# changelog

author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.25.156
changelog:
  - !26103 sync CVE LTS and bugfix from OLK-6.6 ae9235634352 to d3550d8dd4f9
  - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
  - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
  - proc: Fix broken error paths for namespace links
  - selftests/bpf: Add simple strscpy() implementation
  - tools/testing: add linux/args.h header and fix radix, VMA tests
  - jiffies: Cast to unsigned long in secs_to_jiffies() conversion
  - jiffies: Define secs_to_jiffies()
  - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder
  - selftests/hid: ensure CKI can compile our new tests on old kernels
  - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
  - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
  - seqlock: fix scoped_seqlock_read kernel-doc
  - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
  - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
  - exfat: preserve benign secondary entries during rename and move
  - exfat: move exfat_chain_set() out of __exfat_resolve_path()
  - exfat: add exfat_get_dentry_set_by_ei() helper
  - exfat: rename argument name for exfat_move_file and exfat_rename_file
  - exfat: remove unnecessary read entry in __exfat_rename()
  - exfat: move free cluster out of exfat_init_ext_entry()
  - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
  - regulator: scmi: Simplify with scoped for each OF child loop
  - audit: fix potential integer overflow in audit_log_n_hex()
  - audit: add audit_log_nf_skb helper function
  - crypto: qat - fix restarting state leak on allocation failure
  - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
  - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
  - nvmet: remove superfluous initialization
  - usb: gadget: f_fs: initialize reset_work at allocation time
  - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
  - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
  - usb: typec: tcpm: Fix VDM type for Enter Mode commands
  - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
  - serial: 8250_mid: Disable DMA for selected platforms
  - serial: 8250_mid: Remove 8250_pci usage
  - HID: appleir: fix UAF on pending key_up_timer in remove()
  - treewide: Switch/rename to timer_delete[_sync]()
  - proc: protect ptrace_may_access() with exec_update_lock (part 1)
  - seqlock: Change do_task_stat() to use scoped_seqlock_read()
  - seqlock: Introduce scoped_seqlock_read()
  - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
  - HID: add haptics page defines
  - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
  - ksmbd: track the connection owning a byte-range lock
  - ksmbd: centralize ksmbd_conn final release to plug transport leak
  - ksmbd: use opener credentials for FSCTL mutations
  - smb: client: resolve SWN tcon from live registrations
  - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
  - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
  - netfilter: ebtables: zero chainstack array
  - netfilter: ebtables: Use vmalloc_array() to improve code
  - media: nxp: imx8-isi: Fix use-after-free on remove
  - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
  - media: nxp: imx8-isi: Convert to platform remove callback returning void
  - gpio: sch: use raw_spinlock_t in the irq startup path
  - coresight: etb10: restore atomic_t for shared reading state
  - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
  - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
  - staging: rtl8723bs: fix spaces around binary operators
  - staging: rtl8723bs: core: move constants to right side in comparison
  - PCI: Free saved list without holding pci_bus_sem
  - PCI: Prevent resource tree corruption when BAR resize fails
  - PCI: mediatek: Fix IRQ domain leak when port fails to enable
  - PCI: mediatek: Use generic MACRO for TPVPERL delay
  - PCI: mediatek: Convert bool to single quirks entry and bitmap
  - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
  - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
  - vfio/mlx5: Fix racy bitfields and tighten struct layout
  - PCI: altera: Fix resource leaks on probe failure
  - ALSA: aoa: check snd_ctl_new1() return value
  - iio: common: st_sensors: honour channel endianness in read_axis_data
  - iio: pressure: mpl115: fix runtime PM leak on read error
  - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
  - iio: imu: inv_icm42600: stabilized timestamp in interrupt
  - iio: invensense: fix timestamp glitches when switching frequency
  - iio: invensense: remove redundant initialization of variable period
  - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
  - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
  - ACPI: NFIT: core: Fix possible deadlock and missing notifications
  - ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
  - ACPI: bus: Introduce devm_acpi_install_notify_handler()
  - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
  - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
  - perf/x86/amd/brs: Fix kernel address leakage
  - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
  - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
  - mtd: rawnand: fsl_ifc: return errors for failed page reads
  - mmc: vub300: defer reset until cmd_mutex is unlocked
  - mtd: mchp23k256: use SPI match data for chip caps
  - mtd: onenand: samsung: report DMA completion timeouts
  - wifi: mwifiex: fix permanently busy scans after multiple roam iterations
  - wifi: mac80211: free ack status frame on TX header build failure
  - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
  - reset: sunxi: fix memory region leak on ioremap failure
  - ipvs: reload ip header after head reallocation
  - ipvs: fix more places with wrong ipv6 transport offsets
  - memstick: ms_block: reject a card that reports too many blocks
  - macsec: fix promiscuity refcount leak in macsec_dev_open()
  - llc: fix SAP refcount leak when creating incoming sockets
  - Bluetooth: btrtl: validate firmware patch bounds
  - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
  - wifi: mac80211: fix memory leak in ieee80211_register_hw()
  - wifi: rt2x00: avoid full teardown before work setup in probe
  - powerpc/pseries: fix memory leak on krealloc failure in papr_init
  - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
  - pmdomain: imx: Fix i.MX8MP power notifier
  - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
  - tracing/osnoise: Call synchronize_rcu() when unregistering
  - riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
  - drbd: reject data replies with an out-of-range payload size
  - macsec: don't read an unset MAC header in macsec_encrypt()
  - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
  - ipvs: use parsed transport offset in SCTP state lookup
  - llc: fix SAP refcount leak in llc_ui_autobind()
  - mac802154: remove interfaces with RCU list deletion
  - s390/monwriter: Reject buffer reuse with different data length
  - riscv: probes: save original sp in rethook trampoline
  - hwmon: (asus_atk0110) Check package count before accessing element
  - net: wwan: iosm: bound device offsets in the MUX downlink decoder
  - ata: pata_pxa: Fix DMA channel leak on probe error
  - orangefs: keep the readdir entry size 64-bit in fill_from_part()
  - tracing/probes: Fix double addition of offset for @+FOFFSET
  - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
  - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
  - net: lan743x: Initialize eth_syslock spinlock before use
  - fsl/fman: Free init resources on KeyGen failure in fman_init()
  - hwmon: (occ) unregister sysfs devices outside occ lock
  - net: liquidio: fix BAR resource leak on PF number failure
  - hwmon: (w83793) remove vrm sysfs file on probe failure
  - hwmon: (w83627hf) remove VID sysfs files on error and remove
  - rtc: mpfs: fix counter upload completion condition
  - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
  - espintcp: use sk_msg_free_partial to fix partial send
  - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
  - batman-adv: clean untagged VLAN on netdev registration failure
  - batman-adv: ensure minimal ethernet header on TX
  - batman-adv: retrieve ethhdr after potential skb realloc on RX
  - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
  - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
  - ieee802154: ca8210: fix cas_ctl leak on spi_async failure
  - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
  - ieee802154: admin-gate legacy LLSEC dump operations
  - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
  - net: ipip: require CAP_NET_ADMIN in the device netns for changelink
  - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
  - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
  - net: ena: clean up XDP TX queues when regular TX setup fails
  - net/sched: act_ct: preserve tc_skb_cb across defragmentation
  - net: ixp4xx_hss: fix duplicate HDLC netdev allocation
  - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
  - net: sit: require CAP_NET_ADMIN in the device netns for changelink
  - gpios: palmas: add .get_direction() op
  - gpio-f7188x: Add support for NCT6126D version B
  - cpu: hotplug: Bound hotplug states sysfs output
  - cpu: hotplug: Preserve per instance callback errors
  - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
  - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
  - Input: ims-pcu - fix type confusion in CDC union descriptor parsing
  - Input: ims-pcu - fix race condition in reset_device sysfs callback
  - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
  - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
  - Input: ims-pcu - fix DMA mapping violation in line setup
  - Input: ims-pcu - add response length checks
  - Input: ims-pcu - validate control endpoint type
  - Input: ims-pcu - release data interface on disconnect
  - Input: ims-pcu - fix use-after-free and double-free in disconnect
  - scsi: elx: efct: Fix I/O leak on unsupported additional CDB
  - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
  - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
  - scsi: target: Bound PR-OUT TransportID parsing to the received buffer
  - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
  - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
  - scsi: sg: Report request-table problems when any status is set
  - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
  - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
  - dm-verity: increase sprintf buffer size
  - dm-verity: fix a possible NULL pointer dereference
  - dm-integrity: don't increment hash_offset twice
  - dm_early_create: fix freeing used table on dm_resume failure
  - dm-stats: fix merge accounting
  - dm-stats: fix dm_jiffies_to_msec64
  - dm-log: fix a bitset_size overflow on 32bit machines
  - dm-ioctl: fix a possible overflow in list_version_get_info
  - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
  - dm era: fix out-of-bounds memory access for non-zero start sector
  - dm thin metadata: fix metadata snapshot consistency on commit failure
  - dm thin metadata: fix superblock refcount leak on snapshot shadow failure
  - net: sparx5: unregister blocking notifier on init failure
  - bpf: Add missing access_ok call to copy_user_syms
  - can: bcm: add missing rcu list annotations and operations
  - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
  - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
  - can: isotp: use unconditional synchronize_rcu() in isotp_release()
  - can: esd_usb: kill anchored URBs before freeing netdevs
  - nvmet-rdma: handle inline data with a nonzero offset
  - sctp: validate STALE_COOKIE cause length before reading staleness
  - spi: uniphier: Fix completion initialization order before devm_request_irq()
  - tpm: Make the TPM character devices non-seekable
  - tpm: fix event_size output in tpm1_binary_bios_measurements_show
  - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
  - xfrm: use compat translator only for u64 alignment mismatch
  - xen/gntdev: fix error handling in ioctl
  - ice: fix ice_init_link() error return preventing probe
  - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
  - i2c: mediatek: fix WRRD for SoCs without auto_restart option
  - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
  - ksmbd: fix integer overflow in set_file_allocation_info()
  - smb: client: use kvzalloc() for megabyte buffer in simple fallocate
  - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
  - platform/x86/amd/pmc: Check for intermediate wakeup in function
  - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
  - dmaengine: tegra: Fix burst size calculation
  - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
  - irqchip/crossbar: Use correct index in crossbar_domain_free()
  - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
  - mtd: spi-nor: swp: Improve locking user experience
  - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
  - net: thunderbolt: Fix frags[] overflow by bounding frame_count
  - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
  - fpga: dfl: add bounds check in dfh_get_param_size()
  - ocfs2: reject non-inline dinodes with i_size and zero i_clusters
  - ocfs2: reject dinodes whose i_rdev disagrees with the file type
  - ocfs2: reject dinodes with non-canonical i_mode type
  - ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
  - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
  - ocfs2: avoid moving extents to occupied clusters
  - mtd: rawnand: fix condition in 'nand_select_target()'
  - net/9p: fix infinite loop in p9_client_rpc on fatal signal
  - mtd: rawnand: pl353: fix probe resource allocation
  - ocfs2: use kzalloc for quota recovery bitmap allocation
  - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
  - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
  - 9p: skip nlink update in cacheless mode to fix WARN_ON
  - mtd: slram: remove failed entries from the device list
  - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
  - proc: only bump parent nlink when registering directories
  - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
  - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
  - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
  - mips: sched: Fix CPUMASK_OFFSTACK memory corruption
  - power: supply: charger-manager: fix refcount leak in is_full_charged()
  - ntfs3: fix out-of-bounds read in decompress_lznt
  - ntfs3: validate split-point offset in indx_insert_into_buffer
  - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
  - ntfs3: cap RESTART_TABLE free-chain walker at rt->used
  - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
  - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
  - fs/ntfs3: validate lcns_follow in log_replay conversion
  - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
  - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
  - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
  - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
  - mm/damon/core: make charge_addr_from aware of end-address exclusivity
  - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
  - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
  - MIPS: ip22-gio: fix device reference leak in probe
  - MIPS: ip22-gio: fix kfree() of static object
  - MIPS: ip22-gio: fix gio device memory leak
  - remoteproc: qcom: Fix leak when custom dump_segments addition fails
  - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
  - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
  - lockd: Plug nlm_file leak when nlm_do_fopen() fails
  - sunrpc: wait for in-flight TLS handshake callback when cancel loses race
  - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
  - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
  - nvdimm/btt: Free arenas on btt_init() error paths
  - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
  - Bluetooth: SCO: hold sk properly in sco_conn_ready
  - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
  - HID: playstation: validate num_touch_reports in DualShock 4 reports
  - mfd: tps6586x: Fix OF node refcount
  - cifs: invalidate cfid on unlink/rename/rmdir
  - batman-adv: tt: prevent TVLV OOB check overflow
  - batman-adv: frag: fix primary_if leak on failed linearization
  - batman-adv: frag: free unfragmentable packet
  - batman-adv: fix VLAN priority offset
  - batman-adv: tt: avoid request storms during pending request
  - batman-adv: dat: fix tie-break for candidate selection
  - batman-adv: dat: ensure accessible eth_hdr proto field
  - batman-adv: bla: reacquire gw address after skb realloc
  - batman-adv: dat: acquire ARP hw source only after skb realloc
  - batman-adv: access unicast_ttvn skb->data only after skb realloc
  - batman-adv: gw: acquire ethernet header only after skb realloc
  - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
  - perf/x86/amd/lbr: Fix kernel address leakage
  - x86/boot: Reject too long acpi_rsdp= values
  - x86/boot: Validate console=uart8250 baud rate to fix early boot hang
  - tools/power/x86/intel-speed-select: Harden daemon pidfile open
  - mfd: sm501: Fix reference leak on failed device registration
  - leds: uleds: Fix potential buffer overread
  - selinux: fix incorrect execmem checks on overlayfs
  - selinux: check connect-related permissions on TCP Fast Open
  - soc: fsl: qe: panic on ioremap() failure in qe_reset()
  - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
  - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
  - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
  - netfilter: xt_nat: reject unsupported target families
  - netfilter: ecache: fix inverted time_after() check
  - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
  - netfilter: nf_nat_sip: reload possible stale data pointer
  - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
  - netfilter: xt_cluster: reject template conntracks in hash match
  - netfilter: nfnl_cthelper: apply per-class values when updating policies
  - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
  - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
  - ASoC: mediatek: mt8183: Release reserved memory on cleanup
  - ASoC: mediatek: mt8192: Release reserved memory on cleanup
  - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
  - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
  - fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
  - fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
  - fbdev: vesafb: fix memory leak in vesafb_probe()
  - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
  - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
  - fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
  - fbdev: s3fb: fix potential memory leak in s3_pci_probe()
  - fbdev: i740fb: fix potential memory leak in i740fb_probe()
  - fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
  - fbdev: sm712: Fix operator precedence in big_swap macro
  - fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
  - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
  - fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
  - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
  - KVM: s390: pci: Fix handling of AIF enable without AISB
  - KVM: arm64: vgic: Check the interrupt is still ours before migrating it
  - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
  - arm64: dts: qcom: sdm630: describe adsp_mem region properly
  - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()
  - net: ife: require ETH_HLEN to be pullable in ife_decode()
  - net: atm: reject out-of-range traffic classes in QoS validation
  - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
  - ASoC: SOF: topology: validate vendor array size before parsing
  - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
  - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
  - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
  - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
  - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
  - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
  - smb: client: fix overflow in passthrough ioctl bounds check
  - octeontx2-af: fix VF bringup affecting PF promiscuous state
  - net/mlx5: Fix L3 tunnel entropy refcount leak
  - selftests/net: fix EVP_MD_CTX leak in tcp_mmap
  - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
  - dm era: fix NULL pointer dereference in metadata_open()
  - SUNRPC: pin upper rpc_clnt across the TLS connect_worker
  - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
  - cifs: validate DFS referral string offsets
  - s390/zcrypt: Remove the empty file
  - ipvs: ensure inner headers in ICMP errors are in headroom
  - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
