
  - net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device {CVE-2023-54015}
  - x86/sev: Make enc_dec_hypercall() accept a size instead of npages {CVE-2023-53996}
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129}
  - page_pool: fix inconsistency for page_pool_ring_[un]lock()
  - net: page_pool: use in_softirq() instead {CVE-2025-38129}
  - vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
  - vsock: avoid to close connected socket after the timeout {CVE-2025-40248}
  - sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length {CVE-2025-39933}
  - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905}
  - i40e: validate ring_len parameter against hardware-specific values
  - i40e: add validation for ring_len param {CVE-2025-39973}
  - i40e: increase max descriptors for XL710
  - i40e: remove read access to debugfs files {CVE-2025-39901}
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
  - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
  - i2c: tegra: check msg length in SMBUS block read {CVE-2025-38425}
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395}
  - virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375}
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
  - vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
  - can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow {CVE-2023-54102}
  - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() {CVE-2022-50865}
  - tcp: minor optimization in tcp_add_backlog() {CVE-2022-50865}
  - block, bfq: fix uaf for bfqq in bic_set_bfqq() {CVE-2023-52983}
  - block, bfq: replace 0/1 with false/true in bic apis
  - block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq {CVE-2022-50329}
  - block, bfq: fix possible uaf for 'bfqq->bic' {CVE-2022-50488}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
  - Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled {CVE-2025-38346}
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
  - ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
  - net/mdiobus: Fix potential out-of-bounds read/write access {CVE-2025-38111}
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided
  - net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
  - net: atm: add lec_mutex {CVE-2025-38323}
  - Bluetooth: hci_sync: always check if connection is alive before deleting
  - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync {CVE-2023-53762}
  - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete {CVE-2025-38118}
  - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync {CVE-2024-58013}
  - net_sched: remove qdisc_tree_flush_backlog()
  - net_sched: ets: fix a race in ets_qdisc_change() {CVE-2025-38107}
  - net_sched: tbf: fix a race in tbf_change()
  - net_sched: prio: fix a race in prio_tune() {CVE-2025-38083}
  - net_sched: red: fix a race in __red_change() {CVE-2025-38108}
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
  - smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
  - wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
  - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request {CVE-2025-38013}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
  - mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154}
  - wifi: ath10k: Delay the unmapping of the buffer {CVE-2022-50700}
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
  - ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
  - drm/amd/display: fix FCLK pstate change underflow {CVE-2023-53780}
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els29]
changelog:
  - fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
  - qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
  - drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
  - pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
  - netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
  - fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
  - svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
  - bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
  - scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
  - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
  - memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
  - ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
  - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
  - net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
  - usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
  - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
  - rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
  - block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
  - wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
  - wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
  - wifi: mac80211: check for station first in client probe {CVE-2023-53588}
  - bonding: do not assume skb mac_header is set {CVE-2023-53601}
  - drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
  - wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
  - net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
  - media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
  - md/raid10: fix memleak of md thread {CVE-2023-54294}
  - usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
  - scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
  - HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
  - driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
  - rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
  - bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
  - drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
  - mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
  - bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
  - net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
  - net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
  - net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
  - smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
  - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
  - HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte
  - HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
  - HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
  - xfs: do not propagate ENODATA disk errors into xattr code {CVE-2025-39835}
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode {CVE-2025-38535}
  - wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf {CVE-2023-53524}
  - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
  - xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
  - drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras {CVE-2023-53471}
  - drm/edid: fix info leak when failing to get panel id {CVE-2023-53085}
  - xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
  - vdpa: Add features attr to vdpa_nl_policy for nlattr length check {CVE-2023-53652}
  - virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
  - virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687}
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy {CVE-2025-40251}
  - tracing: Limit access to parser->buffer when trace_get_user failed {CVE-2025-39683}
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
  - HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
  - udf: Do not bother merging very long extents {CVE-2023-53506}
  - cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913}
  - ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
  - tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
  - tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
  - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
  - gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  - iavf: Fix use-after-free in free_netdev {CVE-2023-53556}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els30]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-31431}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-31431}
  - crypto: authencesn - Fix src offset when decrypting in-place {CVE-2026-31431}
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-31431}
  - crypto: authenc - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
  - crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-31431}
  - crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
  - crypto: scatterwalk - Backport memcpy_sglist() {CVE-2026-31431}
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
  - bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
  - libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
  - scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
  - ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
  - intel_th: msu: Fix vmalloced buffers {CVE-2022-50142}
  - vt: Clear selection before changing the font {CVE-2022-49948}
  - ACPICA: Fix error code path in acpi_ds_call_control_method() {CVE-2022-50411}
  - usbnet: Run unregister_netdev() before unbind_all() {CVE-2022-50220}
  - ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
  - bpf: Propagate error from htab_lock_bucket() to userspace {CVE-2022-50490}
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
  - module: fix [e_shstrndx].sh_size=0 OOB access {CVE-2022-49444}
  - ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
  - tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
  - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
  - xsk: Fix xsk_diag use-after-free error during socket cleanup {CVE-2023-53426}
  - svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
  - net: hns3: add VLAN id validation before using {CVE-2025-71112}
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
  - i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
  - team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add {CVE-2022-50384}
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() {CVE-2025-37940}
  - net: stmmac: Fix accessing freed irq affinity_hint {CVE-2025-23155}
  - ext4: set goal start correctly in ext4_mb_normalize_request {CVE-2023-54021}
  - netfilter: ipset: fix region locking in hash types {CVE-2025-37997}
  - openvswitch: Fix unsafe attribute parsing in output_userspace() {CVE-2025-37998}
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() {CVE-2025-37990}
  - nfs: handle failure of nfs_get_lock_context in unlock path {CVE-2025-38023}
  - drm/amd/pm: Prevent division by zero {CVE-2025-37767}
  - netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764}
  - tracing: Fix null pointer dereference in tracing_err_log_open() {CVE-2023-53167}
  - ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
  - scsi: qla2xxx: Pointer may be dereferenced {CVE-2023-53150}
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() {CVE-2025-38061}
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes {CVE-2025-38066}
  - libnvdimm/labels: Fix divide error in nd_label_data_init() {CVE-2025-38072}
  - wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() {CVE-2023-53251}
  - tracing: Free error logs of tracing instances {CVE-2023-53375}
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes {CVE-2025-38466}
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO {CVE-2025-38122}
  - dma-buf: insert memory barrier before updating num_fences {CVE-2025-38095}
  - x86/sgx: Prevent attempts to reclaim poisoned pages {CVE-2025-38334}
  - ext4: inline: fix len overflow in ext4_prepare_inline_data {CVE-2025-38222}
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38214}
  - sctp: initialize more fields in sctp_v6_from_sk() {CVE-2025-39812}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
  - usb: net: sierra: check for no status endpoint {CVE-2025-38474}
  - vxlan: Annotate FDB data races {CVE-2025-38037}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling {CVE-2025-38115}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert {CVE-2025-38387}
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() {CVE-2025-38312}
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments {CVE-2025-38391}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request {CVE-2025-38430}
  - wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() {CVE-2022-50829}
  - wifi: mt76: disable napi on driver removal {CVE-2025-38009}
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump {CVE-2025-39813}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
  - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
  - RDMA/irdma: avoid invalid read in irdma_net_event {CVE-2025-71133}
  - scsi: qla4xxx: Prevent a potential error pointer dereference {CVE-2025-39676}
  - ppp: fix race conditions in ppp_fill_forward_path {CVE-2025-39673}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() {CVE-2026-22990}
  - thunderbolt: Do not double dequeue a configuration request {CVE-2025-38174}
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT {CVE-2025-38439}
  - ACPICA: fix acpi operand cache leak in dswstate.c {CVE-2025-38345}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH {CVE-2025-38063}
  - shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs {CVE-2023-53391}
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference {CVE-2025-38231}
  - udf: Do not update file length for failed writes to inline files {CVE-2023-53295}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs {CVE-2025-38285}
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree {CVE-2025-38468}
  - nvmet-tcp: don't restore null sk_state_change {CVE-2025-38035}
  - wifi: iwlwifi: mvm: fix double free on tx path. {CVE-2022-50248}
  - ACPICA: fix acpi parse and parseext cache leaks {CVE-2025-38344}
  - bonding: fix use-after-free due to enslave fail after slave array update {CVE-2026-23171}
  - macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
  - cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() {CVE-2023-53479}
  - fbcon: Fix OOB access in font allocation
  - fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
  - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
  - rename(): fix the locking of subdirectories
  - scsi: qedi: Fix use after free bug in qedi_remove() {CVE-2023-54100}
  - ixgbe: Fix panic during XDP_TX with > 64 CPUs {CVE-2023-54090}
  - bpf: Do not let BPF test infra emit invalid GSO types to stack {CVE-2025-68725}
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure {CVE-2025-71154}
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() {CVE-2023-54014}
  - selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() {CVE-2022-50699}
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() {CVE-2025-39808}
  - PCI: Fix dropping valid root bus resources with .end = zero {CVE-2023-53814}
  - KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state {CVE-2023-53208}
  - drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini {CVE-2023-53193}
  - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() {CVE-2025-39795}
  - libceph: return the handler error from mon_handle_auth_done() {CVE-2026-22992}
  - Bluetooth: Fix hci_suspend_sync crash {CVE-2023-53520}
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() {CVE-2025-39782}
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue {CVE-2026-22977}
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists {CVE-2025-38601}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
  - libceph: make free_choose_arg_map() resilient to partial allocation {CVE-2026-22991}
  - soundwire: fix enumeration completion {CVE-2023-54096}
  - ext4: fix inode leak in ext4_xattr_inode_create() on an error path {CVE-2022-50845}
  - ring-buffer: Handle race between rb_move_tail and rb_check_pages {CVE-2023-53709}
  - netlink: fix potential deadlock in netlink_set_err() {CVE-2023-53731}
  - xhci: dbc: Fix memory leak in xhci_alloc_dbc() {CVE-2022-50809}
  - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline {CVE-2022-50286}
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed {CVE-2023-53481}
  - driver core: location: Free struct acpi_pld_info *pld before return false {CVE-2023-53211}
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() {CVE-2025-39845}
  - dma-buf/dma-resv: Stop leaking on krealloc() failure {CVE-2023-53181}
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct {CVE-2025-38514}
  - xfrm: Zero padding when dumping algos and encap {CVE-2023-53684}
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer {CVE-2023-53648}
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF {CVE-2023-53747}
  - ice: fix wrong fallback logic for FDIR {CVE-2023-54040}
  - cifs: Fix xid leak in cifs_create() {CVE-2022-50351}
  - drm/amd/display: populate subvp cmd info only for the top pipe {CVE-2023-53806}
  - netfilter: ctnetlink: fix refcount leak on table dump {CVE-2025-38721}
  - sfc: fix crash when reading stats while NIC is resetting {CVE-2023-54156}
  - Bluetooth: Fix race condition in hidp_session_thread {CVE-2023-54120}
  - bpf: Reject %p% format string in bprintf-like helpers {CVE-2025-38528}
  - RDMA/bnxt_re: Prevent handling any completions after qp destroy {CVE-2023-54048}
  - RDMA/siw: Fix immediate work request flush to completion queue {CVE-2022-50736}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() {CVE-2025-38617}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr {CVE-2025-38701}
  - IB/hfi1: Fix possible panic during hotplug remove {CVE-2023-53488}
  - cgroup: split cgroup_destroy_wq into 3 workqueues {CVE-2025-39953}
  - NFS: Fix the setting of capabilities when automounting a new filesystem {CVE-2025-39798}
  - fs: Prevent file descriptor table allocations exceeding INT_MAX {CVE-2025-39756}
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() {CVE-2025-39713}
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089}
  - wifi: mac80211: reject TDLS operations when station is not associated {CVE-2025-38644}
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() {CVE-2023-53271}
  - RDMA/bnxt_re: wraparound mbox producer index {CVE-2023-53201}
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies {CVE-2025-38100}
  - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() {CVE-2025-38706}
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated {CVE-2025-38700}
  - ALSA: hda: Fix Oops by 9.1 surround channel names {CVE-2023-53400}
  - mm: move page table sync declarations to linux/pgtable.h {CVE-2025-39844}
  - rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access {CVE-2023-53419}
  - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails {CVE-2023-53199}
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras {CVE-2025-38540}
  - scsi: ses: Don't attach if enclosure has no components {CVE-2023-53431}
  - ipv6/addrconf: fix a potential refcount underflow for idev {CVE-2023-53189}
  - wifi: ath11k: Fix SKB corruption in REO destination ring {CVE-2023-53315}
  - bpf: fix ktls panic with sockmap {CVE-2025-38166}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime {CVE-2025-38470}
  - net: openvswitch: fix race on port output {CVE-2023-53188}
  - net_sched: Flush gso_skb list too during ->change() {CVE-2025-37992}
  - netfilter: x_tables: fix percpu counter block leak on error path when creating new netns {CVE-2023-53200}
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
  - af_unix: Fix data-race around unix_tot_inflight. {CVE-2023-54006}
  - watchdog: Fix kmemleak in watchdog_cdev_register {CVE-2023-53234}
  - usb: idmouse: fix an uninit-value in idmouse_open {CVE-2022-50733}
  - net: dcb: choose correct policy to parse DCB_ATTR_BCN {CVE-2023-53369}
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() {CVE-2022-50347}
  - Bluetooth: l2cap: Check encryption key size on incoming connection {CVE-2025-39889}
  - x86/apic: Don't disable x2APIC if locked {CVE-2022-50720}
  - serial: 8250: Reinit port->pm on port specific driver unbind {CVE-2023-53176}
  - devlink: hold region lock when flushing snapshots {CVE-2022-50712}
  - net: qrtr: Fix a refcount bug in qrtr_recvmsg() {CVE-2023-53445}
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list {CVE-2026-23084}
  - PM: EM: fix memory leak with using debugfs_lookup() {CVE-2023-53411}
  - vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check {CVE-2023-54031}
  - atm: clip: prevent NULL deref in clip_push() {CVE-2025-38251}
  - ceph: fix potential use-after-free bug when trimming caps {CVE-2023-53867}
  - ACPI: video: check for error while searching for backlight device parent {CVE-2023-52693}
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL {CVE-2023-53246}
  - x86/xen: Fix memory leak in xen_init_lock_cpu() {CVE-2022-50761}
  - net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping {CVE-2025-38126}
  - platform/x86: dell_rbu: Fix list usage {CVE-2025-38197}
  - x86/kexec: Fix double-free of elf header buffer {CVE-2023-54146}
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() {CVE-2025-38305}
  - KVM: Destroy target device if coalesced MMIO unregistration fails {CVE-2023-54024}
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table {CVE-2025-38319}
  - rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() {CVE-2022-50771}
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init {CVE-2023-53309}
  - net: atlantic: fix fragment overflow handling in RX path {CVE-2025-68301}
  - bpf: Fix oob access in cgroup local storage {CVE-2025-38502}
  - bpf: Add cookie object to bpf maps {CVE-2025-38502}
  - misc: vmw_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-53279}
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks {CVE-2025-38412}
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN {CVE-2025-38048}
  - tracing: Fix race issue between cpu buffer write and swap {CVE-2023-53368}
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop {CVE-2025-37985}
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write {CVE-2023-53344}
  - wifi: ath11k: fix node corruption in ar->arvifs list {CVE-2025-38293}
  - x86/mm: Check return value from memblock_phys_alloc_range() {CVE-2025-38071}
  - net: Fix TOCTOU issue in sk_is_readable() {CVE-2025-38112}
  - scsi: mpi3mr: Fix an issue found by KASAN {CVE-2023-54011}
  - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper
  - scsi: qla2xxx: Array index may go out of bound {CVE-2023-54179}
  - net/mlx5e: fix memory leak in mlx5e_ptp_open {CVE-2023-54169}
  - igc: Fix Kernel Panic during ndo_tx_timeout callback {CVE-2023-54166}
  - Bluetooth: L2CAP: Fix potential user-after-free {CVE-2023-54214}
  - RDMA/restrack: Release MR restrack when delete {CVE-2022-50822}
  - RDMA/irdma: Fix memory leak of PBLE objects {CVE-2023-54055}
  - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup {CVE-2023-54275}
  - mptcp: stricter state check in mptcp_worker {CVE-2023-54176}
  - nfsd: provide locking for v4_end_grace {CVE-2026-22980}
  - iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089}
  - net: atlantic: add check for MAX_SKB_FRAGS {CVE-2025-68301}
  - net: atlantic: reduce scope of is_rsc_complete
  - atlantic: Fix buff_ring OOB in aq_ring_rx_clean
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies {CVE-2025-40096}
  - net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe {CVE-2022-50777}
  - wifi: rt2x00: Fix memory leak when handling surveys {CVE-2023-54131}
  - wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() {CVE-2022-50740}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure {CVE-2026-23144}
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() {CVE-2022-50423}
  - wifi: ath10k: fix dma_free_coherent() pointer {CVE-2026-23133}
  - bpf: Move bpf map owner out of common struct {CVE-2025-38502}
  - fs: Lock moved directories
  - fs: Establish locking order for unrelated directories
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
  - macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
  - HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
  - ppp: fix memory leak in pad_compress_skb {CVE-2025-39847}
  - migrate: correct lock ordering for hugetlb file folios {CVE-2026-23097}
  - keys: Fix linking a duplicate key to a keyring's assoc_array {CVE-2023-54170}
  - scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
  - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() {CVE-2023-53320}
  - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range {CVE-2023-54229}
  - wifi: iwlwifi: pcie: fix possible NULL pointer dereference {CVE-2023-54053}
  - dm flakey: don't corrupt the zero page {CVE-2023-54317}
  - md/raid10: fix memleak for 'conf->bio_split' {CVE-2023-54123}
  - crypto: qat - fix out-of-bounds read {CVE-2023-54325}
  - drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP {CVE-2023-54263}
  - ipmi:ssif: Fix a memory leak when scanning for an adapter {CVE-2023-54064}
  - Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" {CVE-2023-54197}
  - netfilter: nf_tables: always release netdev hooks from notifier {CVE-2023-54200}
  - wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO {CVE-2023-54029}
  - serial: arc_uart: fix of_iomap leak in `arc_serial_probe` {CVE-2023-53719}
  - soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow {CVE-2023-54259}
  - vfio/type1: fix cap_migration information leak {CVE-2023-54137}
  - drm/client: Fix memory leak in drm_client_target_cloned {CVE-2023-54091}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() {CVE-2025-39742}
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko {CVE-2025-38581}
  - iwlwifi: Add missing check for alloc_ordered_workqueue {CVE-2025-38602}
  - net: bridge: fix soft lockup in br_multicast_query_expired() {CVE-2025-39773}
  - net: drop UFO packets in udp_rcv_segment() {CVE-2025-38622}
  - iommu: Fix error unwind in iommu_group_alloc() {CVE-2023-53482}
  - qed: allow sleep in qed_mcp_trace_dump() {CVE-2023-53509}
  - cifs: Fix xid leak in cifs_flock() {CVE-2022-50460}
  - platform/x86: dell-sysman: Fix reference leak {CVE-2023-53631}
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure {CVE-2025-38695}
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls {CVE-2025-38608}
  - bpf: prevent decl_tag from being referenced in func_proto {CVE-2022-50862}
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock {CVE-2025-39736}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() {CVE-2025-39737}
  - drm/amd/display: Fix potential null dereference {CVE-2023-53498}
  - x86/MCE/AMD: Use an u64 for bank_map {CVE-2023-53474}
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() {CVE-2023-53480}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els31]
changelog:
  - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  - xfrm: esp: avoid in-place decrypt on shared skb frags
  - clk: Fix clk_hw_get_clk() when dev is NULL {CVE-2022-49187}
  - x86/sgx: Add overflow check in sgx_validate_offset_length() {CVE-2022-49785}
  - ext4: init quota for 'old.inode' in 'ext4_rename' {CVE-2022-50346}
  - skbuff: Account for tail adjustment during pull operations {CVE-2022-50365}
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory {CVE-2022-50409}
  - scsi: qla2xxx: Delay module unload while fabric scan in progress {CVE-2025-71235}
  - HID: alps: fix NULL pointer dereference in alps_raw_event() {CVE-2026-31625}
  - rxrpc: fix reference count leak in rxrpc_server_keyring() {CVE-2026-31634}
  - drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects {CVE-2023-54010}
  - drm/amdgpu: fix the waring dereferencing hive {CVE-2024-46805}
  - drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func {CVE-2024-49911}
  - tracing: Prevent bad count for tracing_cpumask_write {CVE-2024-56763}
  - HID: wacom: fix when get product name maybe null pointer {CVE-2024-56629}
  - thermal: int340x: Add NULL check for adev {CVE-2025-23136}
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() {CVE-2025-37794}
  - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
  - wifi: cfg80211: ocb: don't leave if not joined {CVE-2023-53992}
  - mmc: core: Fix kernel panic when remove non-standard SDIO card {CVE-2022-50640}
  - EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() {CVE-2022-50645}
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register {CVE-2022-50625}
  - inet_diag: Initialize pad field in struct inet_diag_req_v2 {CVE-2024-42106}
  - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt {CVE-2022-49481}
  - net/core: Fix ETH_P_1588 flow dissector {CVE-2023-52580}
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() {CVE-2023-52560}
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg {CVE-2024-38596}
  - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 {CVE-2024-26660}
  - block: prevent division by zero in blk_rq_stat_sum() {CVE-2024-35925}
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286}
  - tipc: fix a possible memleak in tipc_buf_append {CVE-2024-36954}
  - ipv6: prevent possible NULL deref in fib6_nh_init() {CVE-2024-40961}
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER {CVE-2024-42090}
  - ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
  - drm/radeon: check bo_va->bo is non-NULL before using it {CVE-2024-41060}
  - dma: fix call order in dmam_free_coherent {CVE-2024-43856}
  - scsi: qla2xxx: Fix for possible memory corruption {CVE-2024-42288}
  - ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt {CVE-2024-26774}
  - netfilter: flowtable: incorrect pppoe tuple {CVE-2024-27015}
  - bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() {CVE-2024-40919}
  - Bluetooth: btintel: Fix null ptr deref in btintel_read_version {CVE-2024-35933}
  - netdevsim: prevent bad user input in nsim_dev_health_break_write() {CVE-2024-56716}
  - net/mlx5e: CT: Fix null-ptr-deref in add rule err flow {CVE-2024-53120}
  - EDAC/bluefield: Fix potential integer overflow {CVE-2024-53161}
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update() {CVE-2024-53217}
  - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() {CVE-2024-50304}
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race {CVE-2024-50082}
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
  - HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
  - filemap: Fix bounds checking in filemap_read() {CVE-2024-50272}
  - efi: fix potential NULL deref in efi_mem_reserve_persistent {CVE-2023-52976}
  - perf/x86/amd: fix potential integer overflow on shift of a int {CVE-2022-49748}
  - ext4: fix infinite loop when replaying fast_commit {CVE-2024-43828}
  - kthread: unpark only parked kthread {CVE-2024-50019}
  - xhci: tegra: fix checked USB2 port number {CVE-2024-50075}
  - Bluetooth: Call iso_exit() on module unload {CVE-2024-50078}
  - scsi: target: core: Fix null-ptr-deref in target_alloc_device() {CVE-2024-50153}
  - drm/radeon: Fix encoder->possible_clones {CVE-2024-50201}
  - squashfs: harden sanity check in squashfs_read_xattr_id_table {CVE-2023-52979}
  - xsk: fix an integer overflow in xp_create_and_assign_umem() {CVE-2025-21997}
  - can: j1939: j1939_session_new(): fix skb reference counting {CVE-2024-56645}
  - ice: Do not use WQ_MEM_RECLAIM flag for workqueue {CVE-2023-52743}
  - ALSA: usx2y: Use snd_card_free_when_closed() at disconnection {CVE-2024-56533}
  - sched/core: Prevent rescheduling when interrupts are disabled {CVE-2024-58090}
  - HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections {CVE-2024-57986}
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow {CVE-2025-22086}
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs {CVE-2025-22045}
  - Bluetooth: btrtl: Prevent potential NULL dereference {CVE-2025-37792}
  - tracing/histograms: Fix memory leak problem {CVE-2022-49648}
  - net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error {CVE-2025-21924}
  - ext4: fix another off-by-one fsmap error on 1k block filesystems {CVE-2023-53143}
  - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open {CVE-2024-46791}
  - crypto: ecdh - explicitly zeroize private_key {CVE-2024-42098}
  - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl {CVE-2025-22044}
  - geneve: do not assume mac header is set in geneve_xmit_skb() {CVE-2024-56636}
  - tracing/timerlat: Fix a race during cpuhp processing {CVE-2024-49866}
  - x86/mtrr: Check if fixed MTRRs exist before saving them {CVE-2024-44948}
  - genirq/irq_sim: Initialize work context pointers properly {CVE-2025-38408}
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() {CVE-2025-38664}
  - mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040}
  - objtool: Fix SEGFAULT {CVE-2022-50879}
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() {CVE-2022-49307}
  - can: af_can: fix NULL pointer dereference in can_rx_register() {CVE-2022-49863}
  - bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() {CVE-2022-49869}
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map {CVE-2022-49832}
  - tty: vt: initialize unicode screen buffer {CVE-2022-50222}
  - mfd: max77620: Fix refcount leak in max77620_initialise_fps {CVE-2022-50108}
  - pnode: terminate at peers of source {CVE-2022-50280}
  - mm: /proc/pid/smaps_rollup: fix no vma's null-deref {CVE-2022-50380}
  - chardev: fix error handling in cdev_device_add() {CVE-2022-50282}
  - net: hinic: fix the issue of CMDQ memory leaks {CVE-2022-50387}
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
  - tracing: Do not register unsupported perf events {CVE-2025-71125}
  - ASoC: amd: fix memory leak in acp3x pdm dma ops {CVE-2026-23190}
  - can: j1939: make j1939_session_activate() fail if device is no longer registered {CVE-2025-71182}
  - net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
  - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() {CVE-2026-23335}
  - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n {CVE-2026-23439}
  - xfrm: clear trailing padding in build_polexpire() {CVE-2026-31664}
  - wifi: rt2x00usb: fix devres lifetime {CVE-2026-31672}
  - mmc: vub300: fix NULL-deref on disconnect {CVE-2026-31651}
  - wifi: brcmsmac: Fix dma_free_coherent() size {CVE-2026-31661}
  - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change {CVE-2024-50044}
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes {CVE-2024-41095}
  - smb: client: fix deadlock in smb2_find_smb_tcon() {CVE-2024-39468}
  - drm/amdgpu: Fixed bug on error when unloading amdgpu {CVE-2023-52912}
  - usb: typec: ucsi: Fix null pointer dereference in trace {CVE-2024-46719}
  - drm/amdgpu: the warning dereferencing obj for nbio_v7_4 {CVE-2024-46819}
  - netfilter: flowtable: initialise extack before use {CVE-2024-45018}
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() {CVE-2024-47668}
  - drm/amd/display: Check null pointer before dereferencing se {CVE-2024-50049}
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption {CVE-2024-49858}
  - drm/amd/pm: ensure the fw_info is not null before using it {CVE-2024-49890}
  - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped {CVE-2024-47673}
  - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() {CVE-2024-49962}
  - drm/amd/display: Check stream before comparing them {CVE-2024-49896}
  - wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() {CVE-2024-56593}
  - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() {CVE-2025-21689}
  - sctp: properly validate chunk size in sctp_sf_ootb() {CVE-2024-50299}
  - USB: usbtmc: prevent kernel-usb-infoleak {CVE-2024-47671}
  - printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX {CVE-2024-58017}
  - nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() {CVE-2025-21848}
  - kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() {CVE-2023-52936}
  - linux/dim: Fix divide by 0 in RDMA DIM {CVE-2022-49670}
  - scsi: st: Fix array overflow in st_setup() {CVE-2025-37857}
  - usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() {CVE-2022-50825}
  - samples/bpf: Fix buffer overflow in tcp_basertt {CVE-2023-54312}
  - debugobjects: Don't wake up kswapd from fill_pool() {CVE-2023-54268}
  - regmap-irq: Fix out-of-bounds access when allocating config buffers {CVE-2023-53768}
  - RDMA/core: Fix GID entry ref leak when create_ah fails {CVE-2023-54003}
  - drm: Don't unref the same fb many times by mistake due to deadlock handling {CVE-2023-52486}
  - pstore/ram: Fix crash when setting number of cpus to an odd number {CVE-2023-52619}
  - net: usb: qmi_wwan: fix memory leak for not ip packets {CVE-2024-43861}
  - HID: i2c-hid-of: fix NULL-deref on failed power up {CVE-2024-26717}
  - netfilter: nf_tables: set dormant flag on hook register failure {CVE-2024-26835}
  - md: fix kmemleak of rdev->serial {CVE-2024-26900}
  - spi: fix null pointer dereference within spi_sync {CVE-2024-36930}
  - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() {CVE-2024-56748}
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() {CVE-2024-56747}
  - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport {CVE-2024-56688}
  - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag {CVE-2025-21699}
  - sock_map: Add a cond_resched() in sock_hash_free() {CVE-2024-47710}
  - net: stmmac: Fix zero-division error when disabling tc cbs {CVE-2024-49977}
  - net/mlx5: Fix error path in multi-packet WQE transmit {CVE-2024-50001}
  - HID: core: remove unnecessary WARN_ON() in implement() {CVE-2024-39509}
  - tipc: fix memory leak in tipc_link_xmit {CVE-2025-37757}
  - ima: Fix potential memory leak in ima_init_crypto() {CVE-2022-49627}
  - net: tun: unlink NAPI from device on destruction {CVE-2022-49672}
  - iommu/amd: Fix pci device refcount leak in ppr_notifier() {CVE-2022-50505}
  - rxrpc: Fix bug due to prealloc collision {CVE-2025-38544}
  - ext4: zero i_disksize when initializing the bootloader inode {CVE-2023-53101}
  - scsi: hisi_sas: Add cond_resched() for no forced preemption model {CVE-2024-56589}
  - net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103}
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path {CVE-2025-37788}
  - drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini {CVE-2023-53237}
  - samples/bpf: Fix fout leak in hbm's run_bpf_prog {CVE-2023-53290}
  - regulator: core: fix NULL dereference on unbind due to stale coupling data {CVE-2025-38668}
  - PM / devfreq: Fix leak in devfreq_dev_release() {CVE-2023-53518}
  - coresight: trbe: remove cpuhp instance node before remove cpuhp state {CVE-2022-50319}
  - net: phy: fix null-ptr-deref while probe() failed {CVE-2022-49021}
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() {CVE-2022-49002}
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() {CVE-2022-48972}
  - watch_queue: Free the page array when watch_queue is dismantled {CVE-2022-49148}
  - samples/landlock: Fix path_list memory leak {CVE-2021-47654}
  - net: tun: Fix memory leaks of napi_get_frags {CVE-2022-49871}
  - ftrace: Fix null pointer dereference in ftrace_add_mod() {CVE-2022-49802}
  - netdevsim: Fix memory leak of nsim_dev->fa_cookie {CVE-2022-49803}
  - tracing: Fix memory leak in tracing_read_pipe() {CVE-2022-49801}
  - mtd: core: fix possible resource leak in init_mtd() {CVE-2022-50304}
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() {CVE-2022-50321}
  - xfrm_user: fix info leak in build_report() {CVE-2026-31671}
  - regulator: core: fix resource leak in regulator_register() {CVE-2022-50724}
  - x86/tdx: Fix data leak in mmio_read() {CVE-2024-46794}
  - x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n {CVE-2021-47430}
  - ceph: remove the incorrect Fw reference check when dirtying pages {CVE-2024-50179}
  - nfs: Fix KMSAN warning in decode_getfattr_attrs() {CVE-2024-53066}
  - blk-cgroup: Fix class @block_class's subsystem refcount leakage {CVE-2025-21745}
  - cifs: Fix lost destroy smbd connection when MR allocate failed {CVE-2023-54260}
  - cifs: Fix xid leak in cifs_ses_add_channel() {CVE-2022-50856}
  - phy: tegra: xusb: Clear the driver reference in usb-phy dev {CVE-2023-54083}
  - drm/ttm: Don't leak a resource on swapout move error {CVE-2023-53844}
  - team: Move team device type change at the end of team_port_add {CVE-2025-68340}
  - udp: Fix wildcard bind conflict check when using hash2 {CVE-2026-31503}
  - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock {CVE-2026-31592}
  - HID: core: clamp report_size in s32ton() to avoid undefined shift {CVE-2026-31624}
  - af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
  - nvme-pci: ensure we're polling a polled queue {CVE-2026-31523}
  - module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
  - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els32]
changelog:
  - net: skbuff: propagate shared-frag marker through pskb_copy()
  - HID: ignore non-functional sensor in HP 5MP Camera {CVE-2025-21992}
  - net: fix crash when config small gso_max_size/gso_ipv4_max_size {CVE-2024-50258}
  - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() {CVE-2024-53042}
  - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
  - serial: imx: Add missing .thaw_noirq hook {CVE-2022-49841}
  - module: ensure that kobject_put() is safe for module type kobjects {CVE-2025-37995}
  - udf: Fix uninitialized array access for some pathnames {CVE-2023-53165}
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer {CVE-2023-53182}
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
  - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data {CVE-2026-23370}
  - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
  - icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
  - net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
  - ice: Fix memory leak in ice_set_ringparam() {CVE-2026-23389}
  - wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
  - HID: asus: avoid memory leak in asus_report_fixup() {CVE-2026-31524}
  - xprtrdma: treat all calls not a bcall when bc_serv is NULL {CVE-2022-49321}
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy() {CVE-2022-49567}
  - x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails {CVE-2022-49549}
  - af_unix: Fix a data-race in unix_dgram_peer_wake_me(). {CVE-2022-49344}
  - bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data {CVE-2022-50536}
  - net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() {CVE-2023-53578}
  - wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() {CVE-2023-53570}
  - mptcp: fix race on unaccepted mptcp sockets {CVE-2022-49669}
  - ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
  - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() {CVE-2026-23315}
  - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447}
  - Squashfs: check metadata block offset is within range {CVE-2026-23388}
  - apparmor: Fix double free of ns_name in aa_replace_profiles() {CVE-2026-23408}
  - nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
  - i2c: piix4: Fix a memory leak in the EFCH MMIO support {CVE-2022-49653}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els34]
changelog:
  - net: skbuff: propagate shared-frag marker through skb_gro_receive + skb_shift {CVE-2026-46300}
  - Revert "net: gro: propagate SKBFL_SHARED_FRAG through skb_gro_receive"