  - ipvs: use parsed transport offset in TCP state lookup
  - ipvs: pass parsed transport offset to state handlers
  - ipv6: mcast: Fix potential UAF in MLD delayed work
  - ipv6: mcast: Replace locking comments with lockdep annotations.
  - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
  - octeontx2-pf: check DMAC extraction support before filtering
  - net/sched: cake: reject overhead values that underflow length
  - net: usb: lan78xx: disable VLAN filter in promiscuous mode
  - net: usb: lan78xx: move functions to avoid forward definitions
  - net/tls: Consume empty data records in tls_sw_read_sock()
  - ring-buffer: Fix event length with forced 8-byte alignment
  - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
  - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
  - Bluetooth: MGMT: Fix adv monitor add failure cleanup
  - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
  - amt: fix size calculation in amt_get_size()
  - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
  - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
  - net: qualcomm: rmnet: validate MAP frame length before ingress parsing
  - qede: fix off-by-one in BD ring consumption on build_skb failure
  - net: microchip: vcap: fix races on the shared Super VCAP block
  - net/mlx5e: Fix HV VHCA stats agent registration race
  - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
  - netfilter: xt_connmark: reject invalid shift parameters
  - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
  - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
  - netfilter: xt_u32: reject invalid shift counts
  - gue: validate REMCSUM private option length
  - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
  - selftests/hid: Cover hid_bpf_get_data() size overflow
  - selftests/hid: convert the hid_bpf selftests with struct_ops
  - selftests/hid: force using our compiled libbpf headers
  - selftests/hid: do not manually call headers_install
  - selftests/hid: ensure we can compile the tests on kernels pre-6.3
  - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
  - ata: sata_gemini: unwind clocks on IDE pinctrl errors
  - minix: avoid overflow in bitmap block count calculation
  - afs: Fix unchecked-length string display in debug statement
  - afs: Fix the volume AFS_VOLUME_RM_TREE is set on
  - afs: Fix vllist leak
  - afs: Fix callback service message parsers to pass through -EAGAIN
  - afs: use kvfree() to free memory allocated by kvcalloc()
  - afs: Fix error code in afs_extract_vl_addrs()
  - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
  - net/sched: hhf: clear heavy-hitter state on reset
  - pinctrl: meson: restore non-sleeping GPIO access
  - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
  - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
  - smb: move some duplicate definitions to common/cifsglob.h
  - net/sched: act_bpf: use rcu_dereference_bh() to read the filter
  - cxgb4: Fix decode strings dump for T6 adapters
  - virtio_net: disable cb when NAPI is busy-polled
  - irqchip/ts4800: Fix missing chained handler cleanup on remove
  - irqchip/gic-v3-its: Fix OF node reference leak
  - tracing: eprobe: read the complete FILTER_PTR_STRING pointer
  - tracing/events: Fix to check the simple_tsk_fn creation
  - bridge: stp: Fix a potential use-after-free when deleting a bridge
  - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
  - net: gianfar: dispose irq mappings on probe failure and device removal
  - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
  - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
  - hwmon: (pmbus) Fix passing events to regulator core
  - hwmon: adm1275: Prevent reading uninitialized stack
  - MIPS: DEC: Ensure RTC platform device deregistration upon failure
  - sctp: fix SCTP_RESET_STREAMS stream list length limit
  - net: enetc: check the number of BDs needed for xdp_frame
  - qede: fix out-of-bounds check for cqe->len_list[]
  - seg6: validate SRH length before reading fixed fields
  - gpio: htc-egpio: use managed gpiochip registration
  - gpio: mvebu: fail probe if gpiochip registration fails
  - spi: sh-msiof: abort transfers when reset times out
  - tracing: probes: fix typo in a log message
  - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback
  - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
  - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
  - net: sungem: fix probe error cleanup
  - net: mvneta: re-enable percpu interrupt on resume
  - rtc: cmos: unregister HPET IRQ handler on probe failure
  - rtc: ds1307: Fix off-by-one issue with wday for rx8130
  - smb/client: preserve errors from smb2_set_sparse()
  - ipv6: fix error handling in disable_policy sysctl
  - ipv6: fix error handling in forwarding sysctl
  - ipv6: fix error handling in ignore_routes_with_linkdown sysctl
  - ipv6: fix error handling in disable_ipv6 sysctl
  - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
  - veth: fix NAPI leak in XDP enable error path
  - net: dsa: sja1105: round up PTP perout pin duration
  - net, bpf: check master for NULL in xdp_master_redirect()
  - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
  - alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
  - NTB: epf: Fix doorbell bitmask and IRQ vector handling
  - NTB: epf: Report 0-based doorbell vector via ntb_db_event()
  - NTB: epf: Make db_valid_mask cover only real doorbell bits
  - netfilter: nft_compat: ebtables emulation must reject non-bridge targets
  - netfilter: nft_synproxy: stop bypassing the priv->info snapshot
  - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
  - ipv4: fib: Don't ignore error route in local/main tables.
  - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
  - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
  - rtc: msc313: fix NULL deref in shared IRQ handler at probe
  - i40e: Fix i40e_debug() to use struct i40e_hw argument
  - ice: fix AQ error code comparison in ice_set_pauseparam()
  - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
  - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
  - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
  - bpf: zero-initialize the fib lookup flow struct
  - bpf: Fix stack slot index in nospec checks
  - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
  - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
  - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
  - octeontx2-pf: Clear stats of all resources when freeing resources
  - octeontx2-af: mcs: Fix unsupported secy stats read
  - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
  - tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
  - net: marvell: prestera: initialize err in prestera_port_sfp_bind
  - selftests/mm: fix exclusive_cow test fork() handling
  - selftests/mm: allow PUD-level entries in compound testcase of hmm tests
  - selftests/mm: clarify alternate unmapping in compaction_test
  - irqchip/crossbar: Fix parent domain resource leak
  - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
  - netfilter: nf_reject: skip iphdr options when looking for icmp header
  - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
  - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
  - netfilter: ipset: annotate "pos" for concurrent readers/writers
  - netfilter: ipset: Fix data race between add and dump in all hash types
  - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
  - ieee802154: fix kernel-infoleak in dgram_recvmsg()
  - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
  - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
  - ACPI: resource: Amend kernel-doc style
  - thermal: intel: Fix dangling resources on thermal_throttle_online() failure
  - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
  - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
  - flow_dissector: check device type before reading ETH_ADDRS
  - devlink: Fix parent ref leak in devl_rate_node_create()
  - dpaa2-switch: fix VLAN upper check not rejecting bridge join
  - virtio-net: fix len check in receive_big()
  - spi: rpc-if: Use correct device for hardware reinitialization on resume
  - PCI: iproc: Restore .map_irq() for the platform bus driver
  - sctp: hold socket lock when dumping endpoints in sctp_diag
  - net: psample: fix info leak in PSAMPLE_ATTR_DATA
  - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
  - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
  - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
  - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
  - xfrm: validate selector family and prefixlen during match
  - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
  - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path
  - xfrm: Use the XFRM_GRO to indicate a GRO call on input
  - spi: dw: fix wrong BAUDR setting after resume
  - gpio: mlxbf3: fail probe if gpiochip registration fails
  - sparc: led: avoid trimming a newline from empty writes
  - apparmor: fix label can not be immediately before a declaration
  - i3c: master: Prevent reuse of dynamic address on device add failure
  - apparmor: put secmark label after secid lookup
  - apparmor: aa_getprocattr free procattr leak on format failure
  - apparmor: fix potential UAF in aa_replace_profiles
  - apparmor: grab ns lock and refresh when looking up changehat child profiles
  - apparmor: fix rawdata_f_data implicit flex array
  - apparmor: aa_label_alloc use aa_label_free on alloc failure
  - apparmor: check label build before no_new_privs test
  - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()
  - Revert "PCI/MSI: Unmap MSI-X region on error"
  - PCI: mediatek: Use actual physical address instead of virt_to_phys()
  - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
  - tools lib api: Fix mount_overload() snprintf truncation and toupper range
  - tools lib api: Fix filename__write_int() writing uninitialized stack data
  - tools lib api: Fix missing null termination in filename__read_int/ull()
  - xprtrdma: Return sendctx slot after Send preparation failure
  - xprtrdma: Repost Receive buffers for malformed replies
  - xprtrdma: Sanitize the reply credit grant after parsing
  - xprtrdma: Fix bcall rep leak and unbounded peek
  - xprtrdma: Resize reply buffers before reposting receives
  - xprtrdma: Document and assert reply-handler invariants
  - xprtrdma: Check frwr_wp_create() during connect
  - PCI: rcar-host: Remove unused LIST_HEAD(res)
  - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
  - PCI: meson: Propagate devm_add_action_or_reset() failure
  - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
  - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
  - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
  - nfs: keep PG_UPTODATE clear after read errors in page groups
  - NFSv4/pnfs: defer return_range callbacks until after inode unlock
  - xprtrdma: Decouple req recycling from RPC completion
  - xprtrdma: Use sendctx DMA state for Send signaling
  - xprtrdma: Post receive buffers after RPC completion
  - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
  - xprtrdma: Avoid 250 ms delay on backlog wakeup
  - xprtrdma: Remove temp allocation of rpcrdma_rep objects
  - pNFS/filelayout: fix cheking if a layout is striped
  - clk: qcom: a53: Corrected frequency multiplier for 1152MHz
  - dmaengine: Fix possible use after free
  - dmaengine: qcom: gpi: set DMA_PRIVATE capability
  - perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
  - dmaengine: imx-sdma: Refine spba bus searching in probe
  - drm/amd/display: Add missing kdoc for ALLM parameters
  - fs/ntfs3: fix mount failure on 64K page-size kernels
  - fs/ntfs3: add bounds check to run_get_highest_vcn()
  - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
  - clk: at91: keep securam node alive while mapping it
  - iio: tcs3472: power down chip on probe failure
  - iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
  - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
  - iio: magnetometer: ak8975: fix potential kernel stack memory leak
  - iio: light: si1133: prevent race condition on timeout
  - iio: light: si1133: reset counter to prevent race condition
  - char: tlclk: fix use-after-free in tlclk_cleanup()
  - usb: host: max3421: Reject hub port requests for non-existent ports
  - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
  - staging: most: video: avoid double free on video register failure
  - mailbox: mtk-adsp: fix UAF during device teardown
  - phy: phy-can-transceiver: Check driver match and driver data against NULL
  - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
  - platform/x86: xo15-ebook: Fix wakeup source and GPE handling
  - x86/platform/olpc: xo15: Drop wakeup source on driver removal
  - PCI/ASPM: Don't reconfigure ASPM entering low-power state
  - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
  - coresight: cti: Fix DT filter signals silently ignored
  - staging: nvec: fix use-after-free in nvec_rx_completed()
  - net/9p: fix race condition on rdma->state in trans_rdma.c
  - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
  - mfd: cs42l43: Sanity check firmware size
  - ksmbd: fix use-after-free in same_client_has_lease()
  - ionic: Fix check in ionic_get_link_ext_stats
  - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
  - tipc: fix UAF in tipc_l2_send_msg()
  - KEYS: Use acquire when reading state in keyring search
  - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
  - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down
  - MIPS: mm: Fix out-of-bounds write in maar_res_walk()
  - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
  - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
  - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
  - selftests/bpf: Initialize operation name before use
  - smb/client: always return a value for FS_IOC_GETFLAGS
  - cifs: remove all cifs files before kill super
  - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
  - netfilter: nf_conncount: callers must hold rcu read lock
  - kcm: use WRITE_ONCE() when changing lower socket callbacks
  - net: bcmgenet: Use weighted round-robin TX DMA arbitration
  - net: wwan: t7xx: check skb_clone in control TX
  - net/mlx5: Check max_macs devlink param value against max capability
  - bpf: Run generic devmap egress prog on private skb
  - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
  - net: mana: initialize gdma queue id to INVALID_QUEUE_ID
  - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
  - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
  - handshake: Require admin permission for DONE command
  - power: supply: core: fix supplied_from allocations
  - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
  - spi: xilinx: use FIFO occupancy register to determine buffer size
  - crypto: rng - Free default RNG on module exit
  - crypto: cavium/cpt - fix DMA cleanup using wrong loop index
  - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
  - cxl/test: Add check after kzalloc() memory in alloc_mock_res()
  - tipc: reject inverted service ranges from peer bindings
  - tipc: prevent snt_unacked underflow on CONN_ACK
  - tipc: require net admin for TIPCv2 netlink mutators
  - net/sched: sch_hfsc: Don't make class passive twice
  - sctp: validate embedded address parameter length
  - bridge: cfm: reject invalid CCM interval at configuration time
  - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
  - net/sched: cls_flow: Dont expose folded kernel pointers
  - ASoC: tegra: tegra210_ahub: Validate written enum value
  - ASoC: fsl: fsl_audmix: Validate written enum values
  - ASoC: codecs: hdac_hdmi: Validate written enum value
  - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
  - RDMA/mlx5: Fix undefined shift of user RQ WQE size
  - RDMA/mlx5: Remove raw RSS QP restrack tracking
  - fs: efs: remove unneeded debug prints
  - Bluetooth: vhci: validate devcoredump state before side effects
  - Bluetooth: hci: validate codec capability element length
  - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
  - s390/process: Fix kernel thread function pointer type
  - bpf: Tighten cgroup storage cookie checks for prog arrays
  - of: cpu: add check in __of_find_n_match_cpu_property()
  - cxl/test: Zero out LSA backing memory to avoid leaking to user
  - cxl/test: Fix integer overflow in mock LSA bounds checks
  - selftests/bpf: Fix bpf_iter/task_vma test
  - ext4: fix kernel BUG in ext4_write_inline_data_end
  - bonding: 3ad: fix mux port state on oper down
  - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails
  - tools/virtio: check mmap return value in vringh_test
  - vhost/net: complete zerocopy ubufs only once
  - vduse: Requeue failed read to send_list head
  - vhost/vdpa: validate virtqueue index in mmap and fault paths
  - vduse: hold vduse_lock across IDR lookup in open path
  - ASoC: codecs: aw88261: fix incorrect masks for boost regs
  - spi: meson-spifc: fix runtime PM leak on remove
  - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
  - btrfs: zoned: don't account data relocation space-info in statfs free space
  - hwmon: (it87) Clamp negative values to zero in set_fan()
  - fbdev: sm501fb: Fix buffer errors in OF binding code
  - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
  - wifi: mt76: mt7921: fix potential tx_retries underflow
  - wifi: mt76: mt7915: fix potential tx_retries underflow
  - wifi: mt76: fix argument to ieee80211_is_first_frag()
  - hwspinlock: qcom: avoid uninitialized struct members
  - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
  - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
  - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
  - scsi: target: Remove tcm_loop target reset handling
  - watchdog: unregister PM notifier on watchdog unregister
  - configfs: fix lockless traversals of ->s_children
  - firmware_loader: Fix recursive lock in device_cache_fw_images()
  - spi: ep93xx: fix double-free of zeropage on DMA setup failure
  - IB/mlx5: Properly support implicit ODP rereg_mr
  - IB/mlx5: Don't take the rereg_mr fallback without a new translation
  - ACPI: IPMI: Fix message kref handling on dead device
  - ALSA: seq: Clear variable event pointer on read
  - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
  - ALSA: seq: Fix partial userptr event expansion
  - wifi: wcn36xx: fix OOB read from short trigger BA firmware response
  - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
  - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
  - bpf: Update transport_header when encapsulating UDP tunnel in lwt
  - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well
  - RDMA/irdma: Initialize iwmr->access during MR registration
  - RDMA/irdma: Fix OOB read during CQ MR registration
  - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
  - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
  - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
  - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
  - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
  - ocfs2/dlm: require a ref for locking_state debugfs open
  - ocfs2: reject FITRIM ranges shorter than a cluster
  - ocfs2: fix buffer head management in ocfs2_read_blocks()
  - ocfs2: rebase copied fsdlm LVB pointers in locking_state
  - perf/x86/amd/core: Always use the NMI latency mitigation
  - bpftool: Use libbpf error code for flow dissector query
  - drm/amdgpu: set sub_block_index for mca ras sub-blocks
  - configfs_lookup(): don't leave ->s_dentry dangling on failure
  - lib/test_meminit: use && for bools
  - sched: restore timer_slack_ns when resetting RT policy on fork
  - ext2: fix ignored return value of generic_write_sync()
  - mm/fake-numa: fix under-allocation detection in uniform split
  - scsi: ufs: Fix wrong value printed in unexpected UPIU response case
  - scsi: pm8001: Fix error code in non_fatal_log_show()
  - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
  - nvdimm/btt: Handle preemption in BTT lane acquisition
  - ARM: imx31: Fix IIM mapping leak in revision check
  - ata: libata: Fix ata_exec_internal()
  - HID: wiimote: Fix table layout and whitespace errors
  - ARM: imx3: Fix CCM node reference leak
  - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
  - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
  - md/raid10: reset read_slot when reusing r10bio for discard
  - rpmsg: use generic driver_override infrastructure
  - media: qcom: venus: relax encoder frame/blur step size on v6
  - media: qcom: venus: relax encoder frame/blur dimension steps on v4
  - media: qcom: venus: drop extra padding in NV12 raw size calculation
  - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
  - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
  - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
  - drm/msm/dp: Fix the ISR_* enum values
  - drm/msm/dp: fix HPD state status bit shift value
  - ocfs2: kill osb->system_file_mutex lock
  - ocfs2: don't BUG_ON an invalid journal dinode
  - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
  - dax/kmem: account for partial discontiguous resource upon removal
  - libbpf: Fix UAF in strset__add_str()
  - libbpf: Harden parse_vma_segs() path parsing
  - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada
  - drm/tegra: Fix iommu_map_sgtable() return value check
  - gpu: host1x: Fix iommu_map_sgtable() return value check
  - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
  - gpu: host1x: Allow entries in BO caches to be freed
  - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove
  - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
  - net/sched: cls_bpf: prevent unbounded recursion in offload rollback
  - ipv6: guard against possible NULL deref in __in6_dev_stats_get()
  - workqueue: drop spurious '*' from print_worker_info() fn declaration
  - nvme-multipath: fix flex array size in struct nvme_ns_head
  - pinctrl: cs42l43: Fix polarity on debounce
  - ALSA: seq: midi: Serialize output teardown with event_input
  - mtd: spi-nor: Drop duplicate Kconfig dependency
  - mips: n64: add __iomem for writel call
  - mips: ralink: mt7621: add missing __iomem
  - MIPS: DEC: Remove do_IRQ() call indirection
  - MIPS: Fix big-endian stack argument fetching in o32 wrapper
  - PM: sleep: Use complete() in device_pm_sleep_init()
  - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup
  - IB/mlx4: Fix refcount leak in add_port() error path
  - RDMA/rxe: Fix a use-after-free problem in rxe_mmap
  - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
  - bus: sunxi-rsb: Always check register address validity
  - pwm: imx27: Fix variable truncation in .apply()
  - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
  - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node
  - firmware: arm_scmi: Fix OOB in scmi_power_name_get()
  - media: rockchip: rga: fix too small buffer size
  - net/sched: sch_drr: annotate data-races around cl->deficit
  - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
  - bitops: use common function parameter names
  - sysfs: clamp show() return value in sysfs_kf_read()
  - firmware: arm_scmi: Read sensor config as 32-bit value
  - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
  - RDMA/srpt: fix integer overflow in immediate data length check
  - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
  - RDMA/hns: Fix arithmetic overflow in calc_hem_config()
  - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
  - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
  - net/sched: sch_htb: annotate data-races (I)
  - net/sched: sch_htb: do not change sch->flags in htb_dump()
  - crypto: ccp - Treat zero-length cert chain as query for blob lengths
  - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
  - clk: scpi: Unregister child clock providers on remove
  - thermal: hwmon: Fix critical temperature attribute removal
  - evm: terminate and bound the evm_xattrs read buffer
  - drm/hisilicon/hibmc: use clock to look up the PLL value
  - drm/hisilicon/hibmc: move display contrl config to hibmc_probe()
  - arm64: dts: qcom: sm8450: Fix ICE reg size
  - clk: scmi: Fix clock rate rounding
  - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host
  - iommu/amd: Fix a stale comment about which legacy mode is user visible
  - nilfs2: fix backing_dev_info reference leak
  - dlm: fix add msg handle in send_queue ordered
  - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
  - crypto: atmel-sha204a - fix blocking and non-blocking rng logic
  - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
  - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings
  - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc
  - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
  - media: v4l2-common: Add YUV24 format info
  - media: cedrus: Fix failure to clean up hardware on probe failure
  - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
  - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
  - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH
  - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint
  - wifi: ath9k: fix OOB access from firmware tx status queue ID
  - kconfig: fix potential NULL pointer dereference in conf_askvalue
  - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
  - wifi: rtw89: Correct data type for scan index to avoid infinite loop
  - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
  - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
  - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block
  - arm64: tegra: Fix Tegra234 MGBE PTP clock
  - wifi: cfg80211: fix grammar in MLO group key error message
  - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning
  - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S
  - Documentation: proc: fix section numbering in table of contents
  - libbpf: Report error when a negative kprobe offset is specified
  - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
  - drm/radeon: fix integer overflow in radeon_align_pitch()
  - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
  - drm/tidss: Drop extra drm_mode_config_reset() call
  - drm/rockchip: Test for imported buffers with drm_gem_is_imported()
  - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive()
  - afs: Fix further netns teardown to cancel the preallocation charger
  - afs: fix NULL pointer dereference in afs_get_tree()
  - afs: Fix netns teardown to cancel the preallocation charger
  - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
  - serial: 8250_omap: clear rx_running on zero-length DMA completes
  - serial: msm: Disable DMA for kernel console UART
  - dt-bindings: power: imx93: Add MIPI PHY power domain
  - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties
  - media: uvcvideo: Fix sequence number when no EOF
  - media: uvcvideo: Fix buffer sequence in frame gaps
  - media: uvcvideo: Avoid partial metadata buffers
  - crypto: crypto4xx - Remove insecure and unused rng_alg
  - crypto: crypto4xx - Remove ahash-related code
  - crypto: sun4i-ss - Remove insecure and unused rng_alg
  - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
  - crypto: algif_skcipher - force synchronous processing on trees without ctx->state
  - fuse: re-lock request before returning from fuse_ref_folio()
  - fuse: fix device node leak in cuse_process_init_reply()
  - RDMA/siw: bound Read Response placement to the RREAD length
  - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
  - Input: maplecontrol - set driver data before registering input device
  - Input: maplemouse - set driver data before registering input device
  - Input: maple_keyb - set driver data before registering input device
  - Input: mms114 - fix multi-touch slot corruption
  - Input: maplemouse - fix NULL pointer dereference in open()
  - Input: mms114 - reject an oversized device packet size
  - Input: touchwin - reset the packet index on every complete packet
  - Input: mms114 - fix touch indexing for MMS134S and MMS136
  - Input: iforce - bound the device-reported force-feedback effect index
  - Input: goodix - clamp the device-reported contact count
  - Input: elan_i2c - prevent division by zero and arithmetic underflow
  - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
  - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
  - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
  - i2c: stm32f7: truncate clock period instead of rounding it
  - i2c: mpc: Fix timeout calculations
  - udmabuf: fix DMA direction mismatch in release_udmabuf()
  - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
  - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
  - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
  - exfat: bound uniname advance in exfat_find_dir_entry()
  - module: decompress: check return value of module_extend_max_pages()
  - watchdog: apple: Add "apple,t8103-wdt" compatible
  - EDAC/i10nm: Don't fail probing if ADXL is missing
  - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
  - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
  - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
  - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
  - crypto: talitos/hash - remove useless wrapper
  - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
  - crypto: talitos/hash - drop workqueue mechanism for SEC1
  - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
  - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
  - crypto: talitos - move code in current_desc_hdr() into a standalone function
  - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
  - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
  - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
  - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
  - crypto: drbg - Fix the fips_enabled priority boost
  - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
  - crypto: caam - use print_hex_dump_devel to guard key hex dumps again
  - crypto: caam - use print_hex_dump_devel to guard key hex dumps
  - crypto: af_alg - Remove zero-copy support from skcipher and aead
  - partitions: aix: bound the pp_count scan to the ppe array
  - btrfs: do not trim a device which is not writeable
  - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
  - dm-ioctl: report an error if a device has no table
  - hwrng: jh7110 - fix refcount leak in starfive_trng_read()
  - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
  - usb: typec: ucsi: cancel pending work on system suspend
  - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
  - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
  - usb: typec: ucsi: Invert DisplayPort role assignment
  - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
  - usb: typec: class: drop PD lookup reference
  - usb: typec: anx7411: use devm_pm_runtime_enable()
  - usbip: vudc: fix NULL deref in vep_dequeue()
  - usbip: tools: support SuperSpeedPlus devices
  - USB: usb-storage: ene_ub6250: restore media-ready check
  - USB: ulpi: fix memory leak on registration failure
  - USB: serial: digi_acceleport: fix write buffer corruption
  - USB: serial: digi_acceleport: fix hard lockup on disconnect
  - USB: serial: digi_acceleport: fix broken rx after throttle
  - USB: serial: option: add Telit Cinterion FE990D50 compositions
  - USB: serial: keyspan_pda: fix information leak
  - usb: mtu3: unmap request DMA on queue failure
  - USB: misc: uss720: unregister parport on probe failure
  - USB: storage: include US_FL_NO_SAME in quirks mask
  - usb: sl811-hcd: disable controller wakeup on remove
  - USB: legousbtower: fix use-after-free on disconnect race
  - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
  - USB: ldusb: fix use-after-free on disconnect race
  - USB: idmouse: fix use-after-free on disconnect race
  - usb: gadget: f_printer: take kref only for successful open
  - usb: gadget: udc: Fix use-after-free in gadget_match_driver
  - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
  - usb: free iso schedules on failed submit
  - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
  - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
  - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
  - usb: cdc_acm: Add quirk for Uniden BC125AT scanner
  - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
  - bpf: Restore sysctl new-value from 1 to 0
  - xfs: fix unreachable BIGTIME check in dquot flush validation
  - xfs: use null daddr for unset first bad log block
  - media: mtk-jpeg: cancel workqueue on release for supported platforms only
  - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
  - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
  - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
  - HID: letsketch: fix UAF on inrange_timer at driver unbind
  - HID: wacom: stop hardware after post-start probe failures
  - tools/mm/slabinfo: fix total_objects attribute name
  - tools/mm/slabinfo: Fix trace disable logic inversion
  - X.509: Fix validation of ASN.1 certificate header
  - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
  - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
  - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
  - cpufreq: Fix hotplug-suspend race during reboot
  - cpufreq: intel_pstate: Sync policy->cur during CPU offline
  - firmware_loader: fix device reference leak in firmware_upload_register()
  - OPP: of: Fix potential memory leak in opp_parse_supplies()
  - smb: client: use unaligned reads in parse_posix_ctxt()
  - smb: client: fix query directory replay double-free
  - ksmbd: use opener credentials for delete-on-close
  - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
  - ksmbd: run set info with opener credentials
  - ksmbd: require source read access for duplicate extents
  - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
  - ksmbd: serialize QUERY_DIRECTORY requests per file
  - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
  - smb/client: Fix error code in smb2_aead_req_alloc()
  - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
  - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
  - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
  - fs/ntfs3: handle attr_set_size() errors when truncating files
  - fs/ntfs3: fsync files by syncing parent inodes
  - Bluetooth: L2CAP: validate option length before reading conf opt value
  - Bluetooth: fix UAF in bt_accept_dequeue()
  - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
  - Bluetooth: bnep: pin L2CAP connection during netdev registration
  - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
  - netfilter: ebtables: terminate table name before find_table_lock()
  - netfilter: ebtables: module names must be null-terminated
  - mm: shrinker: fix NULL pointer dereference in debugfs
  - mfd: cros_ec: Delay dev_set_drvdata() until probe success
  - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
  - ipv4: igmp: remove multicast group from hash table on device destruction
  - gpio: eic-sprd: use raw_spinlock_t in the irq startup path
  - NTB: epf: Avoid calling pci_irq_vector() from hardirq context
  - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
  - debugobjects: Plug race against a concurrent OOM disable
  - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
  - audit: Fix data races of skb_queue_len() readers on audit_queue
  - net: af_key: initialize alg_key_len for IPComp states
  - crypto: amlogic - avoid double cleanup in meson_crypto_probe()
  - staging: rtl8723bs: fix OOB write in HT_caps_handler()
  - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
  - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
  - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
  - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
  - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
  - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
  - staging: media: atomisp: reduce load_primary_binaries() stack usage
  - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
  - staging: vme_user: fix location monitor leak in tsi148 bridge
  - staging: vme_user: fix location monitor leak in fake bridge
  - staging: vme_user: bound slave read/write to the kern_buf size
  - tipc: fix out-of-bounds read in broadcast Gap ACK blocks
  - 6lowpan: fix NHC entry use-after-free on error path
  - usb: dwc3: run gadget disconnect from sleepable suspend context
  - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
  - virtio-mmio: fix device release warning on module unload
  - netfilter: ipset: fix race between dump and ip_set_list resize
  - mm/damon/ops-common: handle extreme intervals in damon_hot_score()
  - PCI: host-common: Request bus reassignment when not probe-only
  - PCI: altera: Do not dispose parent IRQ mapping
  - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
  - usb: xhci: Fix sleep in atomic context in xhci_free_streams()
  - binder: fix UAF in binder_free_transaction()
  - binder: fix UAF in binder_thread_release()
  - Bluetooth: btusb: fix wakeup source leak on probe failure
  - Bluetooth: btusb: fix use-after-free on marvell probe failure
  - Bluetooth: btusb: fix use-after-free on registration failure
  - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
  - vfio/pci: Release the VGA arbiter client on register_device() failure
  - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
  - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
  - ALSA: usb-audio: Roll back quirk control caches on write errors
  - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
  - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
  - ALSA: usb-audio: avoid kobject path lookup in DualSense match
  - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
  - ALSA: ice1712: check snd_ctl_new1() return value
  - ALSA: gus: check snd_ctl_new1() return value
  - ALSA: firewire: isight: bound the sample count to the packet payload
  - ALSA: es1938: check snd_ctl_new1() return value
  - ALSA: cmipci: check snd_ctl_new1() return value
  - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
  - urma: fix get tp list from ops to single group id
  - urma: free tpid by uobj
  - Bluetooth: serialize accept_q access
  - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
  - Ethernet: Linkdata: remove mistakenly committed binary file
  - EDAC/i10nm: Add back CWF support
  - config: enable DMR EDAC driver
  - EDAC/imh: Setup 'imh_test' debugfs testing node
  - EDAC/{skx_comm,imh}: Detect 2-level memory configuration
  - EDAC/skx_common: Extend the maximum number of DRAM chip row bits
  - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers
  - EDAC/skx_common: Prepare for skx_set_hi_lo()
  - EDAC/skx_common: Prepare for skx_get_edac_list()
  - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev
  - EDAC/{skx_common,skx}: Use configuration data, not global macros
  - USB: serial: io_ti: fix heap overflow in get_manuf_info()
  - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
  - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
  - ub: ubase: Modify the log for receiving the ctrlq message
  - ipc/shm: serialize orphan cleanup with shm_nattch updates
  - drm/virtio: Fix driver removal with disabled KMS
  - erofs: unify lcn as u64 for 32-bit platforms
  - padata: fix kabi breakage
  - padata: Put CPU offline callback in ONLINE section to allow failure
  - padata: Remove cpu online check from cpu add and removal
  - iommu/vt-d: Fix oops due to out of scope access
  - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
  - bus: fsl-mc: use generic driver_override infrastructure
  - vdpa: use generic driver_override infrastructure
  - iommu/amd: Fix clone_alias() to use the original device's devid
  - kernel/fork: clear PF_BLOCK_TS in copy_process()
  - cgroup/psi: Set of->priv to NULL upon file release
  - ipc: limit next_id allocation to the valid ID range
  - USB: serial: kl5kusb105: fix bulk-out buffer overflow
  - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
  - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging
  - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use
  - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
  - bpf: Fix s16 truncation for large bpf-to-bpf call offsets
  - bpf: Fix out-of-bounds read in bpf_patch_call_args()
  - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
  - fsnotify: fix inode reference leak in fsnotify_recalc_mask()
  - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism
  - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
  - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
  - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
  - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister"
  - xfs: remove xfs_attr_leaf_hasname
  - netfilter: nf_tables: use list_del_rcu for netlink hooks
  - nvmet-tcp: fix race between ICReq handling and queue teardown
  - riscv: traps: Add missing linux/nospec.h include
  - net/hinic5: Fix high-risk interfaces in the sdk
  - sched: fix cpu check logic in soft domain
  - sched: Fix kabi broken of struct sched_entity
  - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag")
  - sched/fair: Fix lag clamp
  - sched/fair: Fix math notation errors in avg_vruntime comment
  - x86/kexec: Disable KCOV instrumentation after load_segments()
  - KVM: arm64: Reject HDBSS enable when dirty ring is active
  - irqchip/gic-v3-its: Add DT cache clear count
  - net:unic:Fixed the problem of storage device hardware version error
  - ub:ubase:Fixed the problem of CDMA Entity has not using USC
  - ub:ubase:Fixed the problem of storage device hardware version error
  - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close)
  - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang
  - ub: ub_fwctl: Correct spenlling issues in the document