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els35]
changelog:
  - ptrace: require CAP_SYS_PTRACE when task has no mm
  - net: udp_offload: propagate SKBFL_SHARED_FRAG in skb_gro_receive_list {CVE-2026-46300}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els1]
changelog:
  - perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344}
  - x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363}
  - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
  - dm: remove fake timeout to avoid leak request {CVE-2026-43314}
  - md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163}
  - drm: Account property blob allocations to memcg {CVE-2026-43287}
  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
  - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
  - net/sched: Fix backlog accounting in qdisc_dequeue_internal {CVE-2025-39677}
  - l2tp: avoid one data-race in l2tp_tunnel_del_work() {CVE-2026-23120}
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() {CVE-2025-39876}
  - espintcp: fix skb leaks {CVE-2025-38057}
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() {CVE-2025-37829}
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() {CVE-2025-37824}
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141}
  - virtiofs: add filesystem context source name check {CVE-2025-37773}
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063}
  - ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
  - wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
  - wifi: ath11k: fix RCU stall while reaping monitor destination ring {CVE-2024-58097}
  - net/sctp: Prevent autoclose integer overflow in sctp_association_init() {CVE-2024-57938}
  - ubi: fastmap: Fix duplicate slab cache names while attaching {CVE-2024-53172}
  - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() {CVE-2024-56369}
  - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware {CVE-2024-53157}
  - vsock: Fix sk_error_queue memory leak {CVE-2024-53118}
  - mm: fix NULL pointer dereference in alloc_pages_bulk_noprof {CVE-2024-53113}
  - exec: don't WARN for racy path_noexec check {CVE-2024-50010}
  - drm/amd/display: Initialize get_bytes_per_element's default to 1 {CVE-2024-49892}
  - ppp: do not assume bh is held in ppp_channel_bridge_input() {CVE-2024-49946}
  - drm/amd/display: Skip Recompute DSC Params if no Stream on Link {CVE-2024-47683}
  - x86/sgx: Fix deadlock in SGX NUMA node search {CVE-2024-49856}
  - pktgen: use cpus_read_lock() in pg_net_init() {CVE-2024-46681}
  - nfsd: call cache_put if xdr_reserve_space returns NULL {CVE-2024-47737}
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739}
  - drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
  - net/mlx5: Fix bridge mode operations when there are no VFs {CVE-2024-46857}
  - Input: MT - limit max slots {CVE-2024-45008}
  - net/mlx5e: SHAMPO, Fix incorrect page release {CVE-2024-46717}
  - netfilter: ctnetlink: use helper function to calculate expect ID {CVE-2024-44944}
  - lib: objagg: Fix general protection fault {CVE-2024-43846}
  - drm/qxl: Add check for drm_cvt_mode {CVE-2024-43829}
  - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems {CVE-2024-42073}
  - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes {CVE-2024-42101}
  - RDMA/mlx5: Add check for srq max_sge attribute {CVE-2024-40990}
  - tracing: Build event generation tests only as modules {CVE-2024-41004}
  - KEYS: trusted: Fix memory leak in tpm2_key_encode() {CVE-2024-36967}
  - epoll: be better about file lifetimes {CVE-2024-38580}
  - drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
  - RDMA/srpt: Add a check for valid 'mad_agent' pointer {CVE-2023-54274}
  - x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction {CVE-2023-54172}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() {CVE-2024-26772}
  - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected {CVE-2024-26891}
  - dm: don't attempt to queue IO under RCU protection {CVE-2023-53860}
  - md: fix soft lockup in status_resync {CVE-2023-53620}
  - spi: qup: Don't skip cleanup in remove's error path {CVE-2023-53567}
  - md/raid10: prevent soft lockup while flush writes {CVE-2023-53151}
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() {CVE-2023-53133}
  - spi: imx: Don't skip cleanup in remove's error path {CVE-2023-53225}
  - xsk: Add missing overflow check in xdp_umem_reg {CVE-2023-53080}
  - wifi: mt76: do not run mt76u_status_worker if the device is not running {CVE-2022-50735}
  - bpf: Skip task with pid=1 in send_signal_common() {CVE-2023-52992}
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
  - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() {CVE-2023-52702}
  - RDMA/irdma: Fix potential NULL-ptr-dereference {CVE-2023-52744}
  - i2c: designware: Fix handling of real but unexpected device interrupts {CVE-2022-50370}
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() {CVE-2022-50544}
  - tpm: acpi: Call acpi_put_table() to fix memory leak {CVE-2022-50562}
  - netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed {CVE-2022-50500}
  - ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
  - blk-mq: fix possible memleak when register 'hctx' failed {CVE-2022-50434}
  - ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
  - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() {CVE-2022-49885}
  - xen/privcmd: fix error exit of privcmd_ioctl_dm_op() {CVE-2022-49989}
  - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE {CVE-2022-49875}
  - can: j1939: j1939_send_one(): fix missing CAN header initialization {CVE-2022-49845}
  - ovl: Use "buf" flexible array for memcpy() destination {CVE-2022-49743}
  - scsi: scsi_transport_sas: Fix error handling in sas_phy_add() {CVE-2022-49839}
  - net: bcmgenet: Use stronger register read/writes to assure ordering {CVE-2022-49194}
  - ima: Fix a potential integer overflow in ima_appraise_measurement {CVE-2022-49643}
  - net: amd-xgbe: Fix skb data length underflow {CVE-2022-48743}
  - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
  - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" {CVE-2025-71137}
  - ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078}
  - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281}
  - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
  - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
  - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696}
  - xfs: stop reclaim before pushing AIL during unmount {CVE-2026-31455}
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
  - drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
  - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
  - ata: libata-transport: fix double ata_host_put() in ata_tport_add() {CVE-2022-49826}
  - tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
  - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case {CVE-2022-49779}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els2]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash {CVE-2024-35854}
  - cifs: Fix memory leak when build ntlmssp negotiate blob failed {CVE-2022-50372}
  - scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() {CVE-2023-53038}
  - drm/amd/display: Do not set DRR on pipe Commit {CVE-2023-53042}
  - tcp: fix skb_copy_ubufs() vs BIG TCP {CVE-2023-53669}
  - clk: Fix clk_core_get NULL dereference {CVE-2024-27038}
  - drm/amd/display: Check null pointers before using dc->clk_mgr {CVE-2024-49907}
  - bpf: reject unhashed sockets in bpf_sk_assign {CVE-2023-53585}
  - driver core: fix resource leak in device_add() {CVE-2023-53594}
  - wifi: ath9k: hif_usb: fix memory leak of remain_skbs {CVE-2023-53641}
  - wifi: ath9k: verify the expected usb_endpoints are present {CVE-2022-50297}
  - drm/amd/display: Fix potential null-deref in dm_resume {CVE-2022-50535}
  - ext4: don't allow journal inode to have encrypt flag {CVE-2022-50277}
  - tls: get psock ref after taking rxlock to avoid leak {CVE-2024-35908}
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program {CVE-2024-27431}
  - bpf: Guard stack limits against 32bit overflow {CVE-2023-52676}
  - can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() {CVE-2021-47457}
  - serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
  - cpufreq: exit() callback is optional {CVE-2024-38615}
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() {CVE-2024-39276}
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets {CVE-2024-36905}
  - wifi: nl80211: reject iftype change with mesh ID change {CVE-2024-27410}
  - tcp: do not accept ACK of bytes we never sent {CVE-2023-52881}
  - crypto: pcrypt - Fix hungtask for PADATA_RESET {CVE-2023-52813}
  - net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960}
  - usb: ulpi: fix memory leak on ulpi_register() error paths
  - usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
  - wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
  - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653}
  - calipso: fix memory leak in netlbl_calipso_add_pass() {CVE-2023-52698}
  - wifi: iwlwifi: mvm: avoid NULL pointer dereference {CVE-2024-49929}
  - ext4: update orig_path in ext4_find_extent() {CVE-2024-49881}
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling {CVE-2024-43863}
  - RDMA/restrack: Fix potential invalid address access {CVE-2024-42080}
  - net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076}
  - nfsd: clear acl_access/acl_default after releasing them {CVE-2025-21796}
  - rtc: pl031: fix rtc features null pointer dereference {CVE-2022-49273}
  - net: veth: clear GRO when clearing XDP even when down {CVE-2024-26803}
  - coresight: cti: Fix hang in cti_disable_hw() {CVE-2022-50491}
  - scsi: qla2xxx: Fix deletion race condition {CVE-2023-53615}
  - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() {CVE-2023-53476}
  - scsi: qla2xxx: Fix potential NULL pointer dereference {CVE-2023-53451}
  - usb: ucsi_acpi: Increase the command completion timeout {CVE-2023-53168}
  - drivers: base: dd: fix memory leak with using debugfs_lookup() {CVE-2023-53390}
  - USB: fix memory leak with using debugfs_lookup() {CVE-2023-53359}
  - PM: domains: fix memory leak with using debugfs_lookup() {CVE-2023-53202}
  - drm/client: Fix memory leak in drm_client_modeset_probe {CVE-2023-53288}
  - drivers: base: component: fix memory leak with using debugfs_lookup() {CVE-2023-53409}
  - USB: uhci: fix memory leak with using debugfs_lookup() {CVE-2023-53197}
  - media: uvcvideo: Handle cameras with invalid descriptors {CVE-2023-53437}
  - arm64: csum: Fix OoB access in IP checksum code for negative lengths {CVE-2023-53726}
  - bnxt: Do not read past the end of test names {CVE-2023-53010}
  - dax: make sure inodes are flushed before destroy cache {CVE-2022-49220}
  - cifs: Fix oops due to uncleared server->smbd_conn in reconnect {CVE-2023-53006}
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE {CVE-2024-42321}
  - PCI: Fix use-after-free of slot->bus on hot remove {CVE-2024-53194}
  - net/ipv6: release expired exception dst cached in socket {CVE-2024-56644}
  - net: sched: fix ordering of qlen adjustment {CVE-2024-53164}
  - watch_queue: Fix NULL dereference in error cleanup {CVE-2022-49257}
  - lz4: fix LZ4_decompress_safe_partial read out of bound {CVE-2022-49078}
  - vmxnet3: disable rx data ring on dma allocation failure {CVE-2024-40923}
  - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() {CVE-2024-36955}
  - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure {CVE-2022-50374}
  - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag {CVE-2024-35817}
  - dm snapshot: fix lockup in dm_exception_table_exit {CVE-2024-35805}
  - nouveau: fix instmem race condition around ptr stores {CVE-2024-26984}
  - wireguard: netlink: access device through ctx instead of peer {CVE-2024-26950}
  - drm/i915/gt: Reset queue_priority_hint on parking {CVE-2024-26937}
  - netfilter: nft_set_pipapo: do not free live element {CVE-2024-26924}
  - dmaengine: fix NULL pointer in channel unregistration function {CVE-2023-52492}
  - PCI/PM: Drain runtime-idle callbacks before driver removal {CVE-2024-35809}
  - nvme-fc: do not wait in vain when unloading module {CVE-2024-26846}
  - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427}
  - phylib: fix potential use-after-free {CVE-2022-48754}
  - mm/filemap: skip to create PMD-sized page cache if needed {CVE-2024-41031}
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() {CVE-2024-35944}
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage {CVE-2024-36006}
  - wifi: ath11k: decrease MHI channel buffer length to 8KB {CVE-2024-35938}
  - dyndbg: fix old BUG_ON in >control parser {CVE-2024-35947}
  - ALSA: core: Fix NULL module pointer assignment at card init {CVE-2024-38605}
  - wifi: iwlwifi: mvm: rfi: fix potential response leaks {CVE-2024-35912}
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD {CVE-2024-35801}
  - ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415}
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() {CVE-2023-52832}
  - i2c: core: Run atomic i2c xfer when !preemptible {CVE-2023-52791}
  - mmc: sdio: fix possible resource leaks in some error paths {CVE-2023-52730}
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions {CVE-2024-42265}
  - wifi: mac80211: fix potential sta-link leak {CVE-2024-35838}
  - octeontx2-af: avoid off-by-one read from userspace {CVE-2024-36957}
  - xen-netfront: Add missing skb_mark_for_recycle {CVE-2024-27393}
  - net: hns3: do not allow call hns3_nic_net_open repeatedly {CVE-2021-47400}
  - HID: sony: Fix a potential memory leak in sony_probe() {CVE-2023-52529}
  - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428}
  - mm/gup: fix gup_pud_range() for dax {CVE-2022-48986}
  - drm/virtio: Fix GEM handle creation UAF {CVE-2022-48899}
  - ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() {CVE-2024-26894}
  - RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243}
  - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049}
  - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
  - bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
  - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks {CVE-2026-23270}
  - net/sched: act_ct: fix skb leak and crash on ooo frags {CVE-2023-52610}
  - Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
  - mm/mempolicy: fix memory leak in set_mempolicy_home_node system call {CVE-2022-50391}
  - mm/kasan: fix double free for kasan pXds {CVE-2026-31686}
  - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
  - dax: Fix dax_mapping_release() use after free {CVE-2023-53613}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els3]
changelog:
  - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}
  - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
  - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
  - cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328}
  - rcu: Fix rcu_read_unlock() deadloop due to softirq
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - RDMA/efa: Fix possible deadlock {CVE-2026-31493}
  - RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}
  - RDMA/efa: Improve admin completion context state machine {CVE-2026-31493}
  - RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493}
  - RDMA/efa: Extend admin timeout error print
  - RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493}
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075}
  - kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402}
  - wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
  - md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210}
  - exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940}
  - af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197}
  - xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
  - udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
  - efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}
  - kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190}
  - smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230}
  - sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935}
  - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208}
  - drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093}
  - firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
  - ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
  - net: hinic: fix memory leak when reading function table {CVE-2022-50438}
  - device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752}
  - libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}
  - usbnet: fix memory leak in error case {CVE-2022-49657}
  - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
  - seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661}
  - net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121}
  - nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}
  - leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587}
  - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986}
  - RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890}
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125}
  - tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800}
  - kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266}
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870}
  - i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788}
  - can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}
  - regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558}
  - wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937}
  - netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952}
  - can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830}
  - bpf: Fix memory leaks in __check_func_call {CVE-2022-49837}
  - configfs: fix a race in configfs_{,un}register_subsystem() {CVE-2022-48931}
  - RDMA/mad: Improve handling of timed out WRs of mad agent {CVE-2024-50095}
  - cifs: Fix connections leak when tlink setup failed {CVE-2022-49822}
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind() {CVE-2024-41097}
  - tcp: add sanity checks to rx zerocopy {CVE-2024-26640}
  - NFSD: Prevent a potential integer overflow {CVE-2024-53146}
  - bpf, cpumap: Handle skb as well when clean up ptr_ring {CVE-2023-53660}
  - team: fix null-ptr-deref when team device type is changed {CVE-2023-52574}
  - fbdev: efifb: Register sysfs groups through driver core {CVE-2024-49925}
  - bpf: devmap: provide rxq after redirect {CVE-2024-50162}
  - net: phy: micrel: Allow probing without .driver_data {CVE-2022-49472}
  - inotify: Avoid reporting event with invalid wd {CVE-2023-54119}
  - USB: hub: Ignore non-compliant devices with too many configs or interfaces {CVE-2025-21776}
  - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode {CVE-2024-58096}
  - RDMA/irdma: Fix data race on CQP request done {CVE-2023-54292}
  - fscache: Fix oops due to race with cookie_lru and use_cookie {CVE-2022-48989}
  - perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() {CVE-2023-52450}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c {CVE-2024-56727}
  - wifi: iwlwifi: fix debug actions order {CVE-2025-38045}
  - tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' {CVE-2022-50553}
  - net: ipv4: fix one memleak in __inet_del_ifa() {CVE-2023-53995}
  - exfat: fix memory leak in exfat_load_bitmap() {CVE-2024-50013}
  - vp_vdpa: fix id_table array not null terminated error {CVE-2024-53110}
  - intel_th: Fix a resource leak in an error handling path {CVE-2022-50143}
  - leds: led-class: Only Add LED to leds_list when it is fully ready {CVE-2026-23101}
  - usb: gadget: core: Check for unset descriptor {CVE-2024-44960}
  - drm/amdkfd: Fix lock dependency warning with srcu {CVE-2023-52632}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() {CVE-2025-38458}
  - PM / devfreq: Check governor before using governor->name {CVE-2025-38609}
  - tls: fix missing memory barrier in tls_init {CVE-2024-36489}
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() {CVE-2025-37830}
  - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery {CVE-2024-40977}
  - nvdimm: Fix firmware activation deadlock scenarios {CVE-2022-49446}
  - wifi: mac80211: sdata can be NULL during AMPDU start {CVE-2022-48875}
  - can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods {CVE-2022-49024}
  - wifi: ath10k: Fix memory leak in management tx {CVE-2024-50236}
  - vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] {CVE-2025-21666}
  - netdevsim: fix memory leak in nsim_bus_dev_new() {CVE-2022-50772}
  - fs: relax assertions on failure to encode file handles {CVE-2024-57924}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c {CVE-2024-56707}
  - ceph: fix deadlock or deadcode of misusing dget() {CVE-2023-52583}
  - bpf, verifier: Fix memory leak in array reallocation for stack state {CVE-2022-49878}
  - ip6_gre: make ip6gre_header() robust {CVE-2025-71098}
  - ACPICA: Avoid walking the Namespace if start_node is NULL {CVE-2025-71118}
  - net/mlx5e: kTLS, Fix incorrect page refcounting {CVE-2024-53138}
  - gve: Clear napi->skb before dev_kfree_skb_any() {CVE-2024-40937}
  - atm: clip: Fix memory leak of struct clip_vcc. {CVE-2025-38546}
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt {CVE-2025-71131}
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration {CVE-2024-45006}
  - irqchip: Fix refcount leak in platform_irqchip_probe {CVE-2023-53610}
  - CDC-NCM: avoid overflow in sanity checking {CVE-2022-48938}
  - Bluetooth: Fix crash when replugging CSR fake controllers {CVE-2022-48982}
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() {CVE-2022-50521}
  - ptp: Ensure info->enable callback is always set {CVE-2025-21814}
  - perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() {CVE-2022-50820}
  - drm: Fix potential null-ptr-deref due to drmm_mode_config_init() {CVE-2022-50556}
  - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU {CVE-2023-54036}
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() {CVE-2024-40959}
  - drm/amdgpu: Fix smatch static checker warning {CVE-2024-46835}
  - svcrdma: Address an integer overflow {CVE-2024-53151}
  - dma-debug: fix a possible deadlock on radix_lock {CVE-2024-47143}
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check {CVE-2024-41072}
  - regulator: core: fix use_count leakage when handling boot-on {CVE-2022-50250}
  - tpm: use try_get_ops() in tpm-space.c {CVE-2022-49286}
  - ata: libata-transport: fix error handling in ata_tdev_add() {CVE-2022-49823}
  - padata: Always leave BHs disabled when running ->parallel() {CVE-2022-50382}
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
  - serial: core: check uartclk for zero to avoid divide by zero {CVE-2024-43893}
  - cifs: fix potential memory leaks in session setup {CVE-2023-53008}
  - tty: fix out-of-bounds access in tty_driver_lookup_tty() {CVE-2023-54198}
  - nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() {CVE-2023-53697}
  - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() {CVE-2026-43136}
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120}
  - drm/ioc32: stop speculation on the drm_compat_ioctl path {CVE-2026-31781}
  - ext4: fix i_disksize exceeding i_size problem in paritally written case {CVE-2023-53270}
  - wifi: nl80211: fix NULL-ptr deref in offchan check {CVE-2023-53113}
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() {CVE-2023-53717}
  - ASoC: SOF: Add some bounds checking to firmware data {CVE-2024-26927}
  - regulator: core: Prevent integer underflow {CVE-2022-50582}
  - power: supply: fix null pointer dereferencing in power_supply_get_battery_info {CVE-2022-50276}
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
  - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
  - nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
  - netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
  - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els4]
changelog:
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c {CVE-2024-56726}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c {CVE-2024-56679}
  - USB: chipidea: fix memory leak with using debugfs_lookup() {CVE-2023-53334}
  - drivers: serial: jsm: fix some leaks in probe {CVE-2022-50312}
  - drm: amd: display: Fix memory leakage {CVE-2023-53605}
  - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent {CVE-2026-43026}
  - net: Drop the lock in skb_may_tx_timestamp() {CVE-2026-43216}
  - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381}
  - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068}
  - net: mdio: unexport __init-annotated mdio_bus_init() {CVE-2022-49350}
  - netfilter: ipset: Rework long task execution when adding/deleting entries {CVE-2023-53549}
  - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() {CVE-2023-53275}
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash {CVE-2022-50494}
  - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message {CVE-2026-23307}
  - usb: image: mdc800: kill download URB on timeout {CVE-2026-43425}
  - tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411}
  - cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() {CVE-2023-52942}
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path {CVE-2023-52703}
  - usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() {CVE-2022-50246}
  - bus: mhi: host: Range check CHDBOFF and ERDBOFF {CVE-2023-53598}
  - hwmon: (coretemp) Simplify platform device handling {CVE-2023-53612}
  - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING {CVE-2024-36920}
  - dm crypt: add cond_resched() to dmcrypt_write() {CVE-2023-53051}
  - xfrm: account XFRMA_IF_ID in aevent size calculation {CVE-2026-43107}
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() {CVE-2024-43879}
  - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() {CVE-2023-53335}
  - regulator: check that dummy regulator has been probed before using it {CVE-2025-22008}
  - HID: prodikeys: Check presence of pm->input_ep82 {CVE-2026-43251}
  - perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() {CVE-2022-50510}
  - wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
  - trace/blktrace: fix memory leak with using debugfs_lookup() {CVE-2023-53408}
  - dm-verity: correctly handle dm_bufio_client_create() failure {CVE-2026-43132}
  - pstore: ram_core: fix incorrect success return when vmap() fails {CVE-2026-43124}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk {CVE-2026-43043}
  - net: use skb_header_pointer() for TCPv4 GSO frag_off check {CVE-2026-43036}
  - scsi: mpi3mr: Fix config page DMA memory leak {CVE-2023-53120}
  - net/mlx5: handle errors in mlx5_chains_create_table() {CVE-2025-21975}
  - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx {CVE-2023-53546}
  - drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() {CVE-2025-37852}
  - bpf: Prevent decl_tag from being referenced in func_proto arg {CVE-2022-50883}
  - arm64: set __exception_irq_entry with __irq_entry as a default {CVE-2023-54322}
  - class: fix possible memory leak in __class_register() {CVE-2022-50578}
  - ALSA: usb-audio: Stop parsing channels bits when all channels are found. {CVE-2024-27436}
  - net/mlx5: fix potential memory leak in mlx5e_init_rep_rx {CVE-2023-54106}
  - net/mlx5: E-Switch, Fix an Oops in error handling code {CVE-2023-53058}
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() {CVE-2023-53078}
  - ice: xsk: disable txq irq before flushing hw {CVE-2023-53102}
  - selinux: fix memleak in security_read_state_kernel() {CVE-2022-50201}
  - efi: runtime: Fix potential overflow of soft-reserved region size {CVE-2024-26843}
  - drm/amdgpu: Fix potential null pointer derefernce {CVE-2023-52814}
  - ata: libata-core: Fix null pointer dereference on error {CVE-2024-41098}
  - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs {CVE-2026-23286}
  - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() {CVE-2026-23304}
  - drm/amd/display: Fix system hang while resume with TBT monitor {CVE-2024-50003}
  - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator {CVE-2026-43085}
  - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION {CVE-2026-31590}
  - l2tp: Drop large packets with UDP encap {CVE-2026-43080}
  - tun: limit printing rate when illegal packet received by tun dev {CVE-2024-27013}
  - xfrm: always flush state and policy upon NETDEV_UNREGISTER event {CVE-2026-43167}
  - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding {CVE-2026-43315}
  - xenbus: Use kref to track req lifetime {CVE-2025-37949}
  - wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS {CVE-2024-46830}
  - scsi: smartpqi: Fix disable_managed_interrupts {CVE-2024-26742}
  - IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF {CVE-2023-52851}
  - vhost-vdpa: fix use after free in vhost_vdpa_probe() {CVE-2023-52795}
  - ndisc: ndisc_send_redirect() cleanup
  - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
  - ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
  - ipv6: icmp: convert to dev_net_rcu()
  - ipv4: icmp: convert to dev_net_rcu()
  - ipv4: use RCU protection in __ip_rt_update_pmtu() {CVE-2025-21766}
  - ipv6: use RCU protection in ip6_default_advmss() {CVE-2025-21765}
  - fix: ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
  - neighbour: use RCU protection in __neigh_notify() {CVE-2025-21763}
  - arp: use RCU protection in arp_xmit() {CVE-2025-21762}
  - openvswitch: use RCU protection in ovs_vport_cmd_fill_info() {CVE-2025-21761}
  - ndisc: extend RCU protection in ndisc_send_skb() {CVE-2025-21760}
  - ipv6: mcast: extend RCU protection in igmp6_send() {CVE-2025-21759}
  - ipv6: mcast: add RCU protection to mld_newpack() {CVE-2025-21758}
  - ipv4: use RCU protection in rt_is_expired()
  - ipv4: use RCU protection in inet_select_addr()
  - ipv4: add RCU protection to ip4_dst_hoplimit()
  - flow_dissector: use RCU protection to fetch dev_net()
  - net: add dev_net_rcu() helper
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency {CVE-2024-47696}
  - perf/x86/amd/core: Always clear status for idx {CVE-2023-53073}
  - tcp_bpf: fix return value of tcp_bpf_sendmsg() {CVE-2024-46783}
  - RDMA/umem: Fix double dma_buf_unpin in failure path {CVE-2026-43128}
  - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453}
  - drm/ttm: Fix a NULL pointer dereference {CVE-2023-53095}
  - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak {CVE-2026-43035}
  - fbcon: check return value of con2fb_acquire_newinfo() {CVE-2026-43123}
  - ipv4: prevent potential spectre v1 gadget in fib_metrics_match() {CVE-2023-52996}
  - perf/x86/intel/uncore: Skip discovery table for offline dies {CVE-2026-43079}
  - mm/page_alloc: clear page->private in free_pages_prepare() {CVE-2026-43303}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() {CVE-2026-23111}
  - netfilter: nf_tables: restore set elements when delete set fails {CVE-2024-27012}
  - drm/amdkfd: Correct the migration DMA map direction {CVE-2024-57897}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els5]
changelog:
  - spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
  - Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
  - net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419}
  - bonding: do not set usable_slaves for broadcast mode {CVE-2026-31419}
  - net: bonding: update the slave array for broadcast mode {CVE-2026-31419}
  - dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
  - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
  - net: Fix an unsafe loop on the list {CVE-2024-50024}
  - sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy {CVE-2025-21636}
  - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx {CVE-2023-54300}
  - wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
  - drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream {CVE-2024-49913}
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset {CVE-2024-50142}
  - serial: imx: Introduce timeout when waiting on transmitter empty {CVE-2024-40967}
  - iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind {CVE-2023-53501}
  - octeontx2-af: Add validation before accessing cgx and lmac {CVE-2023-53654}
  - sctp: sysctl: rto_min/max: avoid using current->nsproxy {CVE-2025-21639}
  - net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices {CVE-2023-52984}
  - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start {CVE-2024-49944}
  - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR {CVE-2022-48703}
  - x86/mm: Fix pti_clone_pgtable() alignment assumption {CVE-2024-44965}
  - net: usb: asix_devices: add phy_mask for ax88772 mdio bus {CVE-2025-38725}
  - ALSA: hda: Do not unset preset when cleaning up codec {CVE-2023-52736}
  - drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func {CVE-2024-49909}
  - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE {CVE-2024-53144}
  - fuse: Initialize beyond-EOF page contents before setting uptodate {CVE-2024-44947}
  - sctp: sysctl: udp_port: avoid using current->nsproxy {CVE-2025-21637}
  - dm stats: check for and propagate alloc_percpu failure {CVE-2023-53044}
  - netpoll: Fix race condition in netpoll_owner_active {CVE-2024-41005}
  - tracing: Fix overflow in get_free_elt() {CVE-2024-43890}
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
  - xen/netfront: stop tx queues during live migration {CVE-2022-48969}
  - Bluetooth: btusb: clamp SCO altsetting table indices {CVE-2026-31497}
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free {CVE-2025-38105}
  - can: j1939: make j1939_sk_bind() fail if device is no longer registered {CVE-2025-39925}
  - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() {CVE-2023-52508}
  - smb: client: Don't log plaintext credentials in cifs_set_cifscreds {CVE-2026-23303}
  - cifs: Fix integer overflow while processing acdirmax mount option {CVE-2025-21963}
  - netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
  - drm/amdgpu/vkms: fix a possible null pointer dereference {CVE-2023-52815}
  - drm/amd/amdgpu: Check tbo resource pointer {CVE-2024-46807}
  - bonding: fix null pointer deref in bond_ipsec_offload_ok {CVE-2024-44990}
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower {CVE-2024-50237}
  - trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
  - drm/amdkfd: Add sync after creating vram bo {CVE-2023-53009}
  - bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
  - drm/client: fix null pointer dereference in drm_client_modeset_probe {CVE-2024-43894}
  - ext4: correct grp validation in ext4_mb_good_group {CVE-2023-53861}
  - RDMA/irdma: Initialize free_qp completion before using it {CVE-2026-31492}
  - usb: udc: remove warning when queue disabled ep {CVE-2024-35822}
  - bpf: Remove tst_run from lwt_seg6local_prog_ops. {CVE-2024-46754}
  - Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet {CVE-2024-56590}
  - tls: stop recv() if initial process_rx_list gave us non-DATA {CVE-2024-58239}
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path {CVE-2022-50482}
  - ext4: update s_journal_inum if it changes after journal replay {CVE-2023-53091}
  - cifs: Fix xid leak in cifs_copy_file_range() {CVE-2022-50643}
  - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit {CVE-2024-49938}
  - nbd: null check for nla_nest_start {CVE-2024-27025}
  - netfilter: ipset: Hold module reference while requesting a module {CVE-2024-56637}
  - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 {CVE-2024-46817}
  - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() {CVE-2026-31512}
  - Bluetooth: MGMT: Add error handling to pair_device() {CVE-2024-43884}
  - netfilter: nf_conntrack_expect: skip expectations in other netns via proc {CVE-2026-31496}
  - nvme-pci: fix mempool alloc size {CVE-2022-50756}
  - fs: fix fd table size alignment properly {CVE-2024-45025}
  - gpio: sim: fix a memory leak {CVE-2023-52706}
  - ice: switch: fix potential memleak in ice_add_adv_recipe() {CVE-2022-48709}
  - netfilter: ebtables: fix memory leak when blob is malformed {CVE-2022-48641}
  - mfd: syscon: Fix null pointer dereference in of_syscon_register() {CVE-2023-52467}
  - netfilter: ipset: drop logically empty buckets in mtype_del {CVE-2026-31418}
  - scsi: megaraid_sas: Fix for a potential deadlock {CVE-2024-57807}
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream {CVE-2023-52806}
  - drm/amd/display: Avoid NULL dereference of timing generator {CVE-2023-52753}
  - netfilter: nft_socket: fix sk refcount leaks {CVE-2024-46855}
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken {CVE-2025-38099}
  - objtool: Fix memory leak in create_static_call_sections() {CVE-2023-53423}
  - ceph: defer stopping mdsc delayed_work
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga {CVE-2023-52819}
  - rethook: fix a potential memleak in rethook_alloc() {CVE-2022-49795}
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() {CVE-2022-49787}
  - scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() {CVE-2023-53132}
  - cifs: fix small mempool leak in SMB2_negotiate() {CVE-2022-49938}
  - regulator: of: Fix refcount leak bug in of_get_regulation_constraints() {CVE-2022-50191}
  - watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource {CVE-2022-50110}
  - drm/ttm: fix bulk_move corruption when adding a entry {CVE-2023-53444}
  - clk: Fix memory leak in devm_clk_notifier_register() {CVE-2023-53674}
  - md: raid1: fix potential OOB in raid1_remove_disk() {CVE-2023-53722}
  - wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU {CVE-2023-54052}
  - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags {CVE-2024-49923}
  - recordmcount: Fix memory leaks in the uwrite function {CVE-2023-53318}
  - crypto: cavium - prevent integer overflow loading firmware {CVE-2022-50330}
  - integrity: Fix memory leakage in keyring allocation error path {CVE-2022-50395}
  - mmc: toshsd: fix return value check of mmc_add_host() {CVE-2022-50886}
  - RDMA/efa: Fix wrong resources deallocation order {CVE-2023-54201}
  - inet: read sk->sk_family once in inet_recv_error() {CVE-2024-26679}
  - ALSA: pcm: Add sanity NULL check for the default mmap fault handler {CVE-2024-53180}
  - net_sched: Prevent creation of classes with TC_H_ROOT {CVE-2025-21971}
  - net: usb: smsc95xx: Limit packet length to skb->len {CVE-2023-53062}
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() {CVE-2024-35930}
  - devres: Fix memory leakage caused by driver API devm_free_percpu() {CVE-2024-43871}
  - rdma/cxgb4: Prevent potential integer overflow on 32bit {CVE-2024-57973}
  - ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects {CVE-2023-53708}
  - rxrpc: Fix missing locking causing hanging calls {CVE-2024-50294}
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() {CVE-2024-50008}
  - ELF: fix kernel.randomize_va_space double read {CVE-2024-46826}
  - crypto: bcm - add error check in the ahash_hmac_init function {CVE-2024-56681}
  - drm/amd/pm: fix null pointer access {CVE-2025-38705}
  - ALSA: line6: Fix racy access to midibuf {CVE-2024-44954}
  - ALSA: us122l: Use snd_card_free_when_closed() at disconnection {CVE-2024-56532}
  - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node {CVE-2023-52662}
  - drm/amd/display: Initialize denominators' default to 1 {CVE-2024-49899}
  - ipmi: fix use after free in _ipmi_destroy_user() {CVE-2022-50677}
  - Bluetooth: Fix memory leak in hci_req_sync_complete() {CVE-2024-35978}
  - null_blk: fix validation of block size {CVE-2024-41077}
  - ionic: Fix netdev notifier unregister on failure {CVE-2024-56715}
  - cifs: Fix integer overflow while processing acregmax mount option {CVE-2025-21964}
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure {CVE-2025-37841}
  - nvmet-tcp: fix kernel crash if commands allocation fails {CVE-2024-46737}
  - netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() {CVE-2024-50259}
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses {CVE-2024-42247}
  - drm/amd/pm: Prevent division by zero {CVE-2025-37770}
  - drm/sched: Increment job count before swapping tail spsc queue {CVE-2025-38515}
  - i2c: qup: jump out of the loop in case of timeout {CVE-2025-38671}
  - brcmfmac: return error when getting invalid max_flowrings from dongle {CVE-2022-50358}
  - PNP: fix name memory leak in pnp_alloc_dev() {CVE-2022-50278}
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN {CVE-2025-38393}
  - regmap: Fix race condition in hwspinlock irqsave routine {CVE-2026-23071}
  - drm/amd/pm: Prevent division by zero {CVE-2025-37768}
  - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() {CVE-2022-49780}
  - RDMA/cm: Fix leaking the multicast GID table reference {CVE-2025-71084}
  - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
  - drop_monitor: fix incorrect initialization order {CVE-2025-21862}
  - wifi: nl80211: disallow setting special AP channel widths {CVE-2024-43912}
  - net/mlx5: Fix steering rules cleanup {CVE-2023-53079}
  - usbnet: Fix using smp_processor_id() in preemptible code warnings {CVE-2025-40164}
  - mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc {CVE-2024-58009}
  - fs/binfmt_elf: Fix memory leak in load_elf_binary() {CVE-2022-50466}
  - drm/amdgpu: set the right AMDGPU sg segment limitation {CVE-2024-56594}
  - bridge: mcast: Fix use-after-free during router port configuration {CVE-2025-38248}
  - xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
  - fuse: reject oversized dirents in page cache {CVE-2026-31694}
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation {CVE-2026-31488}
  - net/mlx5: Collect command failures data only for known commands {CVE-2023-53340}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183}
  - scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
  - scsi: sd: Fix off-by-one error in sd_read_block_characteristics() {CVE-2024-47682}
  - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
  - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
  - nbd: fix race between timeout and normal completion {CVE-2024-49855}
  - iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() {CVE-2025-21724}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els6]
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
  - unshare: fix unshare_fs() handling {CVE-2026-43472}
  - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423}
  - net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422}
  - net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421}
  - dm: fix queue start/stop imbalance under suspend/load/resume races {CVE-2025-40134}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() {CVE-2024-26773}
  - ext4: fix i_data_sem unlock order in ext4_ind_migrate() {CVE-2024-50006}
  - xen: Fix the issue of resource not being properly released in xenbus_dev_probe() {CVE-2024-53198}
  - HID: pidff: Fix null pointer dereference in pidff_find_fields {CVE-2025-37862}
  - crypto: af_alg - Set merge to zero early in af_alg_sendmsg {CVE-2025-39931}
  - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper {CVE-2025-39681}
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061}
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change {CVE-2023-53103}
  - NFS: Fix a potential data corruption {CVE-2023-53711}
  - NFS: Fix a use after free in nfs_direct_join_group() {CVE-2023-53711}
  - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload {CVE-2024-36919}
  - x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type {CVE-2023-52659}
  - Input: uinput - reject requests with unreasonable number of slots {CVE-2024-46745}
  - afs: Fix the maximum cell name length {CVE-2025-21646}
  - drm/i915: Avoid potential vm use-after-free {CVE-2023-52931}
  - interconnect: fix mem leak when freeing nodes {CVE-2023-53096}
  - drm/vkms: Fix memory leak in vkms_init() {CVE-2022-50269}
  - USB: dwc3: fix memory leak with using debugfs_lookup() {CVE-2023-53415}
  - mm/uffd: fix pte marker when fork() without fork event {CVE-2022-49744}
  - scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() {CVE-2023-53696}
  - ipmi_si: fix a memleak in try_smi_init() {CVE-2023-53611}
  - KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() {CVE-2024-58083}
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() {CVE-2024-36924}
  - firmware: cs_dsp: Validate payload length before processing block {CVE-2024-42237}
  - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
  - ftrace: Avoid potential division by zero in function_stat_show() {CVE-2025-21898}
  - IB/core: Implement a limit on UMAD receive List {CVE-2024-42145}
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ {CVE-2024-27437}
  - netfilter: nf_tables: reject duplicate device on updates {CVE-2025-38678}
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type {CVE-2025-23161}
  - net: nexthop: Initialize all fields in dumped nexthops {CVE-2024-42283}
  - tracing: Make sure trace_printk() can output as soon as it can be used {CVE-2023-53007}
  - net: tls: explicitly disallow disconnect {CVE-2025-37756}
  - KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel {CVE-2025-21779}
  - ext4: turn quotas off if mount failed after enabling quotas {CVE-2023-54153}
  - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
  - block: fix overflow in blk_ioctl_discard() {CVE-2024-36917}
  - usb: xhci: Check endpoint is valid before dereferencing it {CVE-2023-52901}
  - iio: core: fix memleak in iio_device_register_sysfs {CVE-2023-52643}
  - platform/x86/amd/pmc: Detect when STB is not available {CVE-2024-53072}
  - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() {CVE-2023-52939}
  - dm thin: make get_first_thin use rcu-safe list first function {CVE-2025-21664}
  - bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock {CVE-2025-21951}
  - bonding: provide a net pointer to __skb_flow_dissect() {CVE-2026-23119}
  - rocker: fix memory leak in rocker_world_port_post_fini() {CVE-2026-23164}
  - rtc: class: Fix potential memleak in devm_rtc_allocate_device() {CVE-2022-50477}
  - ice: fix memory leak in aRFS after reset {CVE-2025-21981}
  - bpf: Forget ranges when refining tnum after JSET {CVE-2025-39748}
  - net: hns: fix possible memory leak in hnae_ae_register() {CVE-2022-50352}
  - team: better TEAM_OPTION_TYPE_STRING validation {CVE-2025-21787}
  - refscale: Fix uninitalized use of wait_queue_head_t {CVE-2023-54316}
  - opp: Fix use-after-free in lazy_opp_tables after probe deferral {CVE-2023-54026}
  - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust {CVE-2024-53122}
  - serial: 8250: fix panic due to PSLVERR {CVE-2025-39724}
  - perf: Fix sample vs do_exit() {CVE-2025-38424}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els5]
changelog:
  - af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
  - netfilter: nft_limit: reject configurations that cause integer overflow {CVE-2024-26668}
  - libbpf: Fix use-after-free in btf_dump_name_dups {CVE-2022-3534}
  - bpf: Fix partial dynptr stack slot reads/writes {CVE-2023-39191}
  - ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
  - ima: define ima_max_digest_data struct without a flexible array variable
  - ima: detect changes to the backing overlay file
  - tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command {CVE-2023-6546}
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
  - netfilter: tproxy: bail out if IP has been disabled on the device {CVE-2024-36270}
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). {CVE-2024-36904}
  - Bluetooth: Fix double free in hci_conn_cleanup {CVE-2023-28464}
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super {CVE-2024-0841}
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() {CVE-2024-26852}
  - tipc: fix UAF in error path {CVE-2024-36886}
  - Bluetooth: af_bluetooth: Fix deadlock {CVE-2024-26886}
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly {CVE-2024-39277}
  - net/mlx5e: Prevent deadlock while disabling aRFS {CVE-2024-27014}
  - net/mlx5e: Introduce flow steering API {CVE-2024-27014}
  - x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
  - x86: Introduce ia32_enabled() {CVE-2024-25742}
  - x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
  - x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
  - RDMA/srpt: Support specifying the srpt_service_guid parameter {CVE-2024-26744}
  - platform/x86: think-lmi: Fix reference leak {CVE-2023-52520}
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command {CVE-2024-27059}
  - fat: fix uninitialized field in nostale filehandles {CVE-2024-26973}
  - usb: xhci: Add error handling in xhci_map_urb_for_dma {CVE-2024-26964}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete {CVE-2024-26897}
  - wifi: mac80211: fix race condition on enabling fast-xmit {CVE-2024-26779}
  - RDMA/qedr: Fix qedr_create_user_qp error flow {CVE-2024-26743}
  - wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer {CVE-2024-26603}
  - wifi: rt2x00: restart beacon queue when hardware reset {CVE-2023-52595}
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg {CVE-2023-52528}
  - RDMA/siw: Fix connection failure handling {CVE-2023-52513}
  - usb: hub: Guard against accesses to uninitialized BOS descriptors {CVE-2023-52477}
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc {CVE-2021-47185}
  - sctp: fail if no bound addresses can be used for a given scope {CVE-2023-1074}
  - memcg: enable accounting for file lock caches {CVE-2022-0480}
  - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
  - RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872}
  - drm/amd/display: Atom Integrated System Info v2_2 for DCN35 {CVE-2024-36897}
  - net/mlx5e: fix a potential double-free in fs_any_create_groups {CVE-2023-52667}
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() {CVE-2024-36902}
  - ipv6: prevent NULL dereference in ip6_output() {CVE-2024-36901}
  - vt: fix memory overlapping when deleting chars in the buffer {CVE-2022-48627}
  - hwmon: (coretemp) Fix out-of-bounds memory access {CVE-2024-26664}
  - i2c: Fix a potential use after free {CVE-2019-25162}
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump {CVE-2024-26615}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els6]
changelog:
  - tun: add missing verification for short frame {CVE-2024-41091}
  - tap: add missing verification for short frame {CVE-2024-41090}
  - drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552}
  - net: fix __dst_negative_advice() race {CVE-2024-36971}
  - net: annotate data-races around sk->sk_dst_pending_confirm {CVE-2024-36971}
  - net: fix out-of-bounds access in ops_init {CVE-2024-36883}
  - net/sched: flower: Fix chain template offload {CVE-2024-26669}
  - netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397}
  - netfilter: nft_set_rbtree: Remove unused variable nft_net {CVE-2024-27397}
  - netfilter: nft_set_rbtree: prefer sync gc to async worker {CVE-2024-27397}
  - netfilter: nft_set_rbtree: rename gc deactivate+erase function {CVE-2024-27397}
  - netfilter: nf_tables: de-constify set commit ops function argument {CVE-2024-27397}
  - netfilter: nft_set_rbtree: .deactivate fails if element has expired {CVE-2024-27397}
  - sched/membarrier: reduce the ability to hammer on sys_membarrier {CVE-2024-26602}
  - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts {CVE-2022-38096}
  - sched/psi: Fix use-after-free in ep_remove_wait_queue() {CVE-2023-52707}
  - wait: add wake_up_pollfree() {CVE-2023-52707}
  - x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
  - x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
  - x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). {CVE-2024-37356}
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued {CVE-2024-38384}
  - netfilter: complete validation of user input {CVE-2024-35962}
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop] {CVE-2023-52635}
  - netfilter: validate user input for expected length {CVE-2024-35896}
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails {CVE-2024-37353}
  - bnxt: prevent skb UAF after handing over to PTP worker {CVE-2022-48637}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 {CVE-2024-38558}
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs {CVE-2024-36929}
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation {CVE-2024-36017}
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound {CVE-2024-33621}
  - drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
  - gro: fix ownership transfer {CVE-2024-35890}
  - mlxbf_gige: stop interface during shutdown {CVE-2024-35885}
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() {CVE-2023-52809}
  - wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225}
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
  - scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161}
  - drm/amdgpu/mes: fix use-after-free issue {CVE-2024-38581}
  - i40e: fix vf may be used uninitialized in this function warning {CVE-2024-36020}
  - vt: fix unicode buffer corruption when deleting characters {CVE-2024-35823}
  - ata: libata-core: Fix double free on error {CVE-2024-41087}
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path {CVE-2024-26925}
  - tcp_metrics: validate source addr length {CVE-2024-42154}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els7]
changelog:
  - tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
  - dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
  - scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
  - ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
  - block/ioctl: prefer different overflow check {CVE-2024-41000}
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." {CVE-2024-40984}
  - net/sched: Fix UAF when resolving a clash {CVE-2024-41040}
  - nvme: avoid double free special payload {CVE-2024-41073}
  - x86/tdx: Allow 32-bit emulation by default {CVE-2024-25744}
  - x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
  - x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
  - x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
  - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
  - x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
  - x86/entry: Compile entry_SYSCALL32_ignore() unconditionally {CVE-2024-25744}
  - x86/entry: Rename ignore_sysret() {CVE-2024-25744}
  - x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
  - x86: Introduce ia32_enabled() {CVE-2024-25742}
  - x86: Fix misspelled Kconfig symbols {CVE-2024-25744}
  - x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
  - objtool: Add entry UNRET validation {CVE-2024-25744}
  - x86/cpu: Switch to arch_cpu_finalize_init() {CVE-2022-40982}
  - init: Provide arch_cpu_finalize_init() {CVE-2022-40982}
  - gfs2: Fix potential glock use-after-free on unmount {CVE-2024-38570}
  - gfs2: Rename sd_{ glock => kill }_wait {CVE-2024-38570}
  - gfs2: Remove ill-placed consistency check {CVE-2024-38570}
  - gfs2: simplify gdlm_put_lock with out_free label {CVE-2024-38570}
  - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list {CVE-2024-40956}
  - drm/amdgpu: add error handle to avoid out-of-bounds {CVE-2024-39471}
  - net/mlx5: Discard command completions in internal error {CVE-2024-38555}
  - net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-52628}
  - perf/core: Fix potential NULL deref {CVE-2023-5717}
  - perf: Disallow mis-matched inherited group reads {CVE-2023-5717}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els8]
changelog:
  - drm/amd/pm: Fix negative array index read {CVE-2024-46821}
  - drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
  - drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
  - drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box {CVE-2024-46811}
  - Squashfs: sanity check symbolic link size {CVE-2024-46744}
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859}
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() {CVE-2024-40995}
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc {CVE-2024-40995}
  - netfilter: bridge: confirm multicast packets before passing them up the stack {CVE-2024-27415}
  - netfilter: let reset rules clean out conntrack entries {CVE-2024-27415}
  - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray {CVE-2024-42243}
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify {CVE-2024-36899}
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem {CVE-2024-35895}
  - bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t {CVE-2024-35895}
  - mm/huge_memory: don't unpoison huge_zero_folio {CVE-2024-40914}
  - cxgb4: fix use after free bugs caused by circular dependency problem {CVE-2023-4133}
  - timers: Restore ABI Compatibility with timer_delete Functions {CVE-2023-4133}
  - timers: Provide timer_shutdown[_sync]() {CVE-2023-4133}
  - timers: Add shutdown mechanism to the internal functions {CVE-2023-4133}
  - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode {CVE-2023-4133}
  - timers: Silently ignore timers with a NULL function {CVE-2023-4133}
  - timers: Rename del_timer() to timer_delete() {CVE-2023-4133}
  - timers: Rename del_timer_sync() to timer_delete_sync() {CVE-2023-4133}
  - timers: Use del_timer_sync() even on UP {CVE-2023-4133}
  - timers: Update kernel-doc for various functions {CVE-2023-4133}
  - timers: Replace BUG_ON()s {CVE-2023-4133}
  - timers: Get rid of del_singleshot_timer_sync() {CVE-2023-4133}
  - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
  - mm: avoid overflows in dirty throttling logic {CVE-2024-42131}
  - ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
  - igc: avoid returning frame twice in XDP_REDIRECT {CVE-2024-26853}
  - igc: Avoid transmit queue timeout for XDP {CVE-2024-26853}
  - nfsd: fix RELEASE_LOCKOWNER {CVE-2024-26629}
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc {CVE-2023-52880}
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment {CVE-2024-42152}
  - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() {CVE-2024-42110}
  - x86: stop playing stack games in profile_pc() {CVE-2024-42096}
  - xdp: Remove WARN() from __xdp_reg_mem_model() {CVE-2024-42082}
  - NFSv4: Fix memory leak in nfs4_set_security_label {CVE-2024-41076}
  - ppp: reject claimed-as-LCP but actually malformed packets {CVE-2024-41044}
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). {CVE-2024-41041}
  - sched/deadline: Fix task_struct reference leak {CVE-2024-41023}
  - tipc: force a dst refcount before doing decryption {CVE-2024-40983}
  - scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
  - xhci: Handle TD clearing for multiple streams case {CVE-2024-40927}
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
  - ipv6: fix possible race in __fib6_drop_pcpu_from() {CVE-2024-40905}
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING {CVE-2024-39476}
  - usb-storage: alauda: Check whether the media is initialized {CVE-2024-38619}
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() {CVE-2024-38619}
  - crypto: bcm - Fix pointer arithmetic {CVE-2024-38579}
  - scsi: qedf: Ensure the copied buf is NUL terminated {CVE-2024-38559}
  - wifi: nl80211: don't free NULL coalescing rule {CVE-2024-36941}
  - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() {CVE-2024-36025}
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() {CVE-2024-35898}
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work {CVE-2024-35852}
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination {CVE-2024-35845}
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791}
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes {CVE-2024-35789}
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work {CVE-2024-27052}
  - nfp: flower: handle acti_netdevs allocation failure {CVE-2024-27046}
  - octeontx2-af: Use separate handlers for interrupts {CVE-2024-27030}
  - netfilter: flowtable: validate pppoe header {CVE-2024-27016}
  - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address {CVE-2024-26946}
  - scsi: qla2xxx: Fix command flush on cable pull {CVE-2024-26931}
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() {CVE-2024-26855}
  - bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel {CVE-2024-26737}
  - Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself {CVE-2023-52735}
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() {CVE-2023-52651}
  - net: tap_open(): set sk_uid from current_fsuid() {CVE-2023-4194}
  - net: tun_chr_open(): set sk_uid from current_fsuid() {CVE-2023-4194}
  - seg6: fix the iif in the IPv6 socket control block {CVE-2021-47515}
  - tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds {CVE-2024-42148}
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes {CVE-2024-46759}
  - net: bridge: mst: fix vlan use-after-free {CVE-2024-36979}
  - stm class: Fix a double free in stm_register_device() {CVE-2024-38627}
  - wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk {CVE-2024-46743}
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup {CVE-2024-46747}
  - drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
  - drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
  - wifi: nl80211: Avoid address calculations via out of bounds array indexing {CVE-2024-38562}
  - wifi: nl80211: convert cfg80211_scan_request allocation to *_size macros {CVE-2024-38562}
  - overflow: Implement size_t saturating arithmetic helpers {CVE-2024-38562}
  - cdrom: rearrange last_media_change check to avoid unintentional overflow {CVE-2024-42136}
  - ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() {CVE-2024-38588}
  - drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
  - sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
  - firmware: cs_dsp: Fix overflow checking of wmfw header {CVE-2024-41039}
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes {CVE-2024-46758}
  - HID: amd_sfh: free driver_data after destroying hid device {CVE-2024-46746}
  - xfs: don't walk off the end of a directory data block {CVE-2024-41013}
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes {CVE-2024-46756}
  - tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes {CVE-2024-46757}
  - drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}
  - drm/amdgpu/mes: fix mes ring buffer overflow {CVE-2024-46700}
  - exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
  - PCI/MSI: Fix UAF in msi_capability_init {CVE-2024-41096}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els9]
changelog:
  - smb: client: fix use-after-free in smb2_query_info_compound() {CVE-2023-52751}
  - smb: client: prevent new fids from being removed by laundromat {CVE-2023-52751}
  - cifs: fix dentry lookups in directory handle cache {CVE-2023-52751}
  - cifs: return a single-use cfid if we did not get a lease {CVE-2023-52751}
  - cifs: Check the lease context if we actually got a lease {CVE-2023-52751}
  - cifs: set rc to -ENOENT if we can not get a dentry for the cached dir {CVE-2023-52751}
  - cifs: use LIST_HEAD() and list_move() to simplify code {CVE-2023-52751}
  - cifs: fix wrong unlock before return from cifs_tree_connect() {CVE-2023-52751}
  - uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}
  - net: do not delay dst_entries_add() in dst_release() {CVE-2024-50036}
  - smb: client: fix UAF in async decryption {CVE-2024-50047}
  - smb3: rename encryption/decryption TFMs
  - mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
  - driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
  - drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
  - ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
  - Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
  - mptcp: pm: Fix uaf in __timer_delete_sync {CVE-2024-46858}
  - of: fdt: fix off-by-one error in unflatten_dt_nodes() {CVE-2022-48672}
  - filelock: fix potential use-after-free in posix_lock_inode {CVE-2024-41049}
  - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock {CVE-2024-41049}
  - drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
  - ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
  - slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
  - ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
  - ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
  - ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
  - tipc: guard against string buffer overrun {CVE-2024-49995}
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
  - firmware_loader: Block path traversal {CVE-2024-47742}
  - ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
  - ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
  - drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
  - ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
  - wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
  - net: do not leave a dangling sk pointer, when socket creation fails {CVE-2024-40954}
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune() {CVE-2024-36978}
  - drm/amdgpu: Validate TA binary size {CVE-2024-44977}