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.3.25.156.20260818.e03011b0964f
changelog:
  - !26198 [sync]urma: allow to set priority for urma_ping
  - urma: allow to set priority for urma_ping
  - !26167 urma: sync support dev/eid sharing mode
  - urma: support dev/eid sharing mode
  - !26120 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity
  - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity


author: lingsheng <lingsheng1@h-partners.com> - 3.7.1-7
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5915,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5915 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: jianmin <jianmin@iscas.ac.cn> - 1.34.1-5
changelog:
  - Type:cve
  - CVE:CVE-2024-3727 CVE-2024-24791
  - SUG:NA
  - DESC: fix CVE-2024-3727 and Rebuild to fix CVE-2024-24791


author: liuxu <liuxu156@huawei.com> - 1:1.36.1-6
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: lijian <lijian2@kylinos.cn> - 1:1.36.1-21
changelog:
  - Type:cves
  - ID:CVE-2026-38754
  - SUG:NA
  - DESC:re-fix CVE-2026-38754, clear stale IFS state on expansion error


author: wangjiang <wangjiang37@h-partners.com> - 2023.2.64-2
changelog:
  - remove expired and sync new certificates
    Removing:
      Security Communication Root CA
    Adding:
      D-Trust SBR Root CA 1 2022
      D-Trust SBR Root CA 2 2022
      Telekom Security SMIME ECC Root 2021
      Telekom Security SMIME RSA Root 2023
      Telekom Security TLS ECC Root 2020
      Telekom Security TLS RSA Root 2023


author: wangjiang <app@cameyan.com> - 2023.2.64-4
changelog:
  - remove expired and sync new certificates
    Removing:
      Certificate "Explicitly Distrust DigiNotar Root CA"
      Certificate "Baltimore CyberTrust Root"
    Adding:
      Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
      Certificate "TWCA CYBER Root CA"
      Certificate "TWCA Global Root CA G2"
      Certificate "SecureSign Root CA12"
      Certificate "SecureSign Root CA14"
      Certificate "SecureSign Root CA15"
      Certificate "D-TRUST BR Root CA 2 2023"
      Certificate "D-TRUST EV Root CA 2 2023"


author: yyjeqhc <jialin.oerv@isrc.iscas.ac.cn> - 1.0.1-6
changelog:
  - Add select local image to build.
  - Add support for setting target architecture during local builds.


author: liyunfei <liyunfei33@huawei.com> - 17.0.6-50
changelog:
  - update to llvm-for-oe-17.0.6-2509.0.2
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2509.0.2


author: liyunfei <liyunfei33@huawei.com> - 17.0.6-54
changelog:
  - update to llvm-for-oe-17.0.6-2512.0.1
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2512.0.1


author: liyunfei <liyunfei33@huawei.com> - 17.0.6-56
changelog:
  - update to llvm-for-oe-17.0.6-2512.0.2
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2512.0.2


author: liyufnei <liyunfei33@huawei.com> - 17.0.6-57
changelog:
  - update to llvm-for-oe-17.0.6-2512.0.3
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2512.0.3


author: liyufnei <liyunfei33@huawei.com> - 17.0.6-58
changelog:
  - update to llvm-for-oe-17.0.6-2603.0.1
  - release-note https://gitcode.com/openeuler/llvm-project/releases/llvm-for-oE-17.0.6-2603.0.1


author: liyufnei <liyunfei33@huawei.com> - 17.0.6-60
changelog:
  - update to llvm-for-oe-17.0.6-2603.0.2
  - release-note https://gitcode.com/openeuler/llvm-project/releases/llvm-for-oE-17.0.6-2603.0.2


author: Han Jinpeng <hanjinpeng@kylinos.cn> - 309-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: remove incorrect provides cockpit-machines and cockpit-machines-ovirt
          remove require libvirt and libvirt-client


author: shaojiansong <shaojiansong@kylinos.cn> - 309-8
changelog:
  - Fix networking: renaming of bridges and other groups (upstream fdba746e4, RHEL-131249, backport to openEuler-24.03-LTS-Next cockpit 309, keep member activation consistent when group name is changed.)


author: dongyuzhen <dongyuzhen@h-partners.com> - 1.6.22-20
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:delete task asynchronously to avoid containerd be killed when delete is blocking


author: Yu Peng <yupeng@kylinos.cn> - 1.6.22-23
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: Fix ctr snapshot mount produce invalid mount command for empty option.


author: Qin Fandong <qinfandong@kylinos.cn> - 9.4-23
changelog:
  - Type:CVE
  - ID:CVE-2026-56392
  - SUG:NA
  - DESC:fix heap overflow in unexpand with large tab stop values


author: xinghe <xingheyd@163.com> - 4.19.3-9
changelog:
  - Type:cves
  - ID:CVE-2026-3238 CVE-2026-3012 CVE-2026-4480 CVE-2026-4408
  - SUG:NA
  - DESC:fix CVE-2026-3238 CVE-2026-3012 CVE-2026-4480 CVE-2026-4408


author: xinghe <xingheyd@163.com> - 4.19.3-10
changelog:
  - Type:cves
  - ID:CVE-2026-6949 CVE-2026-58224 CVE-2026-58216 CVE-2026-58218 CVE-2026-58221 CVE-2026-58222
  - SUG:NA
  - DESC:fix CVE-2026-6949 CVE-2026-58224 CVE-2026-58216 CVE-2026-58218 CVE-2026-58221 CVE-2026-58222


author: Funda Wang <fundawang@yeah.net> - 1:2.4.7-7
changelog:
  - fix CVE-2025-58060, CVE-2025-58364
  - move www files into main package due to requirement by web interface


author: chenyanpan <chenyanpan@xfusion.com> - 1:2.4.7-13
changelog:
  - Fix CVE-2026-34979: Heap overflow in get_options()
  - Fix CVE-2026-34980: Filter control characters from option values


author: gaihuiying <eaglegai@163.com> - 1:2.4.7-16
changelog:
  - fix handling of multiple PPD: keywords from filters related to CVE-2026-34980
    fix a regression in shared printing from non-local accounts related to CVE-2026-27447


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix freeing of resources in disconnect
         openssl: fix crash on missing cert password


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix readdir issues
         h3: fix query of concurrent streams
         noproxy: fix the IPV6 network mask pattern match
         krb5_gssapi: fix memory leak on error path
         openldap: fix memory-leak in error path
         conn: fix hostname move on connection reuse 
         pop3: fix CAPA response termination detection
         libssh: properly free sftp_attributes
         openssl: fix a potential memory leak of params.cert


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:urlapi: avoid null deref if setting blank host to url
         urlapi: skip appending NULL pointer query


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-26
changelog:
  - Type:CVE
  - CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224
  - SUG:NA
  - DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:formdata: validate callback is non-NULL before use
         tftp: correct the filename length check


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-28
changelog:
  - Type:CVE
  - CVE:CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
  - SUG:NA
  - DESC:fix CVE-2026-1965 CVE-2026-3783 CVE-2026-3784


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-29
changelog:
  - Type:CVE
  - CVE:CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168
  - SUG:NA
  - DESC:fix CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-30
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:http1: fix potential NULL dereference in Curl_h1_req_parse_read
         mqtt: fix EOF handling


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-32
changelog:
  - Type:CVE
  - CVE:CVE-2026-8286 CVE-2026-8924 CVE-2026-8927 CVE-2026-9547 CVE-2026-10536 CVE-2026-12064
  - SUG:NA
  - DESC:fix CVE-2026-8286 CVE-2026-8924 CVE-2026-8927 CVE-2026-9547 CVE-2026-10536 CVE-2026-12064


author: lingsheng <lingsheng1@h-partners.com> - 2.90-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Update DNS records after pruning DHCP leases
         cache: Fix potential NULL deref in arcane situations.
         Fix potential memory leak
         Fix possible SIGSEGV in bpf.c
         allow binding mac with ip6


author: Liu Qingtao <liu.qingtao2@zte.com.cn> - 2.90-5
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:Ignore Wincompatible-pointer-types error when compiling with gcc-14.3


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.90-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix bounds checking in check_ia()
         Fix SEGV in Dbus code
         More fixes for DHCP ops in Dbus when DHCP not configured


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.90-9
changelog:
  - Type:CVE
  - CVE:CVE-2026-4890 CVE-2026-4891 CVE-2026-4892 CVE-2026-4893 CVE-2026-5172
  - SUG:NA
  - DESC:Fix NSEC bitmap parsing infinite loop
         Verify rdlen field in RRSIG packets
         Fix buffer overflow in helper.c with large CLIDs
         Fix broken client subnet validation
         Fix buffer overflow vulnerability in extract_addresses()


author: zhongjiawei<zhongjiawei1@huawei.com> - 2:18.09.0-347
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:delete redundant characters to prevent make failure in golang 1.24


author: jade_t<yzd50036@gmail.com> - 2:18.09.0-351
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix the installation conflict between docker-engine and containerd


author: wangkai <13474090681@163.com> - 1:2.3.20-4
changelog:
  - Fix CVE-2025-59031, CVE-2025-59032, CVE-2026-27855, CVE-2026-27856,
    CVE-2026-27857, CVE-2026-27858, CVE-2026-27859, CVE-2026-0394


author: zhang_jian <zhang_jian7@hoperun.com> - 5.8-1
changelog:
  - Upgrade to 5.8
  - Add usage hint and '-h' flag to display option summary
  - Linux: return correct status if poll(2) is interrupted
  - Add return value checks for malloc(3) and pipe(2)


author: wangkai <13474090681@163.com> - 25.3.2.6-18
changelog:
  - Fix CVE-2026-48855, CVE-2026-48858, CVE-2026-49759, CVE-2026-49760, CVE-2026-53422,
    CVE-2026-54886, CVE-2026-54887, CVE-2026-54891, CVE-2026-55950, CVE-2026-55952


author: yanglu <yanglu72@h-partners.com> - 2:6.6-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:ethtool:hibmcge:fix wrong register address in pretty print of ethtool -d command


author: andy <liuyang01@kylinos.cn> - 2:6.6-6
changelog:
  - Type:requirement
  - Id:NA
  - SUG:NA
  - DESC:ethtool: Fix SFF-8472 transceiver module identification
          ethtool: Add default branch to sff8636_show_all_ioctl switch
          qsfp: Better handling of Page 03h netlink read failure
          module-eeprom: treat zero arguments like any other arguments for hex dump
          qsf: Better handling of Page A2h netlink read failure


author: Fengyan Mu <mufengyan@huawei.com> - 2:6.6-7
changelog:
  - Type:requirement
  - Id:NA
  - SUG:NA
  - DESC:ethtool: Add support the printer for the registers of unic driver
          through the command -d


author: yanglu <yanglu72@h-partners.com> - 2:6.6-8
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:add NULL check before jsonw_string_field() in print_string()
         netlink:add NULL check for get_string() in features.c


author: fly_fzc <2385803914@qq.com> - 2.5.0-22
changelog:
  - fix CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407
        CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412


author: lizhengde <lizhengde@xfusion.com> - 6.1.1-27
changelog:
  - Type:CVE
  - CVE:CVE-2026-30997
  - SUG:NA
  - DESC:avcodec/av1dec: check that primary_ref_frame is within range (CVE-2026-30997)


author: Funda Wang <fundawang@yeah.net> - 140.5.0-1
changelog:
  - update to 140.5.0
    * fix CVE-2025-13012, CVE-2025-13013, CVE-2025-13014, CVE-2025-13015,
      CVE-2025-13016, CVE-2025-13017, CVE-2025-13018, CVE-2025-13019,
      CVE-2025-13020


author: Funda Wang <fundawang@yeah.net> - 140.7.0-1
changelog:
  - update to 140.7.0
    * fix CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,
      CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,
      CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,
      CVE-2026-0891


author: Liu Wang <1823363429@qq.com> - 140.13.0-2
changelog:
  - Add StartupWMClass=firefox so that GNOME can correctly recognize the Firefox window and associate it with the icon.


author: wangkai <13474090681@163.com> - 140.3.1-1
changelog:
  - Update to 140.3.1
  - Fix CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533
    CVE-2025-10536 CVE-2025-10537 CVE-2025-9182 CVE-2025-9183 CVE-2025-9184
    CVE-2025-8036 CVE-2025-8037 CVE-2025-8038 CVE-2025-8039 CVE-2025-8040


author: Funda Wang <fundawang@yeah.net> - 140.4.0-1
changelog:
  - update to 140.4.0
  - fix CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711,
    CVE-2025-11712, CVE-2025-11713, CVE-2025-11714, CVE-2025-11715


author: zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:chore nftables add delete table helper
         fix nftables always flush main table on start


author: zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Firewall startup is to set CleanupModuleOnxit=yes to unload related ko when stopping firewalld service
         To reduce unnecessary loading of ebtables-related kernel modules
         fix(nm): release NM client after a timeout


author: zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-8
changelog:
  - Type:bugfix
  - CVE:NA   
  - SUG:NA   
  - DESC:fix(icmp): fix check_icmpv6_name() to use correct IPv6 names
         fix(ipset): fix configuring IP range for ipsets with nftables
         fix(ipset): fix configuring "timeout","maxelem" values for
         fix(rich): validate service name of rich rule
         fix(rich): fix range check for large rule limit
         fix(nftables): use current pkttype keywords


author: wangkai <13474090681@163.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 for fix CVE-2024-32039,CVE-2024-32040,
    CVE-2024-32041,CVE-2024-32458,CVE-2024-32459,CVE-2024-32460,
    CVE-2024-32658,CVE-2024-32659 and CVE-2024-32660


author: wangkai <13474090681@163.com> - 2:2.11.8-1
changelog:
  - Update to 2.11.8
  - Fix CVE-2026-22852, CVE-2026-22856, CVE-2026-22859, CVE-2026-23530, CVE-2026-23531,
    CVE-2026-23532, CVE-2026-23534, CVE-2026-24491, CVE-2026-24675, CVE-2026-24676,
    CVE-2026-24679, CVE-2026-24681, CVE-2026-24682, CVE-2026-24683, CVE-2026-24684,
    CVE-2026-25997, CVE-2026-26271, CVE-2026-26986, CVE-2026-27015, CVE-2026-25941,
    CVE-2026-22855, CVE-2026-22857, CVE-2026-23533, CVE-2026-23732, CVE-2026-23883,
    CVE-2026-23884


author: wangkai <13474090681@163.com> - 2:2.11.8-3
changelog:
  - Fix CVE-2026-26955, CVE-2026-26965, CVE-2026-31806, CVE-2026-31883, CVE-2026-31885,
    CVE-2026-33984, CVE-2026-33983


author: wangkai <13474090681@163.com> - 2:2.11.8-5
changelog:
  - Fix CVE-2026-25942, CVE-2026-25952, CVE-2026-25953, CVE-2026-25954, CVE-2026-27951,
    CVE-2026-29774, CVE-2026-29775, CVE-2026-31884, CVE-2026-33985


author: Chenzhen <chenzhen126@huawei.com> - 2.0.2-4
changelog:
  - fix restart thread block by resetting probe pid
    fix service failed when cmd server thread starts late
    fix OOB write when getting proc cmdline
    fix restart gopher failed for check gopher pid multi times
    fix run sig hander core for probe mng create later
    fix potential nullptr dereference in libevent openssl cb
    ipc: reset probe_flags to 0 when restarting probes
    tcpprobe: do not flush snooped procs to avoid deleting tcp link by accident
    fix buffer overflow in sscanf
    fix buffer overflow and ret value of sscanf
    snooper: enlarge channel map and shorten poll timeout to ease event loss
    system_infos: fix oob of arrays and double free
    Refactor to reduce memory usage of metric record
    bugfix: path parsing error when gala-gopher running in container
    fix strdup relative error
    tcpprobe: fix incorret struct type of tracepoint event
    fix UAF of probe bin after parsing invalid config
    snooper: fix opposite judgment logic of container info


author: JDLihoo <donglihao1@huawei.com> - 2.0.2-6
changelog:
  - restore the pristine source tarball and package upstream changes as patches
  - consolidate upstream changes into 25 Git-formatted patches
  - exclude build artifacts, IDE metadata, profiling images, and unrelated line-ending churn


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 14.3.1-8
changelog:
  - fix param missing in Ztso RISCV_EXT_FLAG_ENTRY in RISC-V-Implement-TARGET_CAN_INLINE_P patch #ID2L4T


author: yaoxin <yao_xin001@hoperun.com> - 0.4.50-1
changelog:
  - Update to 0.4.50:
  - Core:
    * Better Gobject Introspection annotation coverage.
    * Improved error handling for gegl chain processing.
    * Added accessors for pad meta-data, to be able to show names and descriptions in UIs.
    * GeglColor: more lax parameters for g_arapm_values_cmp
    * exr-save: store 16bpc files as half, fixing gimp#10778
    * ff-load, ff-save: fix build with FFmpeg 7
    * dither: do processing in linear when all levels==2


author: Funda Wang <fundawang@yeah.net> - 9.56.1-14
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DECS: Fix CVE-2025-27830, CVE-2025-27832, CVE-2025-27833, CVE-2025-27834, CVE-2025-27835, CVE-2025-27836


author: hdliu <dev03108@linx-info.com> - 9.56.1-15
changelog:
  - Add font mappings so that the PS interpreter can rasterize Chinese content using the two fonts STKaiti-Regular and STheiti-Regular.


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: yaoxin <1024769339@qq.com> - 2:3.0.2-18
changelog:
  - Fix CVE-2026-18301, CVE-2026-18302, CVE-2026-18303, CVE-2026-18304,
    CVE-2026-18305, CVE-2026-18306 and CVE-2026-18308


author: fuanan <fuanan3@h-partners.com> - 2.43.0-4
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: fuanan <fuanan3@h-partners.com> - 2.43.0-7
changelog:
  - Type:CVE
  - ID:CVE-2025-48384 CVE-2025-48385 CVE-2025-48386
  - SUG:NA
  - DESC:Fix CVE-2025-48384 CVE-2025-48385 CVE-2025-48386


author: fuanan <fuanan3@h-partners.com> - 2.43.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix malformed patch:
         backport-CVE-2025-48385-bundle-uri-fix-arbitrary-file-writes-via-parameter-i.patch


author: fuanan <fuanan3@h-partners.com> - 2.43.0-9
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-27614 CVE-2025-46334 CVE-2025-46835
  - SUG:NA
  - DESC:Fix CVE-2025-27613 CVE-2025-27614 CVE-2025-46334 CVE-2025-46835


author: fuanan <fuanan3@h-partners.com> - 2.43.0-10
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patch
         config.mak.uname: set CSPRNG_METHOD to getrandom on Linux


author: zhaoyonghao10 <zhaoyonghao10@h-partners.com> - 2.78.3-16
changelog:
  - apply 3 patches: backport-Fix-a-buffer-leak-when-finishing-connecting.patch, backport-Add-thread-pool-stress-test-to-task-c.patch, backport-Cleanup-trailing-spaces-task-c.patch


author: zhusicong <zhusicong@h-partners> - 2.78.3-17
changelog:
  - fix CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014, CVE-2026-58015, CVE-2026-58016


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-98
changelog:
  - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module
  - posix: Run tst-wordexp-reuse-mem test
  - elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-101
changelog:
  - Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
  - Document CVE-2026-4046


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-103
changelog:
  - include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
  - Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)

   * Fri Apr 24 2026 zhangjian <mszjaas@qq.com> - 2.38-102
   - fix-cve-2026-5450
   - fix-CVE-2026-5928


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-104
changelog:
  - libio: Fix ungetwc operating on byte stream [BZ #33998] (CVE-2026-5928)
  - stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] (CVE-2026-5450)


author: panzhe <panzhe@kylinos.cn> - 2.38-107
changelog:
  - Sw64: Fix getpriority error

   * Fri May 29 2026 zhongxuan2 <zhongxuan2@h-partners.com> - 2.38-106
   - fix-cve-2026-5435
   - fix-CVE-2026-6238


author: litenglong <litenglong@kylinos.cn> - 2.38-115
changelog:
  - aarch64: delete revert-aarch64-Use-memcpy_simd-as-the-default-memcpy.patch to align with the upstream community.


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-86
changelog:
  - memalign: reinstate alignment overflow check (CVE-2026-0861)
  - resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915)


author: Linux_zhang <244695981@qq.com> - 3.8.2-13
changelog:
  - fix CVE-2026-33846,CVE-2026-3833,CVE-2026-42009,CVE-2026-42010,CVE-2026-42014,CVE-2026-42015,CVE-2026-5260.


author: Xu Raoqing <609179072@qq.com> - 3.8.2-16
changelog:
  - buffers: simplify and tighten parse_handshake_header checks
  - lib/auth/psk_passwd: limit the length of the comparison
  - x509/name_constraints: fix intersecting empty constraints
  - datum, mem, str: add helper functions to steal pointers
  - mem,str,datum: rename _steal_* to _take_*
  - x509/virt-san: a small OOM-correctness fix
  - x509: add bare-bones awareness of SRV virtual SAN
  - x509/hostname-verify: make URI/SRV SAN preclude CN fallback
  - fix CVE-2026-42012


author: Julian Zhu <julian.oerv@isrc.iscas.ac.cn> - 1.21.4-40
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix the bootstrap failure caused by the backport of RISC-V RVA23 support


author: huang-xiaoquan <huangxiaoquan1@huawei.com> - 1.21.4-42
changelog:
  - Type:Feature
  - CVE:NA
  - SUG:NA
  - DESC: [stepopt2] Add goexperiment.StepOpt2 for optimized step function in runtime


author: huzhangying <huzhangying@huawei.com> - 1.21.4-43
changelog:
  - Type:CVE
  - CVE:CVE-2025-58183,CVE-2025-58189,CVE-2025-61724,CVE-2025-58188,CVE-2025-58185,CVE-2025-58187,CVE-2025-61723,CVE-2025-47912,CVE-2025-58186
  - SUG:NA
  - DESC:fix CVE-2025-58183,CVE-2025-58189,CVE-2025-61724,CVE-2025-58188,CVE-2025-58185,CVE-2025-58187,CVE-2025-61723,CVE-2025-47912,CVE-2025-58186


author: huzhangying <huzhangying@huawei.com> - 1.21.4-45
changelog:
  - Type:CVE
  - CVE:fix CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61728,CVE-2025-68121,CVE-2025-61723
  - SUG:NA
  - DESC:fix CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61728,CVE-2025-68121,CVE-2025-61723


author: huzhangying <huzhangying@huawei.com> - 1.21.4-46
changelog:
  - Type:CVE
  - CVE:CVE-2026-27139,CVE-2026-27142,CVE-2026-25679
  - SUG:NA
  - DESC:fix CVE-2026-27139,CVE-2026-27142,CVE-2026-25679


author: huzhangying <huzhangying@huawei.com> - 1.21.4-48
changelog:
  - Type:CVE
  - CVE:CVE-2026-27143,CVE-2026-27144,CVE-2026-32288,CVE-2026-27140
  - SUG:NA
  - DESC:fix CVE-2026-27143,CVE-2026-27144,CVE-2026-32288,CVE-2026-27140


author: shupiaoyang <shupiaoyang1@huawei.com> - 1.24.6-2
changelog:
  - internal/runtime/maps: Add intrinsic implementation for ctrlGroupMatchH2 to avoid false-positive match
  - internal/sync: Add support for wide trie in sync.HashTrieMap
  - hash/crc32c: adjust the machine code to assembly instructions
  - hash/crc32c: adjust vmov and eor to fmovd and eorw instruction


author: yechao-w <wang.yechao255@zte.com.cn> - 1:2.12-45
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: kern/riscv/efi/init: Use time register in grub_efi_get_time_ms()


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 1:2.12-47
changelog:
  - Type:CVE
  - CVE:CVE-2025-61661,CVE-2025-61662,CVE-2025-54771,CVE-2025-54770,CVE-2025-61663,CVE-2025-61664
  - SUG:NA
  - DESC:commands/usbtest: Ensure string length is sufficient in usb string processing
         commands/usbtest: Use correct string length field
         tests/lib/functional_test: Unregister commands on module unload
         normal/main: Unregister commands on module unload
         gettext/gettext: Unregister gettext command on module unload
         net/net: Unregister net_set_vlan command on unload
         kern/file: Call grub_dl_unref() after fs->fs_close()
         commands/test: Fix error in recursion depth calculation


author: Han Gao <gaohan@iscas.ac.cn> - 1:2.12-48
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:configure: Add -mno-relax on riscv*
         configure: Defer check for -mcmodel=large until PIC/PIE checks are done


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 1:2.12-50
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: workaround the BuildRequires mis-preinstallation issue on build systems


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 1:2.12-51
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:loader/i386/pc/linux: Fix resource leak
         Revert "lzma: Make sure we don't dereference past array
         loader/efi/linux: Correctly terminate load_options member
         loader/efi/linux: Use sizeof() instead of constant
         loader/efi/linux: Use proper type for len variable
         loader/efi/linux: Do not pass excessive size for source string
         loader/efi/linux: Remove useless assignment
         loader/efi/linux: Reuse len variable
         loader/efi/linux: Unload previous Linux kernel/initrd before updating kernel size
         normal/charset: Fix underflow and overflow in loop init
         lib/LzmaEnc: Validate len before subtracting
         osdep/unix/hostdisk: Fix signed integer overflow
         fs/zfs: Fix another memory leak in ZFS code
         fs/xfs: Fix large extent counters incompat feature support


author: lvgenggeng <lvgenggeng@uniontech.com> - 1:2.12-53
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: mmap/mmap: Add missing grub_malloc() failure check
          mmap/mmap: Fix resource leak
          mmap/mmap: Fix integer overflow in binary search


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 1:2.12-54
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:grub-mkimage: Do not generate empty SBAT metadata
         efi: Fix several memory leaks of UEFI handles
         script/execute: Add a NULL check after grub_calloc() call
         normal/cmdline: Add grub_calloc() failure check and fix hist_lines state loss
         osdep/linux/ofpath: Add missing strdup() failure checks
         lib/relocator: Fix dereference after NULL check
         osdep/linux/getroot: Add missing strdup() failure checks
         script/execute: Add missing grub_strdup() failure check


author: lizhengde <lizhengde@xfusion.com> - 1.16.2-14
changelog:
  - Type:CVE
  - CVE:CVE-2026-53702
  - SUG:NA
  - DESC:Stack buffer overflow in GStreamer H.265 parser. Fix incorrect loop bound.


author: Funda Wang <fundawang@yeah.net> - 1.22.5-2
changelog:
  - fix CVE-2024-47538, CVE-2024-47541, CVE-2024-47542, CVE-2024-47600,
    CVE-2024-47607, CVE-2024-47615, CVE-2024-47835


author: yaoxin <yao_xin001@hoperun.com> - 1.20.3-3
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47599,CVE-2024-47613,CVE-2024-47775
    CVE-2024-47776,CVE-2024-47777,CVE-2024-47778,CVE-2024-47774
    CVE-2024-47540,CVE-2024-47602,CVE-2024-47601,CVE-2024-47603
    CVE-2024-47834,CVE-2024-47537,CVE-2024-47597,CVE-2024-47543
    CVE-2024-47596,CVE-2024-47539,CVE-2024-47546,CVE-2024-47598


author: Funda Wang <fundawang@yeah.net> - 1.20.3-9
changelog:
  - fix CVE-2026-17072 (GStreamer-SA-2026-0073), GStreamer-SA-2026-0072,
    GStreamer-SA-2026-0068
  - fix CVE-2026-53705 (GStreamer-SA-2026-0035)


author: xinghe <xinghe2@h-partners.com> - 2.9.5-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:stream: Prevent mux upgrades if client connection is no longer ready


author: yanglu <yanglu72@h-partners.com> - 2.9.5-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:queues:Do not use pendconn_grab_from_px
         queues:Make sure we call process_srv_queue when leaving
         queue:Make process_srv_queue return the number of streams


author: xinghe <xinghe2@h-partners.com> - 2.9.5-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:haproxy: only tid 0 must not sleep if got signal
         server/addr: fix tune.events.max-events-at-once event miss and leak


author: yaoxin <yao_xin001@hoperun.com> - 1.14.5-1
changelog:
  - Update to 1.14.5:
    * Added signed Windows msi binary and signed Apple dmg binary files.
    * Moved examples to the HDF5Examples folder in the source tree.
    * Added support for using zlib-ng package as the zlib library
    * Disable CMake UNITY_BUILD for hdf5
    * Removed "function/code stack" debugging configuration option
    * Added configure options for enabling/disabling non-standard programming language features
    * Added the CMake variable HDF5_ENABLE_ROS3_VFD to the HDF5 CMake config
      file hdf5-config.cmake. This allows it to easily detect if the library
      has been built with or without read-only S3 functionality.
    * Fixed many CVE:
      CVE-2024-29157,CVE-2024-29158,CVE-2024-29159,CVE-2024-29160,CVE-2024-29161,CVE-2024-29162
      CVE-2024-29163,CVE-2024-29164,CVE-2024-29165,CVE-2024-29166,CVE-2024-32605,CVE-2024-32606
      CVE-2024-32607,CVE-2024-32608,CVE-2024-32609,CVE-2024-32610,CVE-2024-32611,CVE-2024-32612
      CVE-2024-32613,CVE-2024-32614,CVE-2024-32615,CVE-2024-32616,CVE-2024-32617,CVE-2024-32618
      CVE-2024-32619,CVE-2024-32620,CVE-2024-32621,CVE-2024-32622,CVE-2024-32623,CVE-2024-32624
      CVE-2024-33873,CVE-2024-33874,CVE-2024-33875,CVE-2024-33876,CVE-2024-33877,CVE-2018-13871
      CVE-2018-13875,CVE-2018-14034


author: Funda Wang <fundawang@yeah.net> - 1.14.5-2
changelog:
  - add patches from azure linux for fixing CVE-2025-2153, CVE-2025-2310,
    CVE-2025-2914, CVE-2025-2926, CVE-2025-6816, CVE-2025-2925,
    CVE-2025-2924, CVE-2025-44905, CVE-2025-6269, CVE-2025-6750,
    CVE-2025-6857, CVE-2025-7067, CVE-2025-7068, CVE-2025-6858,
    CVE-2025-2923, CVE-2025-2913, CVE-2025-6516, CVE-2025-6818,
    CVE-2025-6817, CVE-2025-6856, CVE-2025-7069


author: zhangyaqi <zhagnyaqi@kylinos.cn> - 2.4.58-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:allocate a heap buffer if the configured size is greater than the stack-allocated buffer.