author: Vadim Panov <vadim.panov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els10]
changelog:
  - smb: client: fix use-after-free of signing key {CVE-2024-53179}
  - smb: client: stop flooding dmesg in smb2_calc_signature() {CVE-2024-53179}
  - smb3: fix oops in calculating shash_setkey {CVE-2024-53179}
  - cifs: return correct error in ->calc_signature() {CVE-2024-53179}
  - cifs: secmech: use shash_desc directly, remove sdesc {CVE-2024-53179}
  - cifs: replace kfree() with kfree_sensitive() for sensitive data {CVE-2024-53179}
  - xsk: fix OOB map writes when deleting elements {CVE-2024-56614}
  - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}
  - scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631}
  - EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708}
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl {CVE-2024-56662}
  - net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601}
  - initramfs: avoid filename buffer overrun {CVE-2024-53142}
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
  - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
  - Bluetooth: msft: fix slab-use-after-free in msft_do_close() {CVE-2024-36012}
  - Bluetooth: Fix support for Read Local Supported Codecs V2 {CVE-2024-36012}
  - Bluetooth: hci_codec: Fix leaking content of local_codecs {CVE-2024-36012}
  - blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
  - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602}
  - net: inet6: do not leave a dangling sk pointer in inet6_create() {CVE-2024-56600}
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
  - net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 {CVE-2023-52818}
  - bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
  - ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
  - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' {CVE-2024-56608}
  - netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
  - HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit {CVE-2023-52519}
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer(). {CVE-2024-56642}
  - cifs: Fix buffer overflow when parsing NFS reparse points {CVE-2024-49996}
  - Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
  - PM / devfreq: Fix buffer overflow in trans_stat_show {CVE-2023-52614}
  - PM / devfreq: Rework freq_table to be local to devfreq struct {CVE-2023-52614}
  - cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() {CVE-2024-41057}
  - cachefiles: fix slab-use-after-free in fscache_withdraw_volume() {CVE-2024-41058}
  - netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() {CVE-2024-41058}
  - memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
  - Bluetooth: ISO: Fix UAF on iso_sock_timeout {CVE-2024-50124}
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125}
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout {CVE-2024-50125}
  - Bluetooth: Consolidate code around sk_alloc into a helper function {CVE-2024-50125}
  - smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() {CVE-2024-35861}
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() {CVE-2024-26754}
  - smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868}
  - smb: client: fix potential UAF in cifs_debug_files_proc_show() {CVE-2024-35868}
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
  - wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
  - x86/alternatives: Disable KASAN in apply_alternatives() {CVE-2023-52504}
  - bpf: Fix out-of-bounds write in trie_get_next_key() {CVE-2024-50262}
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
  - media: edia: dvbdev: fix a use-after-free {CVE-2024-27043}
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2024-27043}
  - media: dvbdev: fix build warning due to comments {CVE-2024-27043}
  - media: dvbdev: adopts refcnt to avoid UAF {CVE-2024-27043}