author: chengyechun <chengyechun1@huawei.com> - 2.4.58-6
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: xingwei <xingwei14@h-partners.com> - 2.4.58-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mod_log_config: Fix LogFormat directive merging
         Fix X509 leak and Increase MAX_CONCURRENCY hard limit
         mod_proxy_balancer: Fix the handling of the stickysession
         mod_cache_socache: Fix possible crash on error path
         mod_ssl: Check SSL_CTX_new() return value
         core: Report invalid Options argument when parsing AllowOverride directives


author: yanglu <yanglu72@h-partners.com> - 2.4.58-10
changelog:
  - Type:CVE
  - CVE:CVE-2025-49812,CVE-2025-23048,CVE-2024-47252,CVE-2024-43204,CVE-2024-42516
  - SUG:NA
  - DESC:fix CVE-2025-49812 CVE-2025-23048 CVE-2024-47252 CVE-2024-43204 CVE-2024-42516
         mod_lua: Fix memory handling in output filters.
         Fix a regression that caused stickysession keys
         avoid ap_set_content_type when processing a _Request_Header
         set_cookie_name: ensure correct format


author: tangce <tangce1@h-partners.com> - 2.4.58-11
changelog:
  - Type:CVE
  - CVE:CVE-2025-58098,CVE-2025-65082,CVE-2025-66200
  - SUG:NA
  - DESC:fix CVE-2025-58098,CVE-2025-65082,CVE-2025-66200


author: tangce <tangce1@h-partners.com> - 2.4.58-14
changelog:
  - Type:CVE
  - CVE:CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059
  - SUG:NA
  - DESC:fix CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059


author: tangce <tangce1@h-partners.com> - 2.4.58-15
changelog:
  - Type:CVE
  - CVE:CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032
  - SUG:NA
  - DESC:fix CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032


author: tangce <tangce1@h-partners.com> - 2.4.58-17
changelog:
  - Type:CVE
  - CVE:CVE-2026-29167,CVE-2026-42535,CVE-2026-44631
  - SUG:NA
  - DESC:fix CVE-2026-29167,CVE-2026-42535,CVE-2026-44631


author: tangce <tangce1@h-partners.com> - 2.4.58-18
changelog:
  - Type:CVE
  - CVE:fix CVE-2026-48913,CVE-2026-44186,CVE-2026-44185,CVE-2026-44119,CVE-2026-43951
  - SUG:NA
  - DESC:fix CVE-2026-48913,CVE-2026-44186,CVE-2026-44185,CVE-2026-44119,CVE-2026-43951


author: tangce <tangce1@h-partners.com> - 2.4.58-19
changelog:
  - Type:CVE
  - CVE:fix CVE-2026-42536,CVE-2026-34356,CVE-2026-34355,CVE-2026-29170
  - SUG:NA
  - DESC:fix CVE-2026-42536,CVE-2026-34356,CVE-2026-34355,CVE-2026-29170


author: jingxiaolu<lujingxiao@huawei.com> - 2.1.5-18
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: sync patches from upstream for refactoring sandbox and bugfixing


author: Donghua Huang <huangdonghua3@h-partners.com> - 50.0-32
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libhns: Increase input parameter checks and adjust inline data size.


author: Donghua Huang <huangdonghua3@h-partners.com> - 50.0-36
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libhns: Fix wrong WQE data in new post send API when QP wraps around


author: liweigang <liweiganga@uniontech.com> - 1.8.9-5
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libxtables: Fix memleak of matches' udata
          xshared: Fix parsing of empty string arg in '-c' option


author: yanglu <yanglu72@h-partners.com> - 1.8.9-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:extensions:recent:Fix format string for unsigned values
         nft:cmd:Init struct nft_cmd::head early


author: douyiwang <douyiwang@huawei.com> 1:17.0.17.10-4
changelog:
  - add fix-libpng-API-allow-reading-up-to-1012-bytes-beyond-the-png-sRGB-bbase-array-bug.patch to fix CVE-2025-66293


author: BenShuai5D <benshuai5d@163.com> 1:17.0.18.8-0
changelog:
  - upgrade to 17.0.18
  - modify Backport-Important-Fixed-Issues.patch
  - modify downgrade-the-glibc-symver-of-memcpy.patch
  - modify puyuan-jdk17.0.9-patch.patch
  - modify add-version-txt.patch
  - modify jdk17-Add-KAE-provider.patch
  - add huawei-Fix-KAEProvider-SM2-Code.patch


author: yinsist <jianhui.oerv@isrc.iscas.ac.cn> - 1.6-4
changelog:
  - Valgrind does not support certain architectures like RISC-V, Before depending on Valgrind, first check if Valgrind supports the architecture


author: yaoxin <1024769339@qq.com> - 1.8.0-4
changelog:
  - Fix CVE-2026-40612,CVE-2026-41256,CVE-2026-41257,CVE-2026-43894,
    CVE-2026-43895,CVE-2026-43896 and CVE-2026-44777


author: dongyuzhen <dongyuzhen@h-partners.com> - 3.2.0-13
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix the problem of missing kata-containers source code in the src package


author: jade_t <yzd50036@gmail.com> - 3.2.0-19
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:modify the git clone download address in kata_integration_clone


author: jade_t <yzd50036@gmail.com> - 3.2.0-20
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix the problem of self-compilation failure in the kata-containers source package


author: dongyuzhen <dongyuzhen@h-partners.com> - 1.11.1-28
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix the problem of missing kata-containers-go source code in the src package


author: yaoxin <1024769339@qq.com> - 1.28-3
changelog:
  - Fix CVE-2026-15811, CVE-2026-15812 and CVE-2026-15813
  - Add patches to make the tests of previous fixes run on 1.28


author: cenhuilin <cenhuilin@kylinos.cn> - 2.39.1-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:lsblk: fix memory leak [coverity scan]
         lsblk: fix possible use-after-free


author: yixiangzhike <yixiangzhike007@163.com> - 2.39.1-31
changelog:
  - backport community patches
      fix columns reduction
      fix memory leak issue in read_Subid_range
      fix off-by-one in maximum last sector calculation
      fix memory corruption in size calculation
      fix memory corruption in read buffers


author: yaoxin <yao_xin001@hoperun.com> - 1.27.4-1
changelog:
  - Update to 1.27.4 for fix CVE-2024-6381 and CVE-2024-6383
  - libbson Fixes:
    * Fix build with Visual Studio 2013.
    * Fix parsing of colon in timezone.
    * Error on failure to init subdocument in bson_iter_visit_all.
    * Fix string handling in bson_string_new and bson_string_append.
    * Fix iteration in bson_strfreev.
    * Use aligned alloc for bson_array_builder_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Fix conversion warning with GCC 12.
    * Fixes to some format strings in trace logs.
    * Allow mongoc_buffer_t to be larger than INT_MAX.
    * Add bson_array_builder_t.
  - libmongoc Fixes:
    * Fix possible crash reading malformed wire protocol message.
    * Upgraded bundled Zlib from 1.2.3 to 1.3.1
    * Close leftover connections to removed servers.
    * Fix possible crash when client is configured with empty password.
    * Fix possible hang if mongoc_gridfs_file_readv is called with a corrupt chunk with incomplete data.
    * Fix 32-bit compile with 64-bit time_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Disable shared libmongoc targets if ENABLE_SHARED=OFF
    * Fix documentation build with Python 3.9.
    * Fix data race in mongoc_cursor_get_host.
    * Add back support for BUILD_VERSION CMake option. BUILD_VERSION was unintentionally removed in 1.25.0.
    * Send recoveryToken in transactions when connected to a load balancer.


author: yuanchao <1050706328@qq.com> - 2.1.12-13
changelog:
  - Fix function undeclared,incompatible pointer and parameter lack in 'add-testcases-for-event.c-apis.patch',support clang build


author: andy <liuyang01@kylinos.cn> - 2.1.12-14
changelog:
  - Fix leak in evbuffer_add_file() on empty files
  - evthread: fix NULL dereference in evthread_setup_global_lock_()
  - Fix potential null dereference in http-server


author: shixuantong <shixuantong1@h-partners.com> - 2.1.12-15
changelog:
  - fix: arc4_getword integer overflow, detected by -fsanitize=undefined
  - Fix divide-by-zero in ev_token_bucket_get_tick_
  - fixed missing check for null after strdup in evutil_inet_pton_scope
  - Fix integer-overflow in ev_token_bucket_cfg_new
  - Fix integer overflow in HTTP version
  - Fix potential Null pointer dereference in bufferevent_openssl.c
  - Fix potential Null pointer dereference in dns-example.c
  - Fix potential Null pointer dereference in event-read-fifo.c
  - Fix unlikely (for libevent) UB in HT_GROW()


author: Funda Wang <fundawang@yeah.net> - 2.1.12-16
changelog:
  - Don't use deprecated functions when building against OpenSSL 3.0
  - fix linkage of shared libraries


author: fly_fzc <2385803914@qq.com> - 2.1.12-17
changelog:
  - fix CVE-2026-63387 CVE-2026-63388 CVE-2026-63384 CVE-2026-63381
        CVE-2026-63385 CVE-2026-63382 CVE-2026-63379 CVE-2026-63383


author: wangkai <13474090681@163.com> - 2.5.31-3
changelog:
  - Fix CVE-2026-40334, CVE-2026-40334, CVE-2026-40338, CVE-2026-40339,
    CVE-2026-40340, CVE-2026-40341


author: Xu Raoqing <609179072@qq.com> - 2.9.4-19
changelog:
  - oidc_child: fix wrong usage of printf format (a2bd434)
  - ad: use right memory context in GPO code (723a30b)
  - Responder: fix passkey auth when user-verification is off (4c6c010)
  - KRB5: fix mem leak in authenticate_stored_users (8b452b3)
  - KCM: fix use-after-free in kcm_read_options (50ae35f)
  - NSS: Fix wrong condition invalidating an optimization (6d71291)


author: Qin Fandong <qinfandong@kylinos.cn> - 2.9.4-22
changelog:
  - Type:CVE
  - ID:CVE-2026-14474
  - SUG:NA
  - DESC:fix CVE-2026-14474: warn when ldap_sudo_search_base falls back to root DN to prevent privilege escalation


author: yixiangzhike <yixiangzhike007@163.com> - 1.6.4-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patch to fix possible uninitialized variable


author: xinghe <xinghe2@h-partners.com> - 2:1.6.40-2
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


author: xinghe <xinghe2@h-partners.com> - 2.74.3-4
changelog:
  - Type:cves
  - ID:CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
  - SUG:NA
  - DESC:fix CVE-2024-52530 CVE-2024-52531 CVE-2024-52532


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-5
changelog:
  - Type:cves
  - ID:CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784
  - SUG:NA
  - DESC:fix CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-7
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-10
changelog:
  - Type:cves
  - ID:CVE-2025-4476 CVE-2025-4948 CVE-2025-4969
  - SUG:NA
  - DESC:fix CVE-2025-4476 CVE-2025-4948 CVE-2025-4969


author: nickyang <nickyang228@163.com> - 2.74.3-12
changelog:
  - Type:cves
  - ID:CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716
  - SUG:NA
  - DESC:fix CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716


author: nickyang <nickyang228@163.com> - 2.74.3-13
changelog:
  - Type:cves
  - ID:CVE-2026-1760 CVE-2026-1801 CVE-2026-2369
  - SUG:NA
  - DESC:fix CVE-2026-1760 CVE-2026-1801 CVE-2026-2369


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-5
changelog:
  - Type:CVE
  - Id:CVE-2025-4877 CVE-2025-4878 CVE-2025-5351 CVE-2025-5987 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877CVE-2025-4878CVE-2025-5351CVE-2025-5987CVE-2025-5372


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-9
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:fix CVE-2026-0968 CVE-2026-0967 CVE-2026-0966 CVE-2026-0965 CVE-2026-0964 CVE-2025-14821


author: zhangbinqin <zhangbinqin@h-partners.com> - 1.11.0-6
changelog:
  - Type:CVE
  - CVE:CVE-2026-7598
  - SUG:NA
  - DESC:add username_len bounds checking to fix CVE-2026-7598


author: jiayuzhe <jiayuzhe@kylinos.cn> - 1.11.0-8
changelog:
  - Type:CVE
  - CVE:CVE-2026-66032,CVE-2026-66033,CVE-2026-66034
  - SUG:NA
  - DESC:fix CVE-2026-66032,CVE-2026-66033,CVE-2026-66034


author: yueyuankun<yueyuankun@kylinos.cn> - 1.11.0-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add patch to work around strict permissions issues for sshd tests


author: fundawang <fundawang@yeah.net> - 2.10.1-10
changelog:
  - Fix CVE-2026-7867 (as-user mount authorization bypass, local privilege escalation)
  - Normalize License field to SPDX identifiers (GPL-2.0-or-later, LGPL-2.0-or-later)
  - Drop unused 
  - Align BuildRequires versions with upstream configure.ac (systemd 209, libmount >= 2.30, add libblkid-devel)
  - Convert pkg-config style BuildRequires to pkgconfig() form
  - Drop unused intltool BuildRequires (i18n uses GNU gettext)


author: ZixinLi <lizixin10@h-partners.com> - 9.10.0-23
changelog:
  - Fix CVE-2025-12748 CVE-2025-13193
  - conf: Add virDomainDefIDsParseString
  - bhyve: Check ACLs before parsing the whole domain XML
  - libxl: Check ACLs before parsing the whole domain XML
  - lxc: Check ACLs before parsing the whole domain XML
  - vz: Check ACLs before parsing the whole domain XML
  - ch: Check ACLs before parsing the whole domain XML
  - qemu: Check ACLs before parsing the whole domain XML
  - qemu: snapshot: Set umask for 'qemu-img' when creating external inactive snapshots


author: PengruiZhang <zhangpengrui@huawei.com> - 9.10.0-26
changelog:
  - vdpa: Add the count of vdpa devices when calculating Max locked memory
  - virDomainDeviceIsUSB: Handle all USB devices and simplify the code
  - add TengyunS5000C cpu info to cpu map
  - qemu:Implement the RAS feature for aarch64


author: PengruiZhang <zhangpengrui@huawei.com> - 9.10.0-28
changelog:
  - virshFindDisk: fix NULL-dereference of xmlCopyNode() result
  - vir-qemu-sev-validate: Use string() method in xpath
  - network: convert virFileLinkPointsTo to return bool
  - security_util: fix log in virSecurityMoveRememberedLabel
  - Skip the UEFI check for CCA
  - conf: fix integer overflow in virDomainControllerDefParseXML
  - qemu: Replace the deprecated short-formed option "unix"
  - ch_driver: fix condition in virCHDomainRemoveInactive()
  - remote: DeserializeDomainDiskErrors: remove dead code


author: Pengrui Zhang <zhangpengrui@huawei.com> - 9.10.0-29
changelog:
  - cpu_map: add kunpeng-920-V1 cpu map
  - cpu_map: add kunpeng-920-V2 cpu map
  - cpu_map: add kunpeng-950-V1 cpu map
  - Migration/urma: tune and restore rcu_expedited around URMA migration
  - Migration/urma: enable ONECOPY capability for destination


author: Pengrui Zhang <zhangpengrui@huawei.com> - 9.10.0-30
changelog:
  - qemu_command: Remove unused iommufd variable in qemuBuildPCIHostdevDevProps
  - qemu_command: Don't open code virPCIDeviceAddressAsString()
  - meson: Stop looking for passt at build time
  - qemu: Move memory device coldplug into a separate function
  - Migration/urma:enable RCU expedited tuning for HCOM Protocol


author: Pengrui Zhang <zhangpengrui@huawei.com> - 9.10.0-31
changelog:
  - ub: ub device management infrastructure
  - ub: support get ub device list
  - ub: support delete missing ub devs
  - ub: add detailed code for prepare and bind driver code
  - ub: support ub dev bind to stub driver
  - ub: support get guidAddress from devNum
  - ub: more detailed code for bind and unbind driver code
  - ub: detailed code for reattach ub dev process
  - ub: check if hostdev ub is prepared
  - ub: check vfio-ub info when ub hostdev is configed
  - ub: switch fclose(FILE) to VIR_FORCE_FCLOSE(FILE)


author: Pengrui Zhang <zhangpengrui@huawei.com> - 9.10.0-33
changelog:
  - conf: Fix error message in virNetworkForwardDefParseXML
  - qemu: Fix guest-sync response time in qga command
  - virthreadpool: create threads from the newly expanded workers
  - qemu: Use g_autoptr in qemuProcessInit
  - qemu: Add kvm-vtimer-status support for AArch64 KVM guests


author: Pengrui Zhang <zhangpengrui@huawei.com> - 9.10.0-34
changelog:
  - qemu_driver: Don't handle the EOF event if vm get restarted
  - conf: add the hugepage allocation option
  - qemu: cgroup: Add /dev/ubmempfd to default device ACL


author: liyunfei <liyunfei33@huawei.com> - 19.1.7-11
changelog:
  - update to llvm-for-oE-19.1.7-2506.0.2
  - release note: https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-19.1.7-2506.0.2


author: liyunfei <liyunfei33@huawei.com> - 19.1.7-17
changelog:
  - update to llvm-for-oE-19.1.7-2512.0.1
  - release note: https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-19.1.7-2512.0.1


author: liyunfei <liyunfei33@huawei.com> - 19.1.7-19
changelog:
  - update to llvm-for-oE-19.1.7-2512.0.2
  - release note: https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-19.1.7-2512.0.2


author: eastb233 <xiezhiheng@huawei.com> - 20.1.8-8
changelog:
  - update to llvm-for-oE-20.1.8-2606.0.2
  - release note: https://atomgit.com/openeuler/llvm-project/releases/llvm-for-oE-20.1.8-2606.0.2


author: Qin Fandong <qinfandong@kylinos.cn> - 2.17.2-2
changelog:
  - Type:CVE
  - ID:CVE-2026-34481, CVE-2026-49844
  - SUG:NA
  - DESC:fix CVE-2026-34481 and CVE-2026-49844: serialize non-finite floating-point values as JSON strings


author: yuanchao <1050706328@qq.com> - 5.0.2-16
changelog:
  - Type: bugfix
  - ID:NA
  - SUG:NA
  - DESC: fix error of cc.compiles in meson.build on aarch cased by '-fstack-clash-protection' and '-Werror'


author: xiejing <xiejing@kylinos.cn> - 4:10.5.25-1
changelog:
  - Bump to 10.5.25 for resolving CVE-2024-21096
  - Fix version description in systemd service file
  - Add conflict with greatsql and change requires


author: Funda Wang <fundawang@yeah.net> - 20240813-1
changelog:
  - update to 20240813 for fix CVE-2024-24853, CVE-2024-25939,
    CVE-2024-24980, CVE-2023-42667, CVE-2023-49141


author: Funda Wang <fundawang@yeah.net> - 20250211-1
changelog:
  - update to 2025021 for fix CVE-2024-28047, CVE-2024-31157, CVE-2024-39279,
    CVE-2024-28127, CVE-2024-29214, CVE-2024-24582, CVE-2023-34440, CVE-2024-37020,
    CVE-2024-39355, CVE-2023-43758, CVE-2024-36293, CVE-2024-31068


author: Funda Wang <fundawang@yeah.net> - 20250512-1
changelog:
  - update to 20250512 to fix CVE-2024-28956, CVE-2025-24495, CVE-2025-20012,
    CVE-2024-45332, CVE-2025-20623, CVE-2024-43420, CVE-2025-20054, CVE-2025-20103


author: Funda Wang <fundawang@yeah.net> - 20250812-1
changelog:
  - update to 20250812 to fix CVE-2025-20053, CVE-2025-20109, CVE-2025-21090,
    CVE-2025-22839, CVE-2025-22840, CVE-2025-22889, CVE-2025-24305, CVE-2025-26403,
    CVE-2025-32086


author: yaoxin <1024769339@qq.com> - 2.4.16.6-1
changelog:
  - Update to 2.4.16.6:
    * metadata: fix caching of JWKs from jwks_uri when using the default expiry setting
    * info: fix requests to the info hook with extend_session=false
    * cookie: OIDCCookieSameSite default behaviour Lax
    * cookie: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
    * cache: avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory
      cannot be found on the system upon initaliizing cache mutexes and the file cache
    * metadata: allow plain HTTP URLs in metadata elements jwks_uri and signed_jwks_uri to ensure backwards
      compatibility with <=2.4.15.7 and to support private/test deployments
    * code: address warnings from static code analysis tool CodeChecker


author: Funda Wang <fundawang@yeah.net> - 102.9.0-9
changelog:
  - set CC and CXX so that clang won't be selected automatically
  - fix compilation errors in sw_64 support


author: yanglu <yanglu72@h-partners.com> - 2:0.95-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Change UDP and ICMP sockets binding to accept a source IP from the -a CLI option


author: zhangxingrong <zhangxingrong@uniontech.com> - 5:2.2.12-3
changelog:
  - Fix smtp client to respect $use_envelope_from option.
  - Fix smtp client $envelope_from_address possible dangling pointer.


author: Funda Wang <fundawang@yeah.net> - 5:2.2.12-4
changelog:
  - fix CVE-2026-43859, CVE-2026-43860, CVE-2026-43861, CVE-2026-43862,
    CVE-2026-43863, CVE-2026-43864


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: yaoxin <1024769339@qq.com> - 8.0.45-1
changelog:
  - Update to 8.0.45 for fix CVEs (CVE-2026-21936,CVE-2026-21937,
    CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968)


author: wangkai <13474090681@163.com> - 8.0.46-1
changelog:
  - Update to 8.0.46 for fix CVEs (CVE-2026-21998, CVE-2026-22001, CVE-2026-22002,
    CVE-2026-22004, CVE-2026-22005, CVE-2026-22009, CVE-2026-22015, CVE-2026-22017,
    CVE-2026-34267, CVE-2026-34270, CVE-2026-34271, CVE-2026-34276, CVE-2026-34278,
    CVE-2026-34293, CVE-2026-34303, CVE-2026-34304, CVE-2026-34308, CVE-2026-35236,
    CVE-2026-35237, CVE-2026-35238, CVE-2026-35239, CVE-2026-35240)


author: yaoxin <yao_xin001@hoperun.com> - 8.0-1
changelog:
  - Update to 8.0
    * CVE-2024-5742: Avoid privilege escalations via symlink attacks
      on emergency save file (boo#1226099)
    * By default ^F is bound to starting a forward search, and ^B to
      starting a backward search, while M-F and M-B repeat the search
      in the corresponding direction. (See the documentation if you
      want the old bindings back.)
    * Command-line option --modernbindings (-/) makes ^Q quit, ^X cut,
      ^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a file,
      ^R replace, ^G find again, ^D find again backwards, ^A set the mark,
      ^T jump to a line, ^P show the position, and ^E execute.
    * For easier access, M-" is bound to placing/removing an anchor,
      and M-' to jumping to the next anchor.


author: gaihuiying <eaglegai@163.com> - 1:5.9.3-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Customized the anti-attacki/reset-last_engineTime function for IdeaUI
         change the permissions of passtest


author: xingwei <xingwei14@h-partners.com> - 1:5.9.3-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Migration patch from upstream, add compatibility to parse
  Linux 6.7 Ip header while keep support for previous versions.


author: yaoxin <yao_xin001@hoperun.com> - 1:20.12.1-1
changelog:
  - Update to 20.12.1:
    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
      leads to HTTP/2 server crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 1:20.12.1-2
changelog:
  - fix building w/ clang: only apply '-fno-ipa-icf' for gcc && disable LTO for clang + ld.bfd
  - improve the handling of trilling whitespaces in C/CXXFLAGS


author: Ge Wang <wang__ge@126.com> - 1:20.12.1-3
changelog:
  - CVE-2023-45853 - Reject overflows of zip header fields in minizip
  - CVE-2024-5274 - Using FunctionParsingScope for parsing class static
  - CVE-2024-5535 - Fix SSL_select_next_proto
  - CVE-2024-7971 - Spill all loop inputs before entering loop


author: wangkai <13474090681@163.com> - 1:20.18.2-1
changelog:
  - Update to 20.18.2
  - Fix CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2024-36137
    CVE-2024-22018 CVE-2024-22020


author: wangkai <13474090681@163.com> - 1:20.18.2-5
changelog:
  - Fix CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,
    CVE-2025-59465, CVE-2025-59466, CVE-2026-21637


author: wangkai <13474090681@163.com> - 1:20.18.2-7
changelog:
  - Followup fix CVE-2026-21637 and fix CVE-2026-21710, CVE-2026-21713,
    CVE-2026-21714, CVE-2026-21715, CVE-2026-21716, CVE-2026-21717


author: wangkai <13474090681@163.com> - 2:2022.10.3-4
changelog:
  - Fix CVE-2026-42616, CVE-2026-42617, CVE-2026-42618, CVE-2026-46569,
    CVE-2026-46570, CVE-2026-46571, CVE-2026-46572, CVE-2026-56135, CVE-2026-56136


author: HelloZ <3161422489@qq.com> - 1.00.029-5
changelog:
  - Add patch 0001-support-DSCP-and-higher-version-gcc-compilation-opti.patch
  - support DSCP and higher version gcc compilation options


author: LHesperus <liuchanggeng@huawei.com> -v2.1.0-1
changelog:
  - remove the logger.h interface and add TRACE interface, increase safe_queue wait time to 5s
  - support reload log-level online
  - adapt analysis on riscv
  - add load base sched instance
  - v2.0.6-3 add adapt dynamicsmt analysis if smt is not enable
  - fix code check
  - add trace log and change level intf and delete logger
  - smc-d analysis fix inconsistency in the display of zero connection
  - v2.0.6-2 add realtime compile macro
  - v2.0.6-1 add smc_acc.yaml check and some logs
  - add net_hardirq_tune_data.h
  - fux binary coredump
  - v2.0.5-3 fix xcall analysis issues
  - v2.0.5-2 improve some output format
  - add xcall prefetch
  - network interface plugin : adapt same nic with different ifindex
  - v2.0.5-1 fix issues
  - v2.0.4-1 add docker coordination burst tune
  - add multi net path tune and analysis
  - add error log and params check
  - v2.0.3-3 oeaware-sdk enhances user permissions
  - v2.0.3-2 Fixed memory leak issues:
    - Fixed unsubscribeHandler topic deserialize memory leak
    - Fixed analysis module memory leak
  - Enhanced eBPF functionality:
    - Set memory lock limit to infinity for eBPF
    - Used eBPF to collect thread information
  - Network improvements:
    - Fixed ntoh port error
    - Added support for attaching all network interfaces
    - Used tcp-set-state to adapt k8s docker
  - New features:
    - Added xcall parameters
    - Added support for docker coordination burst analysis
    - Added parameter validation
    - Added NUMA parallel scheduler tuning support
  - Other improvements:
    - Fixed header files and added CI test
  - v2.0.3-1: Refactored and enhanced the analysis module:
    - Added scenario-aware analysis for multiple optimization plugins
    - Introduced command-line result viewing capability
    - Implemented Markdown format output support
  - Add new plugin: smt,binary,hirq


author: fly_1997 <flylove7@outlook.com> -v2.1.1-1
changelog:
  - add hwprobe_analysis for RISC-V
  - fix error logger info
  - support kernel cluster scheduler
  - adapt for kylin-v10-sp3
  - realtime tune add new tuning item
  - fix smc insmod err
  - realtime tune skip grubby update
  - add hwprobe_tune hwprobe_ext_zbb_tune for RISC-V
  - add high_load value check


author: xu_ping <707078654@qq.com> - 3.24.0-1
changelog:
  - Upgrade version to 3.24.0
    * Add support for FIPS-session mode
    * Updates to harden against RSA timing attacks
    * Add option to show the master key verification patterns of secure keys
    * Add support for exporting a key or certificate as URI-PEM file
    * Performance improvements for attribute retrieval
    * Add support for SHA-2 mechanisms
    * Experimental support for IBM Dilithium via OpenSSL OQS provider
    * Support live guest relocation for protected key (PKEY) operations
    * Add support for CKA_ALWAYS_AUTHENTICATE
    * Add support for CKD_*_SP800 KDFs for ECDH
    * Add support for SHA based key derivation mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms
    * Add support for building Opencryptoki on the IBM AIX platform
    * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
    * Add support for protecting tokens with a token specific user group
    * Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
    * Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later


author: zhang_wenyu <zhang_wenyu@hoperun.com> - 3.25.0-1
changelog:
  - Upgrade version to 3.25.0
    * Add support for PKCS#11 v3.0 SHAKE key derivation
    * Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
    * Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
    * Add support for CCA AES CIPHER secure key types
    * Add support for the CKM_ECDH1_DERIVE mechanism
    * Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
    * Add support for the CKM_RSA_AES_KEY_WRAP mechanism
    * Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
    * Add a tool for import and exporting PKCS#11 keys to a KMIP server
    * Add support for opaque secure key blob import via C_CreateObject
    * Add support for key wrapping with AES-GCM
    * Add support for newer CCA versions on s390x and non-s390x platforms
    * Add support for CKM_AES_GCM (single-part operations only)


author: Funda Wang <fundawang@yeah.net> - 0.23.0-7
changelog:
  - fix CVE-2024-8443, CVE-2024-45615, CVE-2024-45616,
    CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, CVE-2024-45620


author: zhangbinqin<zhangbinqin@h-partners.com> - 9.6p1-13
changelog:
  - Type:CVE
  - CVE:CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388 
  - SUG:NA
  - DESC:fix CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388


author: fly_fzc <2385803914@qq.com> - 1:3.0.12-32
changelog:
  - fix CVE-2025-15467,CVE-2025-69418,
        CVE-2025-69419,CVE-2025-69420,
        CVE-2025-69421,CVE-2026-22795,
        CVE-2026-22796


author: yixiangzhike <yixiangzhike007@163.com> - 1:3.0.12-52
changelog:
  - Type:CVE
  - CVE:CVE-2026-34180 CVE-2026-34182 CVE-2026-42766 CVE-2026-42767 CVE-2026-42770 CVE-2026-45447 CVE-2026-7383 CVE-2026-907
  - SUG:NA
  - DESC:fix CVE-2026-34180 CVE-2026-34182 CVE-2026-42766 CVE-2026-42767 CVE-2026-42770 CVE-2026-45447 CVE-2026-7383 CVE-2026-9076


author: wangkai <13474090681@163.com> - 2.6.9-8
changelog:
  - Fix CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
    CVE-2026-13117, CVE-2026-13122, CVE-2026-13698


author: Funda Wang <fundawang@yeah.net> - 4:5.38.0-11
changelog:
  - split out patch adding link to libperl.so into two separated patches,
    and sync it with mageia, which is a better version than fedora
  - disable cleaning empty perl directories
  - use git lfs storage


author: Funda Wang <fundawang@yeah.net> - 1:2.0209-4
changelog:
  - Type: CVE
  - ID: CVE-2026-8177
  - SUG: NA
  - DESC: fix CVE-2026-8177: replace domParseChar with xmlValidateName to prevent OOB UTF-8 read


author: shaojiansong <shaojiansong@kylinos.cn> - 3.5-5
changelog:
  - Drop seunshare -k/--kill support; the killall() helper is racy and redundant with killall -Z, replace the call site with an error message recommending killall -Z.