author: Vadim Panov <vadim.panov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els11]
changelog:
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format {CVE-2024-53104}
  - ALSA: 6fire: Release resources at card release {CVE-2024-53239}
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches {CVE-2024-26885}
  - bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' {CVE-2024-27045}
  - af_packet: avoid erroring out after sock_init_data() in packet_create() {CVE-2024-56606}
  - cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
  - arm64: hibernate: Fix level3 translation fault in swsusp_save() {CVE-2024-26989}
  - perf: hisi: Fix use-after-free when register pmu fails {CVE-2023-52859}
  - nbd: fix uaf in nbd_open {CVE-2023-52837}
  - ring-buffer: Do not attempt to read past "commit" {CVE-2023-52501}
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) {CVE-2023-52637}
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
  - asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
  - pinctrl: core: delete incorrect free in pinctrl_enable() {CVE-2024-36940}
  - irqchip/gic-v3-its: Prevent double free on error {CVE-2024-35847}
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit {CVE-2024-27395}
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
  - nfs: fix UAF in direct writes {CVE-2024-26958}
  - of: Fix double free in of_parse_phandle_with_args_map {CVE-2023-52679}
  - ext4: fix double-free of blocks due to wrong extents moved_len {CVE-2024-26704}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update {CVE-2024-35855}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els12]
changelog:
  - spec: update shim Conflicts, Provides keys
  - HID: core: zero-initialize the report buffer {CVE-2024-50302}
  - net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
  - bus: mhi: host: Add alignment check for event ring read pointer {CVE-2023-52494}
  - net: sched: fix ets qdisc OOB Indexing {CVE-2025-21692}
  - parport: Proper fix for array out-of-bounds access {CVE-2024-50074}
  - udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
  - security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
  - usb: typec: altmode should keep reference to parent {CVE-2024-50150}
  - dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
  - dm cache: optimize dirty bit checking with find_next_bit when resizing {CVE-2024-50278}
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50279}
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug {CVE-2024-46853}
  - smb: client: fix OOBs when building SMB2_IOCTL request {CVE-2024-50151}
  - net: sched: fix use-after-free in taprio_change() {CVE-2024-50127}
  - USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
  - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() {CVE-2024-53059}
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed {CVE-2024-53059}
  - tracing: Consider the NULL character when validating the event length {CVE-2024-50131}
  - crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
  - NFSD: fix hang in nfsd4_shutdown_callback {CVE-2025-21795}
  - NFSD: add courteous server support for thread with only delegation {CVE-2025-21795}
  - efi: rt-wrapper: Add missing include {CVE-2023-21102}
  - arm64: efi: Execute runtime services from a dedicated stack {CVE-2023-21102}
  - mptcp: refactor passive socket initialization {CVE-2024-26782}
  - mptcp: implement delayed seq generation for passive fastopen {CVE-2024-26782}
  - smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864}
  - smb: client: fix potential UAF in cifs_dump_full_key() {CVE-2024-35866}
  - cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2024-35866}
  - smb: client: fix potential UAF in smb2_is_network_name_deleted() {CVE-2024-35862}
  - smb: client: fix potential UAF in is_valid_oplock_break() {CVE-2024-35863}
  - smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
  - bpf: Protect against int overflow for stack access size {CVE-2024-35905}
  - bpf: Fix verification of indirect var-off stack access {CVE-2024-35905}
  - devlink: fix possible use-after-free and memory leaks in devlink_init() {CVE-2024-26734}
  - leds: trigger: Unregister sysfs attributes before calling deactivate() {CVE-2024-43830}
  - ionic: fix use after netif_napi_del() {CVE-2024-39502}
  - ionic: clean interrupt before enabling queue to avoid credit race {CVE-2024-39502}
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink {CVE-2024-44970}
  - vt_ioctl: fix array_index_nospec in vt_setactivate {CVE-2022-48804}
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() {CVE-2022-49011}
  - raid1: fix use-after-free for original bio in raid1_write_request() {CVE-2024-35979}
  - md/raid1: free the r1bio before waiting for blocked rdev {CVE-2024-35979}
  - drm/amdgpu: fix usage slab after free {CVE-2024-56551}
  - drm/amd: Use `amdgpu_ucode_*` helpers for GPU info bin {CVE-2024-56551}
  - drm/amd: Add a new helper for loading/validating microcode {CVE-2024-56551}
  - drm/amd: check num of link levels when update pcie param {CVE-2023-52812}
  - drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments {CVE-2023-52812}
  - drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported {CVE-2023-52812}
  - drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters() {CVE-2023-52812}
  - drm/amd: Use amdgpu_device_pcie_dynamic_switching_supported() for SMU7 {CVE-2023-52812}
  - drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with SMU13 {CVE-2023-52812}
  - drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs {CVE-2023-52812}
  - drm/amd: Move helper for dynamic speed switch check out of smu13 {CVE-2023-52812}
  - drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13 {CVE-2023-52812}
  - drm/amd/pm: share the code around SMU13 pcie parameters update {CVE-2023-52812}
  - drm: zynqmp_kms: Unplug DRM device before removal {CVE-2024-56538}
  - padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
  - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt {CVE-2023-52854}
  - drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() {CVE-2024-57798}
  - drm/dp_mst: Skip CSN if topology probing is not done yet {CVE-2024-57798}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els13]
changelog:
  - ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
  - wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
  - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' {CVE-2024-27042}
  - dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763}
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
  - cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
  - veth: Fix use after free in XDP_REDIRECT {CVE-2023-53107}
  - firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() {CVE-2024-53068}
  - arm64/sve: Discard stale CPU state when handling SVE traps {CVE-2024-50275}
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd {CVE-2025-21969}
  - wifi: mt76: mt7921e: fix use-after-free in free_irq() {CVE-2024-26892}
  - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read {CVE-2024-58069}
  - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() {CVE-2025-21927}
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
  - net_sched: sch_fifo: implement lockless __fifo_dump() {CVE-2025-21702}
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() {CVE-2025-21993}
  - vlan: enforce underlying device type {CVE-2025-21920}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
  - watch_queue: Actually free the watch {CVE-2022-49256}
  - can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
  - netfilter: nf_set_pipapo: fix initial map fill {CVE-2024-57947}
  - hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations {CVE-2021-47098}
  - aio: fix use-after-free due to missing POLLFREE handling {CVE-2021-47505}
  - aio: keep poll requests on waitqueue until completed {CVE-2021-47505}
  - smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
  - cifs: remove useless DeleteMidQEntry() {CVE-2023-52757}
  - media: uvcvideo: Remove dangling pointers {CVE-2024-58002}
  - media: uvcvideo: Only save async fh if success {CVE-2024-58002}
  - media: uvcvideo: Refactor iterators {CVE-2024-58002}
  - drm: nv04: Fix out of bounds access {CVE-2024-27008}
  - drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array {CVE-2025-21785}
  - net: rose: fix timer races against user threads {CVE-2025-21718}
  - media: uvcvideo: Fix double free in error path {CVE-2024-57980}
  - vrf: use RCU protection in l3mdev_l3_out() {CVE-2025-21791}
  - geneve: Fix use-after-free in geneve_find_dev(). {CVE-2025-21858}
  - afs: Increase buffer size in afs_update_volume_status() {CVE-2024-26736}
  - net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
  - bpf: Check validity of link->type in bpf_link_show_fdinfo() {CVE-2024-53099}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els14]
changelog:
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow {CVE-2024-38577}
  - tcp: fix mptcp DSS corruption due to large pmtu xmit {CVE-2024-50083}
  - vsock: Keep the binding until socket destruction {CVE-2025-21756}
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove {CVE-2025-22020}
  - drm/i915: Fix potential bit_17 double-free {CVE-2023-52930}
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition {CVE-2025-22056}
  - mm: shmem: fix data-race in shmem_getattr() {CVE-2024-46828}
  - nvmet-auth: assign dh_key to NULL after kfree_sensitive {CVE-2024-50215}
  - net: explicitly clear the sk pointer, when pf->create fails {CVE-2024-50186}
  - net: wwan: fix global oob in wwan_rtnl_policy {CVE-2024-50128}
  - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free {CVE-2024-49983}
  - vhost_vdpa: assign irq bypass producer token correctly {CVE-2024-47748}
  - wifi: rtw88: always wait for both firmware loading attempts {CVE-2024-47718}
  - sched: sch_cake: fix bulk flow accounting logic for host fairness {CVE-2024-46828}
  - fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF {CVE-2024-46786}
  - net: bridge: mcast: wait for previous gc cycles when removing port {CVE-2024-44934}
  - vhost/vsock: always initialize seqpacket_allow {CVE-2024-43873}
  - ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
  - nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
  - SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
  - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync {CVE-2024-53208}
  - wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one {CVE-2024-56663}
  - Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
  - tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
  - net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els15]
changelog:
  - udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
  - bpf: Prevent tail call between progs attached to different hooks {CVE-2024-50063}
  - nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043}
  - nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682}
  - nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
  - nfsd: split sc_status out of sc_type {CVE-2024-46682}
  - net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
  - net: fix geneve_opt length integer overflow {CVE-2025-22055}
  - net: usb: lan78xx: Fix double free issue with interrupt buffer allocation {CVE-2024-53213}
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
  - xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els16]
changelog:
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
  - net: atm: fix use after free in lec_send() {CVE-2025-22004}
  - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up {CVE-2025-21887}
  - rcutorture: Fix ksoftirqd boosting timing and iteration {CVE-2022-50177}
  - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() {CVE-2022-49940}
  - selinux: Add boundary check in put_entry() {CVE-2022-50200}
  - Squashfs: fix handling and sanity checking of xattr_ids count {CVE-2023-52933}
  - net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
  - ext4: ignore xattrs past end {CVE-2025-37738}
  - ext4: fix off-by-one error in do_split {CVE-2025-23150}
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list {CVE-2025-21919}
  - md: fix mddev uaf while iterating all_mddevs list {CVE-2025-22126}
  - ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
  - md: factor out a helper from mddev_put()
  - Fix "Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd"
  - ext4: prevent stale extent cache entries caused by concurrent get es_cache


author: Vadim Panov <vadim.panov@yahoo.com> [5.14.0-284.1101.el9_2.tuxcare.7.els17]
changelog:
  - net_sched: hfsc: Fix a UAF vulnerability in class handling {CVE-2025-37797}
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error {CVE-2025-38089}
  - net: ch9200: fix uninitialised access during mii_nway_restart {CVE-2025-38086}
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121}
  - locking/csd_lock: Change csdlock_debug from early_param to __setup {CVE-2022-50091}
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes {CVE-2025-21991}
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead {CVE-2022-49977}
  - NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072}
  - NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-49316}
  - mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els18]
changelog:
  - tls: always refresh the queue when reading sock {CVE-2025-38471}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
  - i2c/designware: Fix an initialization issue {CVE-2025-38380}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
  - mm/khugepaged: fix GUP-fast interaction by sending IPI
  - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() {CVE-2025-21867}
  - crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
  - ext4: avoid journaling sb update on error if journal is destroying {CVE-2025-22113}
  - ext4: define ext4_journal_destroy wrapper
  - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
  - Bluetooth: Remove BT_HS {CVE-2024-38620}
  - block, bfq: fix bfqq uaf in bfq_limit_depth() {CVE-2024-53166}
  - dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763}
  - bpf: Fix helper writes to read-only maps (alt version) {CVE-2024-49861}
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
  - netfilter: xtables: avoid NFPROTO_UNSPEC where needed {CVE-2024-50038}
  - xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
  - net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
  - net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
  - padata: fix UAF in padata_reorder {CVE-2025-21727}
  - RDMA/mlx5: Fix page_size variable overflow {CVE-2025-22091}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els19]
changelog:
  - mm/hugetlb: unshare page tables during VMA split, not before {CVE-2025-38084}
  - hugetlb: unshare some PMDs when splitting VMAs {CVE-2025-38084}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
  - tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
  - vsock: Fix transport_* TOCTOU {CVE-2025-38461}
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
  - net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-37914}
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
  - udp: Fix memory accounting leak. {CVE-2025-22058}
  - net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
  - sch_htb: make htb_deactivate() idempotent {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
  - sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
  - sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
  - sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
  - sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
  - net: fix udp gso skb_segment after pull from frag_list {CVE-2025-38124}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els20]
changelog:
  - drm/amd/amdgpu: introduce gc_*_mes_2.bin v2
  - proc: fix a dentry lock race between release_task and lookup
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
  - scsi: aacraid: Remove useless code
  - scsi: aacraid: Remove unused aac_check_health()
  - scsi: aacraid: struct {user,}sgmap{,64,raw}: Replace 1-element arrays with flexible arrays
  - scsi: aacraid: Rearrange order of struct aac_srb_unit
  - scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array with flexible array
  - scsi: aacraid: union aac_init: Replace 1-element array with flexible array
  - scsi: aacraid: aachba: Replace snprintf() with the safer scnprintf() variant
  - Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity"
  - scsi: aacraid: Avoid -Warray-bounds warning
  - scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity
  - scsi: aacraid: Replace all non-returning strlcpy with strscpy
  - scsi: aacraid: Declare SCSI host template const
  - scsi: aacraid: Drop redundant pci_enable_pcie_error_reporting()
  - scsi: aacraid: Allocate cmd_priv with scsicmd
  - scsi: aacraid: Remove redundant "the"
  - scsi: aacraid: Fix undefined behavior due to shift overflowing the constant
  - scsi: aacraid: Clean up some inconsistent indenting
  - scsi: aacraid: Move the SCSI pointer to private command data
  - scsi: aacraid: Fix spelling of "its"
  - scsi: aacraid: Call scsi_done() directly
  - scsi: aacraid: Introduce aac_scsi_done()
  - scsi: aacraid: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
  - scsi: aacraid: Remove an unused include
  - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler {CVE-2024-25743}
  - net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() {CVE-2025-38550}
  - scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
  - PM: hibernate: defer device probing when resuming from hibernation {CVE-2022-50202}
  - net: fix UaF in netns ops registration error path {CVE-2023-52999}
  - net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed {CVE-2023-52999}
  - usb: typec: fix potential array underflow in ucsi_ccg_sync_control() {CVE-2024-53203}
  - soundwire: cadence: fix invalid PDI offset {CVE-2024-38635}
  - drm/i915/vma: Fix UAF on destroy against retire race {CVE-2024-26939}
  - netns: Make get_net_ns() handle zero refcount net {CVE-2024-40958}
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487}
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
  - wifi: ath11k: fix gtk offload status event locking {CVE-2023-52777}
  - wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
  - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() {CVE-2022-48632}
  - net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739}
  - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv {CVE-2021-47459}
  - net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg {CVE-2021-47596}
  - Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
  - crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
  - crypto: qat - fix double free during reset
  - media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
  - fs/smb/client: Reset password pointer to NULL {CVE-2023-5345}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els21]
changelog:
  - mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
  - mm: fix zswap writeback race condition {CVE-2023-53178}
  - dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
  - drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
  - gpio: davinci: Validate the obtained number of IRQs {CVE-2024-42092}
  - ASoC: topology: Fix references to freed memory {CVE-2024-41069}
  - Bluetooth: hci_sock: Fix not validating setsockopt user input {CVE-2024-35963}
  - Bluetooth: ISO: Fix not validating setsockopt user input {CVE-2024-35964}
  - Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
  - Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
  - dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939}
  - wifi: mwifiex: avoid possible NULL skb pointer dereference {CVE-2023-53384}
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380}
  - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
  - thermal: core: prevent potential string overflow {CVE-2023-52868}
  - drm/amdkfd: Fix shift out-of-bounds issue {CVE-2023-52816}
  - drm/vkms: Fix null-ptr-deref in vkms_release() {CVE-2022-50369}
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
  - net/mlx5: Fix tainted pointer delete is case of flow rules creation fail {CVE-2024-40940}
  - ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
  - platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
  - platform/x86: wmi: remove unnecessary initializations
  - perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
  - do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
  - usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
  - vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
  - igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
  - kobject_uevent: Fix OOB access within zap_modalias_env() {CVE-2024-42292}
  - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() {CVE-2023-53401}
  - net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
  - drm/radeon: possible buffer overflow {CVE-2023-52867}
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
  - wifi: mac80211_hwsim: Fix possible NULL dereference {CVE-2023-53209}
  - vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
  - wifi: iwlwifi: fw: fix memory leak in debugfs {CVE-2023-53422}
  - drm/amdgpu: fix memory leak in mes self test {CVE-2023-53370}
  - skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
  - md/raid10: fix leak of 'r10bio->remaining' for recovery {CVE-2023-53299}
  - nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
  - ppdev: Add an error check in register_device {CVE-2024-36015}
  - wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
  - net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
  - net: add atomic_long_t to net_device_stats fields {CVE-2024-26882}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els22]
changelog:
  - locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
  - netfilter: ipset: Fix suspicious rcu_dereference_protected() {CVE-2024-40993}
  - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type {CVE-2024-39503}
  - netfilter: ipset: Missing gc cancellations fixed {CVE-2024-39503}
  - netfilter: ipset: Add list flush to cancel_gc {CVE-2024-39503}
  - netfilter: ipset: fix performance regression in swap operation {CVE-2024-26910}
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test {CVE-2024-26910}
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
  - scsi: mpt3sas: Fix a memory leak {CVE-2023-53512}
  - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() {CVE-2023-53464}
  - wifi: ath11k: fix deinitialization of firmware resources {CVE-2023-53532}
  - mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() {CVE-2022-50464}
  - ionic: catch failure from devlink_alloc {CVE-2023-53470}
  - enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
  - gpiolib: cdev: fix uninitialised kfifo {CVE-2024-36898}
  - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync {CVE-2022-50447}
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP {CVE-2024-36974}
  - ext4: Fix function prototype mismatch for ext4_feat_ktype {CVE-2023-53224}
  - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation {CVE-2023-53477}
  - netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry {CVE-2025-38472}
  - Bluetooth: qca: add missing firmware sanity checks {CVE-2024-36880}
  - Bluetooth: qca: fix info leak when fetching fw build id {CVE-2024-36032}
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
  - drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
  - drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876}
  - drm/vc4: don't check if plane->state->fb == state->fb {CVE-2024-35932}
  - drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create {CVE-2023-53263}
  - cifs: fix oops during encryption {CVE-2022-50341}
  - smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
  - smb: client: fix race with concurrent opens in rename(2) {CVE-2025-39825}
  - ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL {CVE-2023-52697}
  - blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none {CVE-2023-53292}
  - mlx5: fix possible ptp queue fifo use-after-free {CVE-2023-53398}
  - sctp: check send stream number after wait_for_sndbuf {CVE-2023-53296}
  - sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
  - scsi: mpi3mr: Use number of bits to manage bitmap sizes {CVE-2023-53376}
  - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue {CVE-2023-53280}
  - mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data {CVE-2023-53232}
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
  - fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value {CVE-2022-50327}
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() {CVE-2023-53220}
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() {CVE-2022-50272}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els23]
changelog:
  - nfs: fix possible null-ptr-deref when parsing param {CVE-2022-50455}
  - KVM: arm64: Disassociate vcpus from redistributor region on teardown {CVE-2024-40989}
  - HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
  - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg {CVE-2024-56633}
  - ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
  - ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() {CVE-2023-53483}
  - crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
  - KVM: nSVM: Check instead of asserting on nested TSC scaling support {CVE-2023-53663}
  - ice: Don't tx before switchdev is fully configured {CVE-2023-53657}
  - rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed {CVE-2023-53655}
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() {CVE-2023-53623}
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50485}
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode {CVE-2022-50485}
  - ext4: add helper to check quota inums {CVE-2022-50485}
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode {CVE-2022-50485}
  - swiotlb: Fix double-allocation of slots due to broken alignment handling {CVE-2024-35814}
  - swiotlb: fix a braino in the alignment check fix {CVE-2024-35814}
  - swiotlb: fix slot alignment checks {CVE-2024-35814}
  - swiotlb: fix the deadlock in swiotlb_do_find_slots
  - drm/radeon: free iio for atombios when driver shutdown {CVE-2023-53453}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els24]
changelog:
  - perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
  - block: fix uaf for flush rq while iterating tags {CVE-2024-53170}
  - zram: fix potential UAF of zram table {CVE-2025-21671}
  - sched: sch_cake: add bounds checks to host bulk flow fairness counts {CVE-2025-21647}
  - bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors {CVE-2024-56675}
  - net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
  - isofs: Prevent the use of too small fid {CVE-2025-37780}
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
  - sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
  - ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}
  - RDMA/rxe: Fix incomplete state save in rxe_requester {CVE-2023-53539}
  - crypto: xts - Handle EBUSY correctly {CVE-2023-53494}
  - Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
  - af_unix: Fix data-races around user->unix_inflight. {CVE-2023-53204}
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367}
  - wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
  - wifi: rtlwifi: remove unused dualmac control leftovers
  - wifi: rtlwifi: remove unused timer and related code
  - partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
  - ipmr: do not call mr_mfc_uses_dev() for unres entries {CVE-2025-21719}
  - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
  - net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
  - net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
  - null_blk: Always check queue mode setting from configfs {CVE-2023-53576}
  - ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
  - rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() {CVE-2023-53558}
  - pstore/ram: Check start of empty przs during init {CVE-2023-53331}
  - wifi: ath11k: fix memory leak in WMI firmware stats {CVE-2023-53602}
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
  - net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() {CVE-2022-50486}
  - RDMA/core: Make sure "ib_port" is valid when access sysfs node {CVE-2022-50475}
  - RDMA/rxe: Fix mr->map double free {CVE-2022-50543}
  - scsi: qla2xxx: Fix end of loop test
  - scsi: qla2xxx: Fix mem access after free
  - scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
  - scsi: target: Fix multiple LUN_RESET handling {CVE-2023-53586}
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses {CVE-2023-53675}
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() {CVE-2023-53675}
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841}
  - nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
  - bnxt: avoid overflow in bnxt_get_nvram_directory() {CVE-2023-53661}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els25]
changelog:
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
  - padata: Fix pd UAF once and for all {CVE-2025-38584}
  - wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
  - padata: Fix list iterator in padata_do_serial()
  - padata: do not leak refcount in reorder_work {CVE-2025-38031}
  - padata: avoid UAF for reorder_work {CVE-2025-21726}
  - padata: add pd get/put refcnt helper
  - net/smc: fix UAF on smcsk after smc_listen_out() {CVE-2025-38734}
  - scsi: mpi3mr: Bad drive in topology results kernel crash {CVE-2023-53037}
  - scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
  - igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
  - drm/i915/sseu: fix max_subslices array-index-out-of-bounds access {CVE-2023-53112}
  - i40e: fix idx validation in config queues msg {CVE-2025-39971}
  - dm-bufio: don't schedule in atomic context {CVE-2025-37928}
  - fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927}
  - tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable {CVE-2025-37885}
  - KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
  - KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache {CVE-2022-49882}
  - jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
  - power: supply: gpio-charger: Fix set charge current limits {CVE-2024-57792}
  - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object {CVE-2024-46798}
  - ipv6: prevent possible UAF in ip6_xmit() {CVE-2024-44985}
  - ipv6: fix possible UAF in ip6_finish_output2() {CVE-2024-44986}
  - netfilter: flowtable: validate vlan header {CVE-2024-44983}
  - usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() {CVE-2024-50268}
  - usb: vhci-hcd: Do not drop references before new references are gained {CVE-2024-43883}
  - drm/amd/display: Fix slab-use-after-free on hdcp_work {CVE-2025-21968}
  - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
  - drm/amd/display: Check index msg_id before read or write {CVE-2024-42121}
  - drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages {CVE-2024-41011}
  - drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
  - drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
  - drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
  - drm/i915: mark requests for GuC virtual engines to avoid use-after-free {CVE-2023-53552}
  - ptp: fix integer overflow in max_vclocks_store {CVE-2024-40994}
  - nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
  - loop: Fix use-after-free issues {CVE-2023-53111}
  - ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
  - mptcp: use the workqueue to destroy unaccepted sockets {CVE-2023-53072}
  - perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output {CVE-2023-53065}
  - erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
  - HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  - netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
  - coresight: Clear the connection field properly {CVE-2022-50214}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-53145}
  - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
  - x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
  - arm64: sme: Use STR P to clear FFR context field in streaming SVE mode {CVE-2023-53713}
  - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read {CVE-2023-53710}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els26]
changelog:
  - mm: hugetlb: fix UAF in hugetlb_handle_userfault {CVE-2022-50630}
  - drm/amdkfd: fix potential kgd_mem UAFs {CVE-2023-53816}
  - net/mlx5e: Fix deadlock in tc route query code {CVE-2023-53591}
  - PCI: Fix pci_device_is_present() for VFs by checking PF {CVE-2022-50636}
  - wifi: ath11k: fix monitor mode bringup crash {CVE-2022-50627}
  - wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
  - scsi: target: iscsi: Fix timeout on deleted connection {CVE-2025-38075}
  - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va {CVE-2023-53819}
  - dmaengine: ptdma: check for null desc before calling pt_cmd_callback {CVE-2023-53755}
  - wifi: mt7601u: fix an integer underflow {CVE-2023-53679}
  - Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087}
  - tls: wait for pending async decryptions if tls_strp_msg_hold fails {CVE-2025-40176}
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns {CVE-2025-38499}
  - net: openvswitch: reject negative ifindex {CVE-2023-53843}
  - drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
  - iommu/amd: Improve page fault error reporting {CVE-2023-53789}
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy {CVE-2023-53519}
  - Bluetooth: Fix potential use-after-free when clear keys {CVE-2023-53386}
  - Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
  - ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
  - ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673}
  - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
  - rxrpc: Make it so that a waiting process can be aborted {CVE-2023-53218}
  - ip6_vti: fix slab-use-after-free in decode_session6 {CVE-2023-53821}
  - vxlan: Fix nexthop hash size {CVE-2023-53192}
  - wifi: mac80211: check S1G action frame size {CVE-2023-53257}
  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
  - dm flakey: fix a crash with invalid table line {CVE-2023-53786}
  - md/raid10: fix null-ptr-deref in raid10_sync_request {CVE-2023-53832}
  - md: don't dereference mddev after export_rdev() {CVE-2023-53665}
  - md: fix 'delete_mutex' deadlock
  - md: fix duplicate filename for rdev {CVE-2023-53665}
  - kernfs: Fix UAF in polling when open file is released {CVE-2025-39881}
  - mptcp: pm: avoid possible UaF when selecting endp {CVE-2024-44974}
  - mptcp: fix UaF in listener shutdown {CVE-2023-53088}
  - Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
  - Bluetooth: hci_sync: fix set_local_name race condition
  - Bluetooth: MGMT: Fix possible deadlocks {CVE-2024-53207}
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
  - e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898}
  - wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864}
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI {CVE-2025-39965}
  - xfrm: Duplicate SPI Handling {CVE-2025-39797}
  - nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
  - NFS: Fix a race when updating an existing write {CVE-2025-39697}
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
  - drm/amd/display: Check dce_hwseq before dereferencing it {CVE-2025-38361}


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.28.1.el9_2]
changelog:
  - iavf: fix reset task race with iavf_remove() (Petr Oros) [2228156 2223599]
  - iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies (Petr Oros) [2228156 2223599]
  - Revert "iavf: Do not restart Tx queues after reset task failure" (Petr Oros) [2228156 2223599]
  - Revert "iavf: Detach device during reset task" (Petr Oros) [2228156 2223599]
  - iavf: Wait for reset in callbacks which trigger it (Petr Oros) [2228156 2223599]
  - iavf: use internal state to free traffic IRQs (Petr Oros) [2228156 2223599]
  - iavf: Fix out-of-bounds when setting channels on remove (Petr Oros) [2228156 2223599]
  - iavf: Fix use-after-free in free_netdev (Petr Oros) [2228156 2223599]
  - iavf: make functions static where possible (Petr Oros) [2228156 2223599]
  - iavf: fix err handling for MAC replace (Petr Oros) [2228156 2223599]
  - iavf: remove some unused functions and pointless wrappers (Petr Oros) [2228156 2223599]
  - iavf: remove mask from iavf_irq_enable_queues() (Petr Oros) [2228156 2223599]
  - iavf: send VLAN offloading caps once after VFR (Petr Oros) [2228156 2223599]
  - i40e: Wait for pending VF reset in VF set callbacks (Ivan Vecera) [2228158 2215498]
  - i40e: Add helper for VF inited state check with timeout (Ivan Vecera) [2228158 2215498]
  - KEYS: use kfree_sensitive with key (Vladis Dronov) [2227768 2223719]
  - locking/rtmutex: Add a lockdep assert to catch potential nested blocking (Crystal Wood) [2225623 2218724]
  - locking/rtmutex: Avoid pointless blk_flush_plug() invocations (Crystal Wood) [2225623 2218724]
  - locking/rtmutex: Submit/resume work explicitly before/after blocking (Crystal Wood) [2225623 2218724]
  - sched/core: Provide sched_rtmutex() and expose sched work helpers (Crystal Wood) [2225623 2218724]
  - cpufreq: intel_pstate: Enable HWP IO boost for all servers (David Arcari) [2210270 2175626]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.29.1.el9_2]
changelog:
  - redhat: configs: Disable CONFIG_CRYPTO_STATS since performance issue for storage (Herbert Xu) [2231850 2227964]
  - i2c: tegra: Fix PEC support for SMBUS block read (Steve Best) [2230488 2214531]
  - i2c: tegra: Set ACPI node as primary fwnode (Steve Best) [2230483 2222101]
  - perf vendor events intel: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf vendor events intel: Refresh sapphirerapids metrics and events (Michael Petlan) [2230175 2177180]
  - perf vendor events: Update Intel sapphirerapids (Michael Petlan) [2230175 2177180]
  - perf/x86/intel/cstate: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf/x86/intel: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf/x86/intel/uncore: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf/x86/msr: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf/x86/rapl: Add support for Intel Emerald Rapids (Michael Petlan) [2230175 2177180]
  - platform/x86: intel-uncore-freq: add Emerald Rapids support (Michael Petlan) [2230169 2156827]
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (Phil Sutter) [2228990 2225271] {CVE-2023-4147}
  - netfilter: nft_set_pipapo: fix improper element removal (Phil Sutter) [2227510 2225277] {CVE-2023-4004}


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.30.1.el9_2]
changelog:
  - sched/core: Add __always_inline to schedule_loop() (Crystal Wood) [2233928 2232098]
  - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Tao Liu) [2232700 2182562]
  - arm64: efi: Make efi_rt_lock a raw_spinlock (Mark Salter) [2213499 2188323] {CVE-2023-21102}
  - efi: rt-wrapper: Add missing include (Mark Salter) [2213499 2188323] {CVE-2023-21102}
  - arm64: efi: Execute runtime services from a dedicated stack (Mark Salter) [2213499 2188323] {CVE-2023-21102}
  - crypto: rng - Fix lock imbalance in crypto_del_rng (Herbert Xu) [2232213 2229643]
  - drm/ast: Fix ARM compatibility (Robert Foss) [2232302 2192980]
  - irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 (Mark Salter) [2231962 2179060]
  - genirq: GENERIC_IRQ_EFFECTIVE_AFF_MASK depends on SMP (Mark Salter) [2231962 2179060]
  - scsi: storvsc: Handle SRB status value 0x30 (Cathy Avery) [2231990 2224933]
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Cathy Avery) [2230747 2228298]
  - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress (Benjamin Marzinski) [2228481 2159623]
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225642 2225102] {CVE-2023-3776}
  - md: add error_handlers for raid0 and linear (Nigel Croxon) [2221170 2162219]


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.30.1.el9_2.tuxcare.els2]
changelog:
  - bpf: Fix re-attachment branch in bpf_tracing_prog_attach {CVE-2024-26591}
  - ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
  - smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier {CVE-2023-52449}
  - net: prevent mss overflow in skb_segment() {CVE-2023-52435}
  - smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
  - atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
  - ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
  - nvmet: nul-terminate the NQNs passed in the connect command {CVE-2023-6121}
  - netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
  - NFSD: fix use-after-free in nfsd4_ssc_setup_dul() {CVE-2023-1652}
  - x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045}
  - Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
  - x86: Clear .brk area at early boot {CVE-2022-36123}
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
  - Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
  - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
  - relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
  - ipv6: rpl: Fix Route of Death. {CVE-2023-2156}
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-2156}
  - net: rpl: fix rpl header size calculation {CVE-2023-2156}
  - memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
  - ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
  - drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters {CVE-2024-1086}
  - perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() {CVE-2023-6931}
  - drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}
  - nvmet-tcp: Fix the H2C expected PDU len calculation {CVE-2023-6356}
  - nvmet-tcp: remove boilerplate code {CVE-2023-6356}
  - nvmet-tcp: fix a crash in nvmet_req_complete() {CVE-2023-6356}
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length {CVE-2023-6356}
  - net: tls, update curr on splice as well {CVE-2024-0646}
  - smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
  - smb: client: fix potential OOB in cifs_dump_detail() {CVE-2023-6610}
  - smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
  - RDMA/core: Update CMA destination address on rdma_resolve_addr {CVE-2023-2176}
  - RDMA/core: Refactor rdma_bind_addr {CVE-2023-2176}
  - nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
  - netfilter: nf_tables: skip bound chain on rule flush {CVE-2023-3777}
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
  - drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623}
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
  - nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
  - net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
  - bpf: Fix incorrect verifier pruning due to missing register precision taints {CVE-2023-2163}
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4206}
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4207}
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4208}
  - net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.30.1.el9_2.tuxcare.els3]
changelog:
  - IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests {CVE-2023-52474}
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). {CVE-2023-4622}
  - sched/rt: pick_next_rt_entity(): check list_entry {CVE-2023-1077}
  - RDMA/irdma: Prevent zero-length STAG registration {CVE-2023-25775}
  - block: add check that partition length needs to be aligned with block size {CVE-2023-52458}
  - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS {CVE-2024-26589}
  - bpf: fix check for attempt to corrupt spilled pointer {CVE-2023-52462}
  - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache {CVE-2024-26598}
  - ext4: regenerate buddy after block freeing failed if under fc replay {CVE-2024-26601}
  - ext4: allow ext4_get_group_info() to fail {CVE-2024-26601}
  - mlxsw: spectrum_acl_tcam: Fix stack corruption {CVE-2024-26586}
  - EDAC/thunderx: Fix possible out-of-bounds string access {CVE-2023-52464}
  - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() {CVE-2023-52470}
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table {CVE-2023-52469}
  - md/raid5: fix atomicity violation in raid5_cache_count {CVE-2024-23307}
  - igb: set max size RX buffer when store bad packet is enabled {CVE-2023-45871}
  - netfilter: nft_set_rbtree: skip end interval element from gc {CVE-2024-26581}
  - netfilter: nf_tables: check if catch-all set element is active in next generation {CVE-2024-1085}
  - netfilter: nf_tables: skip set commit for deleted/destroyed sets {CVE-2024-0193}
  - netfilter: nft_set_pipapo: skip inactive elements during set walk {CVE-2023-6817}
  - netfilter: nf_tables: split async and sync catchall in two functions {CVE-2023-4244}
  - netfilter: nf_tables: remove catchall element in GC sync path {CVE-2023-4244}
  - netfilter: nf_tables: expose opaque set element as struct nft_elem_priv {CVE-2023-4244}
  - netfilter: nf_tables: set backend .flush always succeeds {CVE-2023-4244}
  - netfilter: nft_set_pipapo: no need to call pipapo_deactivate() from flush {CVE-2023-4244}
  - netfilter: nf_tables: work around newrule after chain binding {CVE-2023-4244}
  - netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure {CVE-2023-4244}
  - netfilter: nf_tables: fix memleak when more than 255 elements expired {CVE-2023-4244}
  - netfilter: nf_tables: disable toggling dormant table state more than once {CVE-2023-4244}
  - netfilter: nf_tables: disallow element removal on anonymous sets {CVE-2023-4244}
  - netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration {CVE-2023-4244}
  - netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails {CVE-2023-4244}
  - netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention {CVE-2023-4244}
  - netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC {CVE-2023-4244}
  - netfilter: nf_tables: disallow rule removal from chain binding {CVE-2023-4244}
  - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction {CVE-2023-4244}
  - netfilter: nf_tables: defer gc run if previous batch is still pending {CVE-2023-4244}
  - netfilter: nf_tables: fix out of memory error handling {CVE-2023-4244}
  - netfilter: nf_tables: use correct lock to protect gc_list {CVE-2023-4244}
  - netfilter: nf_tables: GC transaction race with abort path {CVE-2023-4244}
  - netfilter: nf_tables: flush pending destroy work before netlink notifier {CVE-2023-4244}
  - netfilter: nft_dynset: disallow object maps {CVE-2023-4244}
  - netfilter: nf_tables: GC transaction race with netns dismantle {CVE-2023-4244}
  - netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path {CVE-2023-4244}
  - netfilter: nf_tables: don't fail inserts if duplicate has expired {CVE-2023-4244}
  - netfilter: nf_tables: deactivate catchall elements in next generation {CVE-2023-4244}
  - netfilter: nf_tables: fix kdoc warnings after gc rework {CVE-2023-4244}
  - netfilter: nf_tables: fix false-positive lockdep splat {CVE-2023-4244}
  - netfilter: nf_tables: remove busy mark and gc batch API {CVE-2023-4244}
  - netfilter: nft_set_hash: mark set element as dead when deleting from packet path {CVE-2023-4244}
  - netfilter: nf_tables: adapt set backend to use GC transaction API {CVE-2023-4244}
  - netfilter: nft_set_rbtree: fix overlap expiration walk {CVE-2023-4244}
  - netfilter: nf_tables: GC transaction API to avoid race with control plane {CVE-2023-4244}
  - netfilter: nf_tables: don't skip expired elements during walk {CVE-2023-4244}
  - netfilter: nf_tables: skip bound chain in netns release path {CVE-2023-4244}
  - netfilter: nf_tables: fix spurious set element insertion failure {CVE-2023-4244}
  - netfilter: nf_tables: report use refcount overflow {CVE-2023-4244}
  - netfilter: nf_tables: fix underflow in chain reference counter {CVE-2023-4244}
  - netfilter: nf_tables: disallow timeout for anonymous sets {CVE-2023-4244}
  - netfilter: nf_tables: disallow updates of anonymous sets {CVE-2023-4244}
  - netfilter: nf_tables: reject unbound chain set before commit phase {CVE-2023-4244}
  - netfilter: nf_tables: reject unbound anonymous set before commit phase {CVE-2023-4244}
  - netfilter: nf_tables: disallow element updates of bound anonymous sets {CVE-2023-4244}
  - netfilter: nf_tables: fix underflow in object reference counter {CVE-2023-4244}
  - netfilter: nf_tables: drop map element references from preparation phase {CVE-2023-4244}
  - netfilter: nf_tables: validate variable length element extension {CVE-2023-4244}
  - netfilter: nft_set_pipapo: .walk does not deal with generations {CVE-2023-4244}
  - netfilter: nf_tables: relax set/map validation checks {CVE-2023-4244}
  - netfilter: nf_tables: integrate pipapo into commit protocol {CVE-2023-4244}
  - netfilter: nf_tables: upfront validation of data via nft_data_init() {CVE-2023-4244}
  - netfilter: nft_set_rbtree: fix null deref on element insertion
  - netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
  - netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR {CVE-2023-4015}
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() {CVE-2023-7192}
  - Documentation/hw-vuln: Fix rST warning {CVE-2022-27672}
  - Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions {CVE-2022-27672}
  - KVM: x86: Mitigate the cross-thread return address predictions bug {CVE-2022-27672}
  - x86/speculation: Identify processors vulnerable to SMT RSB predictions {CVE-2022-27672}
  - uio: Fix use-after-free in uio_open {CVE-2023-52439}
  - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump {CVE-2023-52448}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.30.1.el9_2.tuxcare.els4]
changelog:
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() {CVE-2024-26882}
  - tls: fix use-after-free on failed backlog decryption {CVE-2024-26800}
  - tls: separate no-async decryption request handling from async {CVE-2024-26584}
  - tls: decrement decrypt_pending if no async completion will be called {CVE-2024-26584}
  - net: tls: fix use-after-free with partial reads and async decrypt {CVE-2024-26582}
  - net: tls: handle backlogging of crypto requests {CVE-2024-26584}
  - net: tls: factor out tls_*crypt_async_wait()
  - tap: tap_open(): correctly initialize socket uid {CVE-2023-1076}
  - tun: tun_chr_open(): correctly initialize socket uid {CVE-2023-1076}
  - net: add sock_init_data_uid() {CVE-2023-1076}
  - netfilter: nf_tables: bail out on mismatching dynset and set expressions {CVE-2023-6622}
  - drm/qxl: fix UAF on handle creation {CVE-2023-39198}
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
  - USB: core: Fix deadlock in port "disable" sysfs attribute {CVE-2024-26933}
  - USB: core: Add hub_get() and hub_put() routines {CVE-2024-26933}
  - USB: core: Fix deadlock in usb_deauthorize_interface() {CVE-2024-26934}
  - scsi: qla2xxx: Fix double free of fcport {CVE-2024-26929}
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() {CVE-2024-27020}
  - net: ip_tunnel: prevent perpetual headroom growth {CVE-2024-26804}
  - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout {CVE-2024-26643}
  - netfilter: nf_tables: disallow anonymous set with timeout flag {CVE-2024-26642}
  - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations {CVE-2024-26673}
  - ipv6: sr: fix possible use-after-free and null-ptr-deref {CVE-2024-26735}
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() {CVE-2024-26993}
  - cifs: fix underflow in parse_server_interfaces() {CVE-2024-26828}
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path {CVE-2024-26595}
  - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code {CVE-2024-26595}
  - mlxsw: spectrum_acl_tcam: Make fini symmetric to init {CVE-2024-26595}
  - mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() {CVE-2024-26595}
  - net: xfrm: Fix xfrm_address_filter OOB read {CVE-2023-39194}
  - exfat: check if filename entries exceeds max filename length {CVE-2023-4273}
  - xfrm: add NULL check in xfrm_update_ae_params {CVE-2023-3772}
  - firmware: arm_scmi: Harden accesses to the reset domains {CVE-2022-48655}
  - tcp: Reduce chance of collisions in inet6_hashfn(). {CVE-2023-1206}
  - ipv4: fix null-deref in ipv4_link_failure {CVE-2023-42754}
  - netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
  - netfilter: xt_sctp: validate the flag_info count {CVE-2023-39193}
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition {CVE-2023-33203}
  - net/tls: tls_is_tx_ready() checked list_entry {CVE-2023-1075}
  - HID: asus: use spinlock to safely schedule workers {CVE-2023-1079}
  - HID: asus: use spinlock to protect concurrent accesses {CVE-2023-1079}
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map {CVE-2023-3358}
  - gfs2: Don't deref jdesc in evict {CVE-2023-3212}
  - fbcon: Check font dimension limits {CVE-2023-3161}
  - KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition {CVE-2023-1855}
  - Bluetooth: HCI: Fix global-out-of-bounds {CVE-2023-28866}
  - HID: check empty report_list in hid_validate_values() {CVE-2023-1073}
  - net: mpls: fix stale pointer if allocation fails during device rename {CVE-2023-26545}
  - r8152: Rate limit overflow messages {CVE-2022-3594}
  - drm/vmwgfx: Fix shader stage validation {CVE-2022-36402}
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory {CVE-2022-42895}
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern {CVE-2023-2269}
  - mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() {CVE-2023-52562}
  - i2c: i801: Fix block process call transactions {CVE-2024-26593}
  - bpf: Fix hashtab overflow check on 32-bit arches {CVE-2024-26884}
  - bpf: Fix stackmap overflow check on 32-bit arches {CVE-2024-26883}
  - x86/xen: Add some null pointer checking to smp.c {CVE-2024-26908}
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment {CVE-2024-26907}
  - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security {CVE-2024-26903}
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak {CVE-2024-26901}
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2024-26898}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.30.1.el9_2.tuxcare.els5]
changelog:
  - af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
  - netfilter: nft_limit: reject configurations that cause integer overflow {CVE-2024-26668}
  - libbpf: Fix use-after-free in btf_dump_name_dups {CVE-2022-3534}
  - bpf: Fix partial dynptr stack slot reads/writes {CVE-2023-39191}
  - ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
  - ima: define ima_max_digest_data struct without a flexible array variable
  - ima: detect changes to the backing overlay file
  - tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
  - netfilter: tproxy: bail out if IP has been disabled on the device {CVE-2024-36270}
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). {CVE-2024-36904}
  - Bluetooth: Fix double free in hci_conn_cleanup {CVE-2023-28464}
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super {CVE-2024-0841}
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() {CVE-2024-26852}
  - tipc: fix UAF in error path {CVE-2024-36886}
  - Bluetooth: af_bluetooth: Fix deadlock {CVE-2024-26886}
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly {CVE-2024-39277}
  - net/mlx5e: Prevent deadlock while disabling aRFS {CVE-2024-27014}
  - net/mlx5e: Introduce flow steering API {CVE-2024-27014}
  - x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
  - x86: Introduce ia32_enabled() {CVE-2024-25742}
  - x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
  - x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
  - RDMA/srpt: Support specifying the srpt_service_guid parameter {CVE-2024-26744}
  - platform/x86: think-lmi: Fix reference leak {CVE-2023-52520}
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command {CVE-2024-27059}
  - fat: fix uninitialized field in nostale filehandles {CVE-2024-26973}
  - usb: xhci: Add error handling in xhci_map_urb_for_dma {CVE-2024-26964}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete {CVE-2024-26897}
  - wifi: mac80211: fix race condition on enabling fast-xmit {CVE-2024-26779}
  - RDMA/qedr: Fix qedr_create_user_qp error flow {CVE-2024-26743}
  - wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer {CVE-2024-26603}
  - wifi: rt2x00: restart beacon queue when hardware reset {CVE-2023-52595}
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg {CVE-2023-52528}
  - RDMA/siw: Fix connection failure handling {CVE-2023-52513}
  - usb: hub: Guard against accesses to uninitialized BOS descriptors {CVE-2023-52477}
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc {CVE-2021-47185}
  - sctp: fail if no bound addresses can be used for a given scope {CVE-2023-1074}
  - memcg: enable accounting for file lock caches {CVE-2022-0480}
  - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
  - RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872}
  - drm/amd/display: Atom Integrated System Info v2_2 for DCN35 {CVE-2024-36897}
  - net/mlx5e: fix a potential double-free in fs_any_create_groups {CVE-2023-52667}
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() {CVE-2024-36902}
  - ipv6: prevent NULL dereference in ip6_output() {CVE-2024-36901}
  - vt: fix memory overlapping when deleting chars in the buffer {CVE-2022-48627}
  - hwmon: (coretemp) Fix out-of-bounds memory access {CVE-2024-26664}
  - i2c: Fix a potential use after free {CVE-2019-25162}
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump {CVE-2024-26615}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.30.1.el9_2.tuxcare.els9]
changelog:
  - smb: client: fix use-after-free in smb2_query_info_compound() {CVE-2023-52751}
  - smb: client: prevent new fids from being removed by laundromat {CVE-2023-52751}
  - cifs: fix dentry lookups in directory handle cache {CVE-2023-52751}
  - uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}
  - net: do not delay dst_entries_add() in dst_release() {CVE-2024-50036}
  - smb: client: fix UAF in async decryption {CVE-2024-50047}
  - smb3: rename encryption/decryption TFMs
  - mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
  - driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
  - drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
  - ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
  - Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
  - mptcp: pm: Fix uaf in __timer_delete_sync {CVE-2024-46858}
  - of: fdt: fix off-by-one error in unflatten_dt_nodes() {CVE-2022-48672}
  - filelock: fix potential use-after-free in posix_lock_inode {CVE-2024-41049}
  - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock {CVE-2024-41049}
  - drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
  - ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
  - slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
  - ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
  - ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
  - ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
  - tipc: guard against string buffer overrun {CVE-2024-49995}
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
  - firmware_loader: Block path traversal {CVE-2024-47742}
  - ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
  - ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
  - drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
  - ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
  - wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
  - net: do not leave a dangling sk pointer, when socket creation fails {CVE-2024-40954}
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune() {CVE-2024-36978}
  - drm/amdgpu: Validate TA binary size {CVE-2024-44977}


author: Dmitry Shibut <dshibut@cloudlinux.com> 7.6.6-1
changelog:
  - CLOS-2240: Fix CageFS update errors arising when some packages are being added to the CageFS skeleton


author: Vladimir Lebedev <vlebedev@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 7.6.10-1
changelog:
  - CLOS-2511: Fix the CageFS issue causing Apache to stop working
  - CLOS-2485: Fix MySQL Password Disclosure in install-cagefs-plugin.py on Plesk


author:
  Vladimir Lebedev <vlebedev@cloudlinux.com>, Redouane Elkaboussi <relkaboussi@cloudlinux.com> 7.6.13-1

changelog:
  - CLOS-2576: Modify the lvectl algorithm to mitigate the impact of LVEs being reset to default limits
  - CLOS-2175: Correct the pw struct manipulation in proxyexec


author:
  Dmitry Shibut <dshibut@cloudlinux.com>, Olkseandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.23-1

changelog:
  - CLOS-3119: Add fix_fpm_services_in_container script for Ubuntu
  - CLOS-2672: Improve handling of users in proxyexec commands configuration


author: Mikalai Voina <mvoina@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.27-1
changelog:
  - CLOS-3316: Fix crontab -l in cPanel Terminal on CloudLinux 9
  - CLOS-3343: Add MariaDB client binaries to CageFS
  - CLOS-3358: Avoid unnecessary copy of /etc/mail


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.28-1
changelog:
  - CLOS-3547: Fix logged-in users lookup
  - CLOS-3605: Automatically reconfigure httpd on CloudLinux 10


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 7.6.29-1

changelog:
  - CLOS-3656: Implementation for website isolation feature
  - CLOS-3667: Add hooks for website isolation feature
  - CLOS-3694: Prepare CLI for website isolation feature
  - CLOS-3654: Add document roots monitoring for website isolation feature
  - CLOS-3737: Configure PHP sessions per website isolation
  - CLOS-3719: Setup /tmp per website isolation
  - CLOS-3745: Add a trusted mechanism for website-isolation identification
  - CLOS-3751: Implement binary to enter website isolations
  - CLOS-3720: Implement isolation of crontab per website isolation
  - CLOS-3774: Isolate home directory with overlay mounts for website isolation


author: Anton Volkov <avolkov@cloudlinux.com> 7.4.15-1
changelog:
  - CAG-1205: cagefs update should not recreate symlinks when no need
  - CAG-1206: add /etc/php to CageFS by default


author:
  Anton Volkov <avolkov@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 7.5.1-1

changelog:
  - CAG-1231: Delete cagefs namespaces in userdel.cagefs script
  - CAG-1232: Disable PrivateTmp directive for httpd service in container
  - CAG-1223: adapt mount/umount/enable/disable cagefsctl commands for container without LVE
  - CAG-1213: Log errors in /usr/sbin/cagefs-mount
  - CAG-1218: Run cagefs namespace creation with 10-min interval on no-panel systems
  - CAG-1211: Adapt cagefs service for running without LVE
  - CLPRO-144: Do not use linksafe feature for container environment
  - CAG-1209: make cagefsctl work inside container
  - CAG-1216: setup CageFS namespace when a new user is created inside a container
  - CAG-1212: adapt cagefs.server to work without LVEs, only enter/create LVE if not inside a container
  - CAG-1210: Implement /usr/sbin/cagefs-mount binary to mount custom user's dirs in CageFS


author: Dmitry Shibut <dshibut@cloudlinux.com> 7.5.2-1
changelog:
  - CAG-1224: Make CageFS work on CL Solo
  - AWP-260: CageFS proxy commands updated
  - CAG-1244: Add hook for installation of new php-fpm packages on CPanel
  - CAG-1256: Remove /usr/local/directadmin/directadmin line from proxy.commands on package update


author: ikartavtcev <ikartavtcev@cloudlinux.com> 7.5.4-1
changelog:
  - CAG-1266: Add creating of /home/{username}/.cagefs/var/run/cagefs/utmp in environments without LVE
  - CAG-1276: Allow users inside CageFS to use ClamAV without additional configuration due to changes in the ClamAV distribution
  - LU-3645: fix devices creation for cagefs skeleton


author: Grigory Ponomarenko <gponomarenko@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 7.5.6-1
changelog:
  - CAG-1300: Enhance logging of errors when CageFS is running in VZ container
  - LVEMAN-1896: Fix Phusion Passenger not working on CL9 with cagefs


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 7.6.29-1

changelog:
  - CLOS-3656: Implementation for website isolation feature
  - CLOS-3667: Add hooks for website isolation feature
  - CLOS-3694: Prepare CLI for website isolation feature
  - CLOS-3654: Add document roots monitoring for website isolation feature
  - CLOS-3737: Configure PHP sessions per website isolation
  - CLOS-3719: Setup /tmp per website isolation
  - CLOS-3745: Add a trusted mechanism for website-isolation identification
  - CLOS-3751: Implement binary to enter website isolations
  - CLOS-3720: Implement isolation of crontab per website isolation
  - CLOS-3774: Isolate home directory with overlay mounts for website isolation
  - CLOS-3643: Ensure proxy wrapper files persist after update cycles


author:
  Nika Keshelava <nkeshelava@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.6.30-1

changelog:
  - CLOS-3866, CLOS-3867, CLOS-3877, CLOS-3909, CLOS-3924, CLOS-3931, CLOS-3932: Add support of per-domain php selector for website isolation feature
  - CLOS-3846: Add cagefs-no-dev-log flag to skip /dev/log in CageFS user skeleton
  - CLOS-3905: Add php selector per website usage statistics collection
  - CLOS-3868: Trigger xray and ssa ini regeneration on website isolation enabling
  - CLOS-3859: Fix cagefs-docroots-monitor debounce skip events in short time period
  - CLOS-3858: Detect audit log rotation by comparing path inode vs file handle inode
  - CLOS-3856: Start tailer before loading docroots to prevent missed events
  - CLOS-3896, CLOS-3903: Avoid sys.exit calls in get_user_prefix which can terminate whole application


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.31-1
changelog:
  - CLOS-3974: Remove stale /usr/local/cpanel/htdocs mount point after cPanel v134 upgrade
  - CLOS-3965: Harden PHP selector and PHP configuration directory operations


author: Georgy Lepsaya <glepsaya@cloudlinux.com> 7.6.32-1
changelog:
  - CLOS-3788: Switch from /sbin/service to systemctl on EL7+ to avoid dependency on initscripts-service


author:
  Roman Prilipskii <rprilipskii@cloudlinux.com>, Georgy Lepsaya <glepsaya@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatkyi <oshyshatskyi@cloudlinux.com>, Andrei Zheregelia <azheregelia@cloudlinux.com> 7.6.33-1

changelog:
  - CLOS-4008: Optimize user group processing in cagefsctl.copyetc
  - CLOS-3899: Run check_params.py inside LVE
  - CLOS-4035: Fork check_params.py only for commands with restricted params
  - CLOS-4037: Add nolve flag to proxyexec to bypass LVE entry
  - CLOS-3998: Integrate per-domain LVE limits with website isolation
  - CLOS-3990: Bring back --site-isolation-list command
  - CLOS-3973: Register LVD helper binaries in CageFS proxyexec
  - Update usage messages in cagefsctl for clarity and consistency


author: Roman Prilipskii <rprilipskii@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 7.6.34-1
changelog:
  - CLOS-2408: Add /etc/cpanel/ea4/php.conf.cache and /usr/local/cpanel/cPstrict.pm to CageFS config for cPanel
  - CLPRO-3006: Fix subdomain isolation on DirectAdmin (domain_owner fallback in cagefsctl_user)


author:
  Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.37-1

changelog:
  - CLOS-4404: Speed up cagefs skeleton updates (cache ldd output, prune find traversal)
  - CLOS-4351: Bind /usr/selector inside per-domain isolated namespace to fix dead-symlink 503 on native PHP
  - CLOS-4343: Heal per-site website-isolation directory permissions after a non-isolated request
  - CLOS-4348: Drop legacy InterWorx and ISPManager support; conflict with lvemanager < 7.11.39-1
  - CLOS-4274: Internal bugfixes across CageFS components


changelog: - CLOS-4490, CLOS-4406, CLOS-4387: Internal bugfixes across CageFS components
author:
  Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.38-1


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.11.8-1
changelog:
  - CLOS-2692: Updated to 10.11.8
  - CLOS-2692: Fixed "Can't enter LVE" logging message
  - CLOS-2557: tmpfiles config added


author: Timur Averianov <taverianov@cloudlinux.com> - 10.11.14-1
changelog:
  - CLOS-3531: Updated to 10.11.14
  - CLOS-3538: Stopped patching "mysql.server.sh", the upstream version will be used further on


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.3.39-5
changelog:
  - CLOS-1955: Adjusted conflicts and obsoletes tags to mysqlclient18-compat
  - CLOS-1955: Added conflicts tags to another version of cl-MariaDB* packages


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.4.34-1
changelog:
  - CLOS-2692: Updated to 10.4.34
  - CLOS-2692: Fixed "Can't enter LVE" logging message
  - CLOS-2557: tmpfiles config added


author: Sergey Kokhan <skokhan@cloudlinux.com> - 10.5.15-1
changelog:
  - MYSQLG-668: Update MariaDB to version 10.5.15
  - MYSQLG-667: Fixed version_compile_machine variable


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.5.25-1
changelog:
  - CLOS-2692: Updated to 10.5.25
  - CLOS-2692: Fixed "Can't enter LVE" logging message
  - CLOS-2557: tmpfiles config added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> - 10.6.9-1
changelog:
  - MYSQLG-772: cl-MariaDB106 updated to 10.6.9
  - MYSQLG-764: Conflict between cl-MariaDB106-libs and mariadb-connector-c added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.6.15-1

changelog:
  - CLOS-1923: Updated to 10.6.15
  - CLOS-1744: Added MySQL Provides tag in cl-MariaDB-meta-client package


author: Timur Averianov <taverianov@cloudlinux.com> - 10.6.23-1
changelog:
  - CLOS-3534: Updated to 10.6.23
  - CLOS-3538: Stopped patching "mysql.server.sh", the upstream version will be used further on


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.6.27-1
changelog:
  - CLOS-4619: Updated to 10.6.27
  - CLOS-4619: Drop byte_order_generic headers no longer installed by upstream


author: Timur Averianov <taverianov@cloudlinux.com> - 11.4.8-1
changelog:
  - CLOS-3526: Updated to 11.4.8
  - CLOS-3538: Stopped patching "mysql.server.sh", the upstream version will be used further on


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 11.4.12-1
changelog:
  - CLOS-4623: Updated to 11.4.12
  - CLOS-4623: Drop README-wsrep removed from upstream Docs
  - CLOS-4623: Drop byte_order_generic headers no longer installed by upstream


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 11.8.8-1
changelog:
  - CLOS-4624: Updated to 11.8.8
  - CLOS-4624: Drop README-wsrep removed from upstream Docs
  - CLOS-4624: Drop byte_order_generic headers no longer installed by upstream


author: Timur Averianov <taverianov@cloudlinux.com> - 8.0.43-1
changelog:
  - CLOS-3491: Update cl-MySQL80 to 8.0.43
  - CLOS-3538: Stop patching "mysql.server.sh", the upstream version will be used further on


author: Miroslav Rajcic <miroslav.rajcic@oracle.com> - 8.4.0-1
changelog:
  - mysql_stmt_bind_param C API removed, so increase the libmysqlclient major version to 24.
  - Removed mysqlpump, mysql_upgrade, zlib_decompress and lz4_decompress binaries


author: Timur Averianov <taverianov@cloudlinux.com> - 8.4.6-1
changelog:
  - CLOS-3529: Update cl-MySQL 8.4 to 8.4.6
  - CLOS-3538: Stop patching "mysql.server.sh", the upstream version will be used further on


author: Ruslan Koliada <rkoliada@cloudlinux.com> 1.1.17-1
changelog:
  - CLPRO-2763: Fix C-Monitoring failed to load resources - Template variable service failed Unknown error during query transaction.


author: Ruslan Koliada <rkoliada@cloudlinux.com> 1.1.18-1
changelog:
  - CLPRO-2821: Fix "cl_node_exported" service periodically fails with SIGSEGV while executing its meminfo collector


author: Ruslan Koliada <rkoliada@cloudlinux.com> 3.2.1-1
changelog:
  - CLPRO-3051: Improved scanner configuration, service initialization, notifications, and daemon restart handling


author: Roman Krompets <rkrompets@cloudlinux.com> 0.2-1
changelog:
  - AWP-610: Removed "allow-for-all" switcher from AccelerateWP admin's UI
  - AWP-603: CDN: Updated modal's agreement text
  - AWP-583: Prevent error "License approve required to use this feature." while enabling CDN
  - AWP-600: Show warning message when feature modal opens
  - AWP-589: Fixed features are not marked as "Active" in main AccelerateWP UI
  - AWP-557: CDN Free was not activated through Manage window


author: Roman Krompets <rkrompets@cloudlinux.com> 0.2-4
changelog:
  - AWP-679: Fixed issues found by integration tests
  - AWP-622: Allow apply CDN advice if no active subscription
  - AWP-612: FIx UI issues found while testing awp-cdn
  - AWP-631: Show "Active" instead of "No advice" if customer has any active module


author: Roman Krompets <rkrompets@cloudlinux.com> 0.2-5
changelog:
  - AWP-686: Show CDN checkbox active if any of suite (accelerate_wp_cdn, accelerate_wp_cdn_pro) allowed or visible
  - AWP-682: Show incompatibility error for CDN in end-user plugin


author: Roman Krompets <rkrompets@cloudlinux.com> 0.2-6
changelog:
  - AWP-717: Design Fixes for Latest AccelerateWP UI/UX
  - AWP-705: Load list of websites and advices in parallel
  - AWP-706: Reviewed AccelerateWP end-user app for unused code and removed it.
  - AWP-696: Fixed pagination and sorting in case when triggered table update.


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 0.2-7
changelog:
  - CLPRO-811: Added conversion analytics
  - CLPRO-937: Fixed error when AccelerateWP doesn't show progress (percent) when processing advice
  - AWP-726: Fixed link to documentation page in AccelerateWP for Solo Edition


author: Roman Krompets <rkrompets@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> 0.3-1
changelog:
  - Migrated 'cloudlinux-awp-spa' project to Python311 (CLPRO-1198)
  - Used svg icon instead of mat-icon for settings (CLPRO-1133)
  - Catch advice tracking data from POST in cPanel, fixing GET parameters catching (CLPRO-1197)


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 0.4-1
changelog:
  - Switched sending of Sentry events from the old to the new Sentry in AWP UI (CLPRO-1212)
  - Generate new tracking session when direct access to the hosting panel (CLPRO-1223)
  - Adapted UI AccelerateWP Premium and CDN for Solo/Admin (CLPRO-1200)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.7-1
changelog:
  - Fixed error "Cannot read properties of undefined (reading accelerate_wp)" while opening AccelerateWP (CLPRO-1785)
  - Fixed incorrect "Active" status in AccelerateWP after closing features popup without upgrading (CLPRO-1808)
  - Unified AccelerateWP across CloudLinux Editions (CLPRO-1559)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.7-2
changelog:
  - Added integration support for AccelerateWP UI part (CLPRO-402)
  - Prevented displaying of incorrect feature activation notes if some advice generated (CLPRO-1838)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.7-5
changelog:
  - cPanel: Fixed incorrect handling theme directories while installation (CLPRO-2144)
  - Renamed CloudLinux Shared to CloudLinux Legacy (CLPRO-2173)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-1
changelog:
  - Changed the AccelerateWP UI to fit requirements with Object Cache free (CLPRO-2280)
  - Fixed the link to the user guide in the accelerateWP UI (CLPRO-2223)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-3
changelog:
  - Fix UI issue when the title for CDN module in the manage modal was not translated (CLPRO-2359)
  - Optimized sending requests while applying advice (CLPRO-2226)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-4
changelog:
  - Removed the "Please leave your feedback about AccelerateWP and Smart Advice" component (CLPRO-2263)
  - Renamed "Object Cache" feature to the "Redis Object Cache" in the AccelerateWP UI (CLPRO-2444)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-5
changelog:
  - Fix plugin icons displaying on Direct Admin (CLPRO-2524)
  - Add "app_key" for cPanel's plugin templates that uses LiveAPI to allow customize headers (CLPRO-1368)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-10
changelog:
  - CLPRO-3061: Improved cPanel analytics handling, error context reporting, and notification rendering


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-11
changelog:
  - CLPRO-3130: Improved AWP modal content rendering, pipe input handling, and build dependency installation


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-12
changelog:
  - CLPRO-3120: Improved AccelerateWP UI localisation, runtime language switching, and notification bridge
  - CLPRO-3191: Improved AccelerateWP error-diagnostics reporting and DirectAdmin plugin installation


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 1-3.2
changelog:
  - LVEMAN-1748: Move linksafe group creation to %pre
  - LU-2436: Remove cllib dependency from cloudlinux-linksafe


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 0.1-12
changelog:
  - AWP-257: Post-check of the CDN after advice activation
  - AWP-374: Disable AccelerateWP WordPress plugin license expiration checking
  - AWP-375: Enable CCSS and async_css AccelerateWP functions
  - AWP-378: Add communication AWP feature with CCSS SaaS
  - AWP-395: Update to 3.12.6 version


author:
  Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com>, Martin Krcho <mkrcho@cloudlinux.com> - 1.1-1

changelog:
  - AWP-416: Clear AccelerateWP feature cache when disabling CPCSS
  - AWP-426: Hide SAAS URL in AccelerateWP plugin settings
  - AWP-427: Implement authentication mechanism
  - AWP-438: API for managing CDN features
  - AWP-440: Authentication - Retrofit relevant WP plugin changes from AWP-427 to AWP-378
  - AWP-465: Do not set protocol when activating CDN via API
  - AWP-454: Add the style URL in the CPCSS request
  - AWP-443: Create new CPCSS feature errors according to usage limits
  - AWP-389: POC of Critical Path CSS
  - AWP-431: WP CLI command to enable/disable image optimization
  - AWP-491: Use custom DB table for image minification jobs
  - AWP-492: Compatibility with page caching and CDN
  - AWP-494: Optimize freshly uploaded images
  - AWP-495: Implement image queue processing logic
  - AWP-520: Add version /v1/ to api endpoints
  - AWP-429: Scan entire uploads folder to find images to minify
  - AWP-527: Block the ability to disable Critical CSS from WordPress admin panel
  - AWP-535: Grayed Image Optimization settings when feature not enabled
  - AWP-540: Control the per site image limit from SaaS
  - AWP-523: Handle exceeded quota and other blocking scenarios
  - AWP-558: Notification REST API endpoint not available (404)
  - AWP-542: Improve Critical CSS generation process
  - AWP-553: [WP] Improve file search for mtime based optimization
  - AWP-521: Add notification to the AccelerateWP plugin about usage of WP-Rocket plugin as base plugin
  - AWP-562: Change instructions related to enabling and disabling features
  - AWP-559: [WP] Improve folder search in file scanner
  - AWP-570: Fix duplicate uploads folder in url before files in FileScanner process


author: Martin Krcho <mkrcho@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 1.1-2
changelog:
  - AWP-580: Fix concurrency limit reached loop
  - AWP-484: Send notification and manage payment from AccelerateWP plugin
  - AWP-579: Improve local integration tests verifying contents of plugin's settings page
  - AWP-472: Improve HTTP status checking when post-checking CDN
  - AWP-648: Add ability to stop logging errors to Sentry
  - AWP-650: Show limit notice with special text if there isn't upgrade_url specified
  - AWP-654: Include unique_id in error data for Sentry


author: Martin Krcho <mkrcho@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-3
changelog:
  - AWP-663: Update CLSOP to version 3.13.4
  - AWP-672: Automatically switch to staging SaaS and separate Sentry project when X-Ray connected to staging
  - AWP-660: Protect more AJAX call against CSRF attack
  - AWP-722: Fix search for static css file in CDN post-check and sadd multiple attempts to check if PullZone CDN works


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-4
changelog:
  - AWP-732: Improve plugin compatibility with HealthCheck - PageCache
  - AWP-735: Change firebase/php-jwt package version to 6.4 to be compatible with php 7.2


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-6
changelog:
  - CLPRO-840: Hide "Load CSS asynchrounsly" AccelerateWP button
  - CLPRO-651: Add domain name as user in Sentry event
  - Notiсe to change open_basedir (CLPRO-1145)


author: Martin Krcho <mkrcho@cloudlinux.com> - 1.1-8
changelog:
  - Fix handling of image optimization and critical CSS related settings (CLPRO-1441)
  - Add WP CLI command to purge cache (CLPRO-1426)


author: Martin Krcho <mkrcho@cloudlinux.com> - 1.1-14
changelog:
  - Update CLSOP to version 3.15.9 (CLPRO-1702)
  - Send IP address to Sentry along with domain. (CLPRO-1743)


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-22
changelog:
  - Added support for CloudLinux MAx WebServer (AP2NGX-222, AP2NGX-220)
  - Improved page warming performance (AP2NGX-247)


author: Roman Krompets <rkrompets@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-24
changelog:
  - Fixed the issue with version discrepancies between the plugin and composer.json (CLPRO-2687)
  - Update plugin to version 3.18.3 (CLPRO-951)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> - 1.1-29
changelog:
  - Improved AccelerateWP tmp location handling (CLPRO-2786)
  - Prevent convert images with size more then 16383 × 16383 to WEBP format (CLPRO-2830)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-34
changelog:
  - UI improvements in the AccelerateWP with Critical CSS free (CLPRO-2832)
  - Added support for polylang plugins and cookie notices for MaxCache (MAXWS-936)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-37
changelog:
  - Added custom JwtHelper to prevent JWT-related failures (CLPRO-2989)
  - Improve mobile render-blocking resource optimization (MAXWS-1001)
  - Add font metric overrides to reduce CLS from web fonts (MAXWS-1002)
  - Improve database optimization (MAXWS-1003)
  - Add explicit Cache-Control max-age headers for static resources (MAXWS-1004)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-38
changelog:
  - Improve cache file accessibility (CLPRO-3001)
  - Added API endpoint for license rechecking (MAXWS-1026)


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-40
changelog:
  - Internal stability and reliability improvements
  - Build and packaging updates
  - General maintenance and minor fixes


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.1-9
changelog:
  - AWP-258: Update to 3.12.3.2 version
  - AWP-228: Hide the Add-ons page and related addon recommendations in the plugin
  - AWP-210: Enabling CDN functionality from WP CLI
  - AWP-253: Disable CDN deactivation from admin panel
  - AWP-262: Leave previously enabled addons active


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Hasan <haliev@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Danylo Kuropiatnyk <dkuropiatnyk@cloudlinux.com>, soksanichenko <soksanichenko@cloudlinux.com> 1.0.0-1

changelog:
  - LU-2443, LU-2447, LU-2321, LU-2352, LU-2334, LU-2268, LU-2296, LU-2229, LU-2172, LU-2133: preparations of CloudLinux Solo OS meta package


author:
  Pavel Negrobov <pnegrobov@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, Sergey Kozhekin <skozhekin@cloudlinux.com> 1.0.4-1

changelog:
  - LVEMAN-1851: Adapt cloudlinux-selector utility for "No CageFS" mode
  - CAG-1224: Make CageFS work on CL Solo
  - MODLS-932: Remove mod_lsapi conflicts from the cloudlinux-solo-meta


author: Serhii Kokhan <skokhan@cloudlinux.com> - 3.13-7
changelog:
  - CLOS-1655: Release bump to align CL7 criu-lve with mod_lsapi dependency
    tightening (libcriu.so SONAME guard)


author: Serhii Kokhan <skokhan@cloudlinux.com> - 3.13-10
changelog:
  - MAXWS-1086: Rename C library/headers/pkgconfig to the criu-lve namespace to coexist with criu-libs


author: Marek Kasik <mkasik@redhat.com> - 3.5.27-27
changelog:
  - Avoid stack overflow in DjVuPort by remembering which file we are opening
  - Resolves: #1943411, #1943685


author: Tomas Kasparek <tkasparek@redhat.com> 2.8.5-3
changelog:
  - %if 0%{?fedora} <= 25 is always true on rhel (tkasparek@redhat.com)
  - rhel8 utilizes python3 (tkasparek@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.8.5-5
changelog:
  - Related: #1581665 - provide useful symlinks to a manpage
    (tkasparek@redhat.com)
  - Resolves: #1581665 - provide yum-rhn-plugin on new RHEL systems
    (tkasparek@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.8.5-6
changelog:
  - spec cleanup (no more builds on Fedora <= 25) (michael.mraka@redhat.com)
  - Resolves: #1637980 - fixed plugin for dnf > 3.6.0 (michael.mraka@redhat.com)


author: Lukas Javorsky <ljavorsk@redhat.com> - 26.4.9-2
changelog:
  - Explicitly require the 'procps-ng' package
  - Otherwise it will not require it in the lightweight systems (e.g. containers)
  - and Galera won't work properly


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.9.1-2
changelog:
  - Fix RHBZ#1937424 (Wrong output from geos-config --libs etc.)
  - Fix RHBZ#1937443 (Wrong output from pkgconf geos --libs etc.)


author: Nikolay Petukhov <npetukhov@cloudlinux.com>, Aleksey Petryankin <apetryankin@cloudlinux.com> 1.2-89
changelog:
  - MYSQLG-900: Fixes in systemd dropin-files on cl7 and ubuntu platforms
  - MYSQLG-820: Error reports have become more consistent in governor_package_limitting.py
  - MYSQLG-919: Fix checking plesk reseller existence in governor_package_limitting.py


author: Nikolay Petukhov <npetukhov@cloudlinux.com>, Aleksey Petryankin <apetryankin@cloudlinux.com> 1.2-90
changelog:
  - MYSQLG-929: Fixed systemd warning 'The unit file changed on disk'
  - MYSQLG-935: Added _nowraps function to exclude forced unload from lve
  - MYSQLG-863: Fix error with existing /etc/my.cnf.d.govprev


author:
  Aleksey Petryankin <apetryankin@cloudlinux.com>, Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-92

changelog:
  - MYSQLG-961: Loading mysql functions from libmariadb added
  - MYSQLG-941: Fix libmysqlclient.so.18 and libmariadb.so.3 Provides tags in mariadb102..106
  - MYSQLG-965: da_admin mysql account added into default ignore list


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-96
changelog:
  - CLOS-2058: Fixed performance issue related to governor package limits synchronization
  - CLOS-2077: Fixed KeyError exception for dbgovernor set_path_environ function


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-99
changelog:
  - CLOS-2049: Governor dropin removed
  - CLOS-2170: Add additional safeguards for detecting MySQL AUTO version with DirectAdmin
  - CLOS-2173: Added mysqlclient21 installation for clMariaDB
  - CLOS-2117: mysql-version-list option added
  - MariaDB 10.11 support temporarily removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-102
changelog:
  - CLOS-2215: bad_users_list ownership fixed
  - CLOS-1759: dbgovernor_map mysql charset changed to utf8mb
  - CLOS-1730: Timeouts added to avoid repetive log messages


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-105
changelog:
  - CLOS-2322: Fixed DB limits not applying to users after a MySQL Governor service restart
  - CLOS-2418: MySQL 8.0 community edition repo url changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-106
changelog:
  - CLOS-2373: Backup confirmation added to governor script

  - CLOS-2322: Fixed DB limits not applying to users after a MySQL Governor service restart
  - CLOS-2418: MySQL 8.0 community edition repo url changed


author: Dmitry Shibut <dshibut@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-107
changelog:
  - CLOS-2319: EOLed cl-MariaDB 10.3 removal result to server down
  - CLOS-2471: Fixed wizzard installation


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-109
changelog:
  - CLOS-2572: LVE busy in MySQL processes issue fixed
  - CLOS-2506: Fixed MySQL community downloads URL


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-110
changelog:
  - CLOS-2322: Fixed issue with not applying limits after Governor service restart
  - CLOS-2535: Governor threads logging added


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-111

changelog:
  - CLOS-2645: Corrected MariaDB version detection logic for DA config
  - CLOS-2593, CLOS-2613: Added extended logging
  - CLOS-2385: Added watchdog monitoring utility to governor package
  - CLOS-2386: Implemented external Sentry logging mechanism


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-111

changelog:
  - CLOS-2645: Corrected MariaDB version detection logic for DA config
  - CLOS-2593, CLOS-2613: Added extended logging
  - CLOS-2385: Added watchdog monitoring utility to governor package
  - CLOS-2386: Implemented external Sentry logging mechanism
  - CLOS-2594, CLOS-2641: Implemented logging from MySQL and uniform logging


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-114

changelog:
  - CLOS-2719: Re-enabled watchdog monitoring utility with adjusted logic and interval
  - CLOS-2711: Added extended logging rotation
  - CLOS-2780: Fixed governor restarts
  - CLOS-2596: Do not install missing MariaDB-compat package in case of CL9
  - CLOS-2735: Changed semaphore retry logic to timed wait


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-115
changelog:
  - CLOS-2947: Fix watchdog cron job to stop it from emitting emails
  - CLOS-2885: Prevent sentry_demon from logging zero counters to logs
  - CLOS-2817: Fix Sentry reporting
  - CLOS-2581: Add mysql backup script


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-116
changelog:
  - CLOS-2840: Reduce probability of Governor limits being not applied; prevented Governor hang-up after MySQL/MariaDB or Governor service abrupt termination (replaced semaphore-protected bad_list with lockless one)
  - CLOS-2942: Fix resource usage estimation, reduces probability of Governor limits applied incorrectly
  - CLOS-2873: Fix "/etc/container/dbuser-map" application
  - CLOS-2899: Fix "dbctl --lve-mode=" in case of initial LVE mode "off"


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-117
changelog:
  - Revert changes from 1.2-116 to create a temporary fallback point for 1.2-118
  - Backport fix for unclean handling of SIGTERM in sentry_daemon.py (CLOS-2954)


author:
[cell repeats an earlier one in this file: 106 characters]

changelog:
  - CLOS-2719: Re-enabled watchdog monitoring utility with adjusted logic and interval
  - CLOS-2711: Added extended logging rotation
  - CLOS-2780: Fixed governor restarts
  - CLOS-2596: Do not install missing MariaDB-compat package in case of CL9
  - CLOS-2735: Reduced probability of Governor limits being not applied (changed semaphore retry logic to timed wait in bad_list protection)


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-115

changelog:
  - CLOS-2947: Fix watchdog cron job to stop it from emitting emails
  - CLOS-2885: Prevent sentry_demon from logging zero counters to logs
  - CLOS-2817: Fix Sentry reporting
  - CLOS-2581: Add mysql backup script


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-119
changelog:
  - CLOS-2954: Remove prompt when handling SIGTERM in sentry_daemon.py, it was sometimes leading to "BrokenPipe" error
  - CLOS-2968, CLOS-2794: Improve error reporting


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-122
changelog:
  - CLOS-2999: Fix MySQL version logging
  - CLOS-3051: Improve MySQL connections management to avoid crashes
  - CLOS-3051: Improve error reporting
  - CLOS-3015: Add MariaDB 11.4 support


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-124
changelog:
  - CLOS-3196: Fix service dependencies - stopping/starting subordinate 'governor_sentry_daemon.service' by cPanel upgrade scripts was bringing 'db_governor.service' down


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-125
changelog:
  - CLOS-2663, CLOS-3257: Improve error reporting
  - CLOS-3257: Fix crash during statistics collection for LVE-Stats


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-127
changelog:
  - CLOS-3342: Fix outdated limitations in the scenario of several new DB users showed up in sequence fast, and then no new users seen for long
  - CLOS-3361: Fix MariaDB installation on machines with unknown "mysql" DNF module
  - CLOS-3354: Improve error reporting


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-131
changelog:
  - CLOS-2945: Improve error reporting
  - CLOS-3340: Fix restriction causes reported to LVE-stats
  - CLOS-3340: Fix "dbctl restrict <user>" in period-based mode - it was decreasing restriction level
  - CLOS-3340: Fix "dbctl --lve-mode=..." - max. connection count limitation was not removed after restriction reset
  - CLOS-3340: Speed up "dbctl restrict <user>" and "dbctl unrestrict <user>" on machines with many users
  - CLOS-3340: Reduce resource consumption in period-based mode combined with max. connection count limitation
  - CLOS-3340: Reduce resource consumption by duplicate "dbctl unrestrict <user>"
  - CLOS-3340: Fix "penalty period" configuration in period-based mode - setting it to zero didn't turn it off, but still produced a 1 sec penalty period
  - CLOS-3340: Fix "dbgovernor-restrict.log" - remove redundant and misleading items
  - CLOS-3340: Fix "dbctl restrict <user>" - it could restrict administrative DB account
  - CLOS-3418: Fix outdated limitations


author: Haluk Yilmaz <hyilmaz@cloudlinux.com> 1.2-132
changelog:
  - CLOS-3217: Fix "dbtop" and "dbctl" - reports could be inconsistent under high load
  - CLOS-3217: Speed up "dbtop" and "dbctl"


author: Haluk Yilmaz <hyilmaz@cloudlinux.com> 1.2-133
changelog:
  - CLOS-3027: Strengthen string copy operations
  - CLOS-3027: Support long DB user names, up to 80 characters
  - CLOS-3027: Change shared memory structure to consume less memory


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-134
changelog:
  - CLOS-3514: Reduce overhead in the scenario when a new DB user shows up in the middle of already high load
  - CLOS-3317: Fix invalid Linux user names reported to LVE-stats in cases of advanced authentication, like LDAP


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.2-136
changelog:
  - CLOS-3521: Fix mysql installation on Ubuntu
  - CLOS-3570: Do not install mysqlclient18 & mysqlclient21 on CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Mikalai Voina <mvoina@cloudlinux.com> 1.2-142

changelog:
  - CLOS-4122: Optimized memory management and safety
  - CLOS-4097: Optimized per-user MariaDB connection limits handling


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Nika Keshelava <nkeshelava@cloudlinux.com> 1.2-143

changelog:
  - CLOS-3496: Fixed MySQL Governor speed limit does not align with user package when upgraded/downgraded/reset


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-144
changelog:
  - CLOS-4042: Fix MySQL/MariaDB installation on CL10 when libaio (or numactl) is published with the x86_64_v2 baseline arch tag


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-145
changelog:
  - CLOS-4339: Maintenance update.
  - CLOS-4414: Fix DB usage graphs not displaying in cPanel user interface.


author: Sergey Kozhekin <skozhekin@cloudlinux.com> 1.2-87
changelog:
  - MYSQLG-817: Implement ability to sync one user or one package in /usr/share/lve/dbgovernor/governor_package_limitting.py script
  - MYSQLG-873: Fix governor mysql password issue on plesk
  - MYSQLG-869: Added governor-mysql service status check when adding individual limit vectors after the first install.
  - MYSQLG-882: try/except block has been added for all operations with json in governor-package-limits


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-99
changelog:
  - CLOS-2170: Add additional safeguards for detecting MySQL AUTO version on DA
  - CLOS-2170: Governor install modules partial formatting pass
  - CLOS-2173: Added mysqlclient21 installation for clMariaDB
  - CLOS-2117: mysql-version-list option added
  - MariaDB 10.11 support temporary removed


author: Antonio Trande <sagitter@fedoraproject.org> - 1.10.6-7
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
  - Use bundled junit
  - Fix hamcrest symlinks in Fedora 35+


author: Robert-André Mauchin <zebob.m@gmail.com> - 1.2.0-2
changelog:
  - Fix s390x tests and RISCV build
  - Introduces a patch that fix tests on BigEndian
  - Introduces a patch that disable RVV runtime dispatch for RISCV builds


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-2
changelog:
  - Resolves: #2186645 - Fix issue found by covscan in httpd package
  - Resolves: #2173295 - Include Apache httpd module mod_authnz_fcgi


author: Joe Orton <jorton@redhat.com> - 2.4.57-6
changelog:
  - Resolves: RHEL-5071 - mod_dav_fs: add DavLockDBType
  - mod_dav_fs: add global mutex around lockdb interaction


author: Joe Orton <jorton@redhat.com> - 2.4.57-8
changelog:
  - mod_xml2enc: fix media type handling
    Resolves: RHEL-17686
  - mod_dav: add DavBasePath
    Resolves: RHEL-6600


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-9
changelog:
  - Resolves: RHEL-45766 -  httpd: null pointer dereference in
    mod_proxy (CVE-2024-38477)
  - Resolves: RHEL-45749 - httpd: Potential SSRF in mod_rewrite (CVE-2024-39573)
  - Resolves: RHEL-45818 - httpd: Substitution encoding issue in
    mod_rewrite (CVE-2024-38474)
  - Resolves: RHEL-45771 - httpd: Improper escaping of output in
    mod_rewrite (CVE-2024-38475)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-11.1
changelog:
  - Resolves: RHEL-46047 - httpd: Security issues via backend applications whose
    response headers are malicious or exploitable (CVE-2024-38476)
  - Resolves: RHEL-53021 - Regression introduced by CVE-2024-38474 fix


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-7
changelog:
  - Resolves: #2094997 - CVE-2022-26377 httpd: mod_proxy_ajp: Possible request
    smuggling
  - Resolves: #2097032 - CVE-2022-28615 httpd: out-of-bounds read in 
    ap_strcmp_match()
  - Resolves: #2098248 - CVE-2022-31813 httpd: mod_proxy: X-Forwarded-For dropped
    by hop-by-hop mechanism
  - Resolves: #2097016 - CVE-2022-28614 httpd: out-of-bounds read via ap_rwrite()
  - Resolves: #2097452 - CVE-2022-29404 httpd: mod_lua: DoS in r:parsebody
  - Resolves: #2097459 - CVE-2022-30522 httpd: mod_sed: DoS vulnerability
  - Resolves: #2097481 - CVE-2022-30556 httpd: mod_lua: Information disclosure
    with websockets


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-11
changelog:
  - Resolves: #2162500 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
    of zero byte
  - Resolves: #2162486 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
  - Resolves: #2162510 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
    smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-1
changelog:
  - Resolves: #2184403 - rebase httpd to 2.4.57
  - Resolves: #2177753 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.59-1
changelog:
  - new version 2.4.59
  - Resolves: RHEL-14668 - RFE: httpd rebase to 2.4.59
  - Resolves: RHEL-31856 - httpd: HTTP response splitting
    (CVE-2023-38709)
  - Resolves: RHEL-31859 - httpd: HTTP Response Splitting in multiple
    modules (CVE-2024-24795)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4
changelog:
  - Resolves: RHEL-66488 - Apache HTTPD no longer parse PHP files with unicode
    characters in the name


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7
changelog:
  - Resolves: RHEL-99815 - stickysession field does not work when specifying
    it in the query parameter after upgrade to 9.5
  - Resolves: RHEL-99953 - httpd: HTTP Session Hijack via a TLS
    upgrade (CVE-2025-49812)
  - Resolves: RHEL-99968 - httpd: access control bypass by trusted
    clients is possible using TLS 1.3 session resumption (CVE-2025-23048)
  - Resolves: RHEL-99977 - httpd: insufficient escaping of user-supplied
    data in mod_ssl (CVE-2024-47252)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-8
changelog:
  - Resolves: RHEL-114501 Image mode: The dir /var/www is not created when
    updating system in image mode


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-9
changelog:
  - Resolves: RHEL-105446 - mod_proxy_hcheck may stop healthchecks after a child
    process is reclaimed


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-10
changelog:
  - Resolves: RHEL-119000 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-12
changelog:
  - Resolves: RHEL-135064 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
    via AllowOverride FileInfo (CVE-2025-66200)
  - Resolves: RHEL-135049 - httpd: Apache HTTP Server: CGI environment variable
    override (CVE-2025-65082)
  - Resolves: RHEL-134481 - httpd: Apache HTTP Server: Server Side Includes adds
    query string to #exec cmd=... (CVE-2025-58098)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-13.1
changelog:
  - Resolves: RHEL-173555 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
    code execution via heap-based buffer overflow (CVE-2026-28780)
  - Resolves: RHEL-175080 - httpd: NULL pointer dereference can cause a child
    process crash (CVE-2026-33007)
  - Resolves: RHEL-175100 - httpd: off-by-one out-of-bounds reads in AJP getter
    functions (CVE-2026-33857)
  - Resolves: RHEL-175028 - httpd: heap-based buffer over-read due to missing
    null-termination check (CVE-2026-34032)
  - Resolves: RHEL-175062 - httpd: heap-based buffer over-read and memory
    disclosure in ajp_parse_data() (CVE-2026-34059)


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.4.62-13.3
changelog:
  - Resolves: RHEL-186186 - httpd: mod_proxy_html buffer handling
    vulnerability (CVE-2026-34355)
  - Resolves: RHEL-175636 - httpd: mod_dav_lock uses wrong lock discovery
    (CVE-2026-29169)
  - Resolves: RHEL-186196 - mod_xml2enc: fix bblen accounting in fix_skipto
    (CVE-2026-42536)
  - Resolves: RHEL-186164 - httpd: fix OCSP write buffer advancement
    bug in mod_ssl (CVE-2026-44185)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-13.4
changelog:
  - Resolves: RHEL-186217 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
    via malicious backend servers (CVE-2026-34356)
  - Resolves: RHEL-182578 - httpd: incomplete fix
    for CVE-2023-38709 (CVE-2024-42516)
  - Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-43951,
    CVE-2026-44119, CVE-2026-44186


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-3
changelog:
  - Resolves: RHEL-68660 - RewriteRule proxying to UDS (unix domain socket)
    configured in .htaccess doesn't work on httpd-2.4.62-1


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4.1
changelog:
  - Resolves: RHEL-99972 - CVE-2024-47252 httpd: insufficient escaping of
    user-supplied data in mod_ssl
  - Resolves: RHEL-99963 - CVE-2025-23048 httpd: access control bypass by trusted
    clients is possible using TLS 1.3 session resumption
  - Resolves: RHEL-102079 - stickysession field does not work when specifying it
    in the query parameter after upgrade to 9.5


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7.1
changelog:
  - Resolves: RHEL-125884 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7.2
changelog:
  - Resolves: RHEL-123850 - mod_proxy_hcheck may stop healthchecks after a child
    process is reclaimed


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7.3
changelog:
  - Resolves: RHEL-135063 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
    via AllowOverride FileInfo (CVE-2025-66200)
  - Resolves: RHEL-135048 - httpd: Apache HTTP Server: CGI environment variable
    override (CVE-2025-65082)
  - Resolves: RHEL-134480 - httpd: Apache HTTP Server: Server Side Includes adds
    query string to #exec cmd=... (CVE-2025-58098)


author: Jan Macku <jamacku@redhat.com> - 10.10-1
changelog:
  - Translated using Weblate (Friulian) (#381)
  - Translations update from Weblate (#378)
  - added veth support
  - ifup-eth: add a new PERSISTENT_DHCLIENT_IPV6 option for IPv6 dhclient daemon
  - ifdown removes veth pair if both peers are down
  - rename_device: also support dracut-style kernel cmdline configuration
  - spec: Mark network-scripts as deprecated
  - spec: Initscripts now requires chkconfig (#374)
  - Translations update from Weblate (#371)
  - spec: Move service script into subpackage
  - ci: Onboard initscripts to Packit
  - ci: Migrate from Travis to GH Actions


author: Jan Macku <jamacku@redhat.com> - 10.11.1-1
changelog:
  - spec: Update relation between initscripts and initscripts-service
  - spec: Replace not working awk command with sed
  - use downstream version style


author: Jan Macku <jamacku@redhat.com> - 10.11.2-1
changelog:
  - ifup-routes: Revert quotes
  - ifup-routes: Use `ip replace` only on type `route`
  - ifup-routes: Log when using `ip $type replace`
  - ifup-routes: Use `ip route repace` to avoid race
  - ci: Update path to csdiff repository (#391)


author: Jan Macku <jamacku@redhat.com> - 10.11.3-1
changelog:
  - Drop unnecessary obsoletes
  - spec: Move rename_device to subpackage `initscripts-rename-device`
  - ci: Update `.packit.yml` to run on `c9s`
  - ci: Use Differential ShellCheck action


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 10.11.5-1.cloudlinux
changelog:
  - CLKRN-639: added a script to collect data from clients' servers after a panic occurred
  - Apply CloudLinux patch


author: Jan Macku <jamacku@redhat.com> - 10.11.8-1
changelog:
  - netconsole: var/lock -> run/lock
  - netconsole: source sysconfig/network only if it exists
  - netconsole: remove unused variables
  - netconsole: remove trailing whitespaces
  - sync spec with c9s


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 28-7.cloudlinux
changelog:
  - KMODLVE-575: Fix kmodlve issue on CL8.7 kernel update
  - KMODLVE-557: Fix modinfo error during kmod-lve-1:2.0-43.el8.x86_64 removing
  - KMODLVE-542: Fix errors happening during kmod package installation in containers
  - KMODLVE-464: depmod: resolve different sub-dir lengths issue
  - CLKRN-819: improved prioritizing with modules sharing the same name
  - bump epoch


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-9
changelog:
  - KMODLVE-577: added forgotten lseek handlers to not crash kmodlve on CL9
  - KMODLVE-567: connect the ovz mark out event to the kmodlve callback


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-10
changelog:
  - KMODLVE-579: filemon fixes for CL9
  - KMODLVE-578: added dependency to tuned-profiles-cloudlinux that brings needed kernel params
  - KMODLVE-580: fixed redundant obsoletes for cl9
  - KMODLVE-581: added kmod dependency for cl9
  - KMODLVE-566: do not allow lve creation during lvp_destroy
  - CLKRN-1092: fix build for CL7


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-14
changelog:
  - CLKRN-1153: bump cl9 kernel version for module building
  - KMODLVE-587: enable access to ipv4 and ipv6 entries
  - KMODLVE-588: always update ppos in defaults_next


author: Linar Nadeev <lnadeev@cloudlinux.com> - 2.1-15
changelog:
  - CLKRN-1181: New Alma 9 kernel: -5.14.0-284.11.1.el9_2
  - KMODLVE-594: Prepare kmod-lve for kernel 9.2 build
  - KMODLVE-596: fix cgroup stat parsing


author: Anton Mikaiev <amikaiev@cloudlinux.com> - 2.1-16
changelog:
  - CLKRN-1176: added patch to fix ttypushback vulnerability
  - CLKRN-1195: bumped kernel version for building (cl8) for debug kernel compatibility
  - CLKRN-1093: allow freezable sleep in kmodlve


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-17
changelog:
  - CLKRN-1210: make new page cache accounting default for new installations
  - CLKRN-1089: do not account page cache memory in lve stats output


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-18
changelog:
  - CLKRN-1371: fixed kernel.proc_disable_net & introduced kernel.proc_disable_net2
  - CLKRN-1386: adapt kmodlve building with FEAT_LINK_PROT == 0


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-19
changelog:
  - KMODLVE-600: iolimits events support for CL8/9
  - KMODLVE-601: tag get/put events support
  - CLKRN-1406: revert some changes related to prod_net_disable2 - made the behaviour obliged
  - CLKRN-1355: symlink owner protection fixes for CL9
  - CLKRN-1399: improved fs.protected_symlinks_create option to close the SecureLink creating vulnerability


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-22
changelog:
  - CLKRN-1455: change kernel (cl9) building version for 5.14.0-362.13.1.el9_3
  - CLKRN-1203: switch back to using rh_reserved for tag links
  - CLKRN-1439: reduce warnings from external cgroup moves


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-24
changelog:
  - CLKRN-1488: rework security_* hooks
  - CLOS-2484: suppress the warning for nonexistent 90-cloudlinux.conf in the script


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-26
changelog:
  - CLKRN-1546: always block cgroup move in a multithreaded app
  - CLKRN-1547: stringify more lve_enter flags
  - CLKRN-1541: do not kill unkillable tasks from de_thread()
  - CLKRN-1542: do not allow to interrupt lve_unlink()
  - CLKRN-1457: fixed XFS_QMOPT_FORCE_RES for cl9 kernels


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-28
changelog:
  - CLKRN-1559: check if the ptr is invalid in lve_do_renameat2_trace hook
  - CLKRN-1566: improved restrictions on accessing another mnt ns


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-32
changelog:
  - CLKRN-1606: call missing putname within SP
  - CLKRN-1447: adapted minor log for moving tasks outside of LVEs


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-37
changelog:
  - CLKRN-1698: disable write access to process memory via procfs
  - CLKRN-1688: CL9.5 kernel support
  - CLKRN-1685: implement iolimits for LVP


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-38
changelog:
  - CLKRN-1701: implement namespace check in __ptrace_may_access
  - CLKRN-1696: a switch to disable page cache accounting in lve pmem


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-41
changelog:
  - CLKRN-1717: enable lve_pmem_nocache by default
  - CLKRN-1716: adapted SP hooks variants for Ubuntu 22
  - CLKRN-1715: adapt datacycle hook for Ubuntu 22
  - CLKRN-1715: adapted XFS quota flag for Ubuntu 22 kernel (5.15.0)


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-53
changelog:
  - CLKRN-1910: disable unused ftrace hooks
  - CLKRN-2000: use fput_async if available and doesn't bug_on on non-kernel threads


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-56
changelog:
  - CLKRN-1818: cgroups v2 support for CL10 (new lve_cgroupv2 parameter)
  - CLKRN-1820: implement enter/leave for cgroups v2
  - CLKRN-1821: cpu limit/weight & usage support for cgroups v2
  - CLKRN-1822: cpu stats reset and throttled_time stat for cgroups v2
  - CLKRN-1823: implement memory limits with cgroups v2
  - CLKRN-1824: implement memory usage for cgroups v2
  - CLKRN-1826: implement nproc limit & usage for cgroups v2
  - CLKRN-1831: implement NOUB enter and account/reset NOUB cgroup cpu usage for cgroups v2
  - CLKRN-1851: allow symlink creation outside of lve namespaces
  - CLKRN-1871: do not OOM when reducing PMEM limit in LVP
  - CLKRN-1876: configure cgroup.subtree_control with cgroups v2
  - CLKRN-1878: optimize code with cgroups v2 support
  - CLKRN-1882: subtree_control should be enabled for LVP, not LVE
  - CLKRN-1884: load average support for cgroups v2
  - CLKRN-1909: do not allow to rmdir lve/lvp dirs with cgroups v2
  - CLKRN-1916: split CPU limit between full and noub lves
  - CLKRN-1924: recalc cpu limits after shares changes
  - CLKRN-1925: a fix for racer
  - CLKRN-1930: noub init should happen after root lvp init
  - CLKRN-1933: wrong lve ns check in symlink create hook
  - CLKRN-1939: not enough permissions to enter LVE fix
  - CLKRN-1941: carefully move process to the thread root
  - CLKRN-1948: set memory.swap.max to 0 to replicate swappiness=0 from v1
  - CLKRN-1964: fixed passing incorrect string size
  - CLKRN-1990: fixed build errors for CL8 platform
  - CLKRN-2017: added a hack for attaching noub threads to cgroup v2 cpu controller
  - CLKRN-2027: initial solution for CPU limit balancer
  - CLKRN-2035: build kmod-lve-lts fixes for CL8/CL9 LTS kernels
  - CLKRN-2044: build fixes for Ubuntu22 and CL8/9-LTS / CL8/7h, disable cgroup v2 for production


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-57
changelog:
  - CLKRN-2060: fixed noub_legacy mode to not underlimit the main cpu group
  - CLKRN-2066: fixed LVE cpu stats for a cgroups v2 hack mode
  - CLKRN-2067: improve load balancing
  - CLKRN-2075: symmetrical lve/noub hierarchy
  - CLKRN-2078: cgv2: clamp each noub quota share to kernel minimum
  - CLKRN-2083: fixed cpu weight setting for cgroups v2 case
  - CLKRN-2088: added +cpu to root cgroup subtree_control on lve init
  - CLKRN-2089: bump kmod_kernel_version to 553.111.1 for CL7h and CL8
  - CLKRN-2091: performance statistics for the cgv2 rebalancer
  - CLKRN-2045: added a couple of counters to catch heavy rebalancing code paths


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-59
changelog:
  - CLKRN-2103: cgv2: leave path to target cgroup root, not /lvub
    (fixes __lve_leave: failed to pop cpu context, rc=-16 EBUSY)


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-60
changelog:
  - CLKRN-2105: dead-code cleanup
  - CLKRN-2101: defer child insertion into parent->lvp_children until init done
  - CLKRN-1954: fix a bug in symlink protection
  - CLKRN-2115: added missing error check
  - CLKRN-2115: add missing pointer check
  - CLKRN-2108: order os_lvp_fini() before list_del_init() in lvp_fini()
  - CLKRN-2108: allow module-internal cgroup rmdir outside lve_init thread
  - CLKRN-2111: propagate NET accounting up the full LVP parent chain
  - CLKRN-2112: simplify defaults_start()
  - CLKRN-2113: drop LVE_DEBUG build option; make LVE_DEBUG_CGROUP_BREAK unconditional
  - CLKRN-2115: cleanup: fix error handling in lve_usage_write


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-62
changelog:
  - bump kmod_kernel_version to 6.12.0-211.7.3.el10_2 for AlmaLinux 10.2
  - bump kmod_kernel_version to 5.14.0-687.5.3.el9_8 for AlmaLinux 9.8


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-61
changelog:
  - bump kmod_kernel_version to 6.12.0-211.7.3.el10_2 for AlmaLinux 10.2
  - bump kmod_kernel_version to 5.14.0-687.5.3.el9_8 for AlmaLinux 9.8
  - CLKRN-1954: fix symlink protection edge case
  - internal cleanup and robustness improvements


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.36-2
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
  - add gtk-doc to build requirements (#1942967)