author: shenzhongwei <shenzhongwei@kylinos.cn> - 1.3.8b-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix: %patchN is deprecated (7 usages found), use %patch N (or %patch -P N)


author: wangkai <13474090681@163.com> - 1.3.9a-1
changelog:
  - Update to 1.3.9a for fix CVE-2026-42167
  - Add 'proxy' sub-package with unbundled mod_proxy
  - Use libsodium to provide ed25519 key support for mod_sftp
  - Update logrotate snippet to use try-reload-or-restart rather than reload
    for distributions with systemd 229 or later


author: dongyuzhen <dongyuzhen@h-partners.com> - 25.1-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: Funda Wang <fundawang@yeah.net> - 25.1-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: fix build with wrong permission
  - DESC: fix conflicts with protobuf2
  - DESC: revert:distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: yaoxin <1024769339@qq.com> - 3.1.52-1
changelog:
  - Update to 3.1.52 for fix CVEs: CVE-2026-67322, CVE-2026-67323,
    CVE-2026-67324, CVE-2026-67325 and CVE-2026-67326


author: lizhengde <lizhengde@xfusion.com> - 2.12.0-4
changelog:
  - Type:CVE
  - CVE:CVE-2026-11816
  - SUG:NA
  - DESC:Security fix: path traversal in archive extraction. Add base_dir parameter to _filter_safe_paths to properly validate extraction paths.


author: wangkai <13474090681@163.com> - 3.13.5-1
changelog:
  - Update to 3.13.5
    * Fix CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34516,
      CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525


author: yaoxin <1024769339@qq.com> - 3.14.1-1
changelog:
  - Update to 3.14.1 for fix CVEs: CVE-2026-54273,CVE-2026-54274,CVE-2026-54275
    CVE-2026-54276,CVE-2026-54277,CVE-2026-54278,CVE-2026-54279,CVE-2026-54280


author: Yu Peng <yupeng@kylinos.cn> - 1.4.0-1
changelog:
  - Upgrade to 1.4.0.
    Added decorator functionality to Signal as a convenient way to add a callback 
    Improved type safety by allowing callback parameters to be type checked


author: yaoxin <yao_xin001@hoperun.com> - 6.4.1-1
changelog:
  - Update to 6.4.1
    * Parsing of the ``Transfer-Encoding`` header is now stricter.
    * Handling of whitespace in headers now matches the RFC more closely.
    * ``tornado.curl_httpclient`` now prohibits carriage return and linefeed headers in HTTP headers
    (matching the behavior of ``simple_httpclient``).


author: lipengyu <lipengyu@kylinos.cn> - 3.11.6-20
changelog:
  - Type:CVE
  - CVE:CVE-2025-13836 CVE-2025-13837 CVE-2025-12084
  - SUG:NA
  - DESC:fix CVE-2025-13836 CVE-2025-13837 CVE-2025-12084


author: Qin Fandong <qinfandong@kylinos.cn> - 3.11.6-40
changelog:
  - Type:CVE
  - CVE:CVE-2026-6879
  - SUG:NA
  - DESC:fix CVE-2026-6879: avoid quadratic behavior in xml.etree.ElementPath index predicates


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 7.16.6-1
changelog:
  - Update package with version 7.16.6
    Prevent leading whitespace in markdown code blocks from being stripped
    Update base.tex.j2 for macro compatibility with newer versions of Pandoc
    Allow including text/x-rst outputs in rst conversion, transition away from text/restructuredtext
    Add support for mistune 3.1.0
    [HTMLExporter] Initialize resources before widget filtering
    Add a toggle to skip the svg encoding of images
    Support configureable width and height of reveal presentations
    Convert coalescese_streams function to CoalesceStreamsPreprocessor


author: openeuler_bot <infra@openeuler.sh> - 7.17.0-1
changelog:
  - Add support for arbitrary browser arguments (version:7.17.0).
  - Fix QtPNGExporter returning empty bytes on macOS (version:7.17.0).
  - Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) (version:7.17.0).
  - Drop support for Python 3.8, fix the CI tests (version:7.17.0).


author: YangengLiu <dev01202@linx-info.com> - 7.17.1-1
changelog:
  - update version to 7.17.1
    * Allow configureable WebPDF JavaScript processing timeout.
    * Fix when checking template paths on shared filesystems.
    * Tweak webpdf template logic to fix duplicate extension problem.


author: Funda Wang <fundawang@yeah.net> - 4.18.2-34
changelog:
  - disable automatic maintenance when autopatching with git
    https://github.com/git/git/commit/1942d48380fec53f76361e9adebef15b5db9628a
  - sync patches within branches


author: gaihuiying <eaglegai@163.com> - 1.17.1-15
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: gaihuiying <eaglegai@163.com> - 1.17.1-16
changelog:
  - Type:cves
  - CVE:CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960
  - SUG:NA
  - DESC:fix CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960


author: gaihuiying <eaglegai@163.com> - 1.17.1-17
changelog:
  - Type:cves
  - CVE:CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390,CVE-2026-44608
  - SUG:NA
  - DESC:fix CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390,CVE-2026-44608


author: gaihuiying <eaglegai@163.com> - 1.17.1-19
changelog:
  - Type:CVE
  - CVE:CVE-2026-46582,CVE-2026-40691,CVE-2026-42955,CVE-2026-44621,CVE-2026-44687,CVE-2026-44690,CVE-2026-50046,CVE-2026-50243,CVE-2026-50248,CVE-2026-50251,CVE-2026-55708,CVE-2026-55717,CVE-2026-55990,CVE-2026-56416
  - SUG:NA
  - DESC:fix CVE-2026-46582,CVE-2026-40691,CVE-2026-42955,CVE-2026-44621,CVE-2026-44687,CVE-2026-44690,CVE-2026-50046,CVE-2026-50243,CVE-2026-50248,CVE-2026-50251,CVE-2026-55708,CVE-2026-55717,CVE-2026-55990,CVE-2026-56416


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 1.26.18-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Prevent issue in HTTPResponse().read() when decoded_content is True and then False


author: zhangpengrui <zhangpengrui@huawei.com> 11:8.2.0-59
changelog:
  - vfio: Fix CSV3 mapping device mmio issue
  - util/cacheflush: Make first DSB unconditional on aarch64
  - block: Zero block driver state before reopening
  - target/arm: Correct STRD atomicity
  - qemu-img: Fix amend option parse error handling
  - qemu-img rebase: don't exceed IO_BUF_SIZE in one operation
  - aio-posix: keep polling enabled with fdmon-io_uring.c


author: zhangpengrui <zhangpengrui@huawei.com> 11:8.2.0-60
changelog:
  - qga: Fix truncated output handling in guest-exec status reporting
  - qga/installer: Remove QGA VSS if QGA installation failed
  - qga: Fix channel initialization check in run_agent_once
  - hw/rtc/goldfish: keep time offset when resetting
  - target/arm: Make DisasContext.{fp, sve}_access_checked tristate
  - net: parameterize the removing client from nc list
  - hid: fix incorrect return value for hid
  - util/qemu-timer.c: Don't warp timer from timerlist_rearm()
  - wdt_i6300esb: fix incorrect mask for interrupt type
  - target/arm: Correct LDRD atomicity and fault behaviour


author: zhangpengrui <zhangpengrui@huawei.com> 11:8.2.0-61
changelog:
  - tracetool: fix usage of try_import()
  - gtk: Skip drawing if console surface is NULL
  - vfio/iommufd: Fix SIGSEV in iommufd_cdev_attach()
  - qmp: update vhost-user protocol feature maps
  - hw/intc/arm_gicv3_its: Zero initialize local DTEntry etc structs
  - hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
  - replay: Improve assert in replay_char_read_all_load()
  - hw/scsi: Use error_setg_file_open() for a better error message
  - hw/virtio: Use error_setg_file_open() for a better error message
  - ui/vnc: Fix qemu abort when query vnc info


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-62
changelog:
  - iotests: Run iotests with sanitizers
  - tests/qemu-iotest: Add more image formats to the thorough testing
  - hw/intc: fix the issue of vNMI not supporting live migration
  - vfio/pci: VirtCCA adapt Ascend310P bar2 quirk.
  - vdpa:Set the vhostdev character of the VDPA device to the idstr assigned during migration
  - vdpa: Enable the ability of all VDPA devices to obtain backend config
  - hw/misc/psp.c: support live migrate for vpsp device
  - qga: ignore channel_init() fail if 'retry_path' is set
  - docs: fix typo in xive doc


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-63
changelog:
  - chardev/char-pty: Do not ignore chr_write() failures
  - hw/display/exynos4210_fimd: Remove duplicated definition
  - kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
  - hw/vfio/hct: fix ci check_code issues
  - hw/vfio/hct: support abort migration when hct exception
  - hw/vfio/hct: fix virtual machine paused due to obtain VQ failed.
  - hw/vfio/hct: support live migration function for virtual machines.
  - hw/vfio/hct: support vfio-pci multiple processes.
  - hw/vfio/hct: support start with ccp.ko driver
  - hw/vfio/hct: remove the operation of reading the value of mdev index in qemu.
  - hw/vfio/hct: fix ccp index error caused by uninitialized buf
  - hw/vfio/hct: compatible with hct.ko modules in versions 0.5 and earlier.
  - hw/vfio/hct: sharing CCP resources between host and virtual machines.
  - aio-posix: fix spurious return from ->wait() due to signals
  - tests/unit: skip test-nested-aio-poll with io_uring
  - tests/qemu-iotests/184: Fix skip message for qemu-img without throttle
  - target/arm/cpu64: remove duplicate include
  - cxl/cdat: Fix header sum value in CDAT checksum
  - hw/virtio: Fix packed virtqueue flush used_idx


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-64
changelog:
  - arm/cpu: fix werrors if CONFIG_USER_ONLY was set
  - crypto/hash-gcrypt: Correct undeclared parameter
  - config/targets: update aarch64_be-linux-user gdb XML list
  - ub: add more check for arry to prevent mem overrun
  - backends: fix node id out of range when set proportion
  - ub: check kvm_usi_via_irqfd when set kvm interrupt
  - ub: fix some mem leak in handle_enum_query_request
  - ub: remove unused param in enum_query_get_max_num_ports
  - ub: fix possible mem overrun in fill_rq
  - ub: do size check for alloc idev ers addr
  - ub: dma memory read wirte with memory flag
  - ub: ummu mcmdq null cmd fix mem leak and enhace safe
  - ub: limits ummu kvtbl max entries to 1024
  - ub: fix some mem leak
  - ub: correct ub cfg setting and values
  - ub: support different versions of the UMMU chips
  - ub: fix compiling error if target is not aarch64


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-65
changelog:
  - net: pad packets to minimum length in qemu_receive_packet() (CVE-2025-12464)
  - io: release active GSource in TLS channel finalizer
  - io: move websock resource release to close method
  - io: fix use after free in websocket handshake code(CVE-2025-11234)
  - ub: correct cfg write access


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-66
changelog:
  - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()(CVE-2026-0665)
  - hw/intc/loongarch_ipi_kvm: Fix the bug where the VM would crash when performing save or resume operations.
  - cxl/cdat: Handle cdat table build errors
  - hw/virtio: Fix the de-initialization of vhost-user devices
  - ub: fix memory leak in double pointer


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-69
changelog:
  - Migration/urma:reduce plflash update time
  - Migration/urma:avoid clearing remote dirty bitmap after migration completes
  - Migration/urma:add detailed downtime statistics for live migration
  - Migration/urma:support jfr post list mode over URMA
  - Migration/urma:move registration and unregistration ram to thread
  - Migration/urma:Fix VM crash due to packet loss during URMA-based memory migration
  - target/i386: csv: Enhance get/release logic for shared memory region of CSV3 VM
  - target/i386: csv: Remove all nodes within dma unmapping addr range
  - vfio/container: unregister csv3 mmio listener in vfio_disconnect_container()
  - system/physmem: Try to use 2M THP if CSV3 guest RAM backend is memfd
  - target/i386: csv: Support issuing the LAUNCH_FINISH_EX API with host-data for CSV3 guest
  - target/i386: csv: Introduce host-data=str option
  - arm/vfio: provide a vfio-platform device type that supports passthrough of mmcd(MAMI config device) into virtual machines.
  - Migration/urma:fix memory leak caused by hashmap in urma migration
  - bugfix: add PAS_EXPANSION config to support mmcd device
  - ub: fix ub ers map failed 
  - ub: fix vm reset core when config vfio-ub device


author: fanmingzhan <fanmingzhan@h-partners.com> - 11:8.2.0-70
changelog:
  - vfio: fix tpm test case, align the hignmem_platform_bus parameter, and modify the pas_expansion assignment


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-71
changelog:
  - Revert "target/arm/kvm-rme: Add DMA remapping for the shared memory region"
  - arm/kvm-rme: Add support for hisi-cca huge page mapping method
  - arm/kvm-rme: Add device assignment method for cca realm vm
  - arm/kvm-rme: fix qom definition and update KVM_EXIT_ARM_RME_DEV value


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-72
changelog:
  - ub: don't check ers addr size is power of 2
  - ub: support process msg code exch
  - ub: replace malloc with g_malloc0
  - Migration/urma:explicitly set URMA JFS tp_type to URMA_CTP
  - MAINTAINERS: add me as maintainer to virtio-snd
  - virtio-snd: remove TODO comments
  - virtio-snd: handle 5.14.6.2 for PCM_INFO properly(CVE-2026-3196)
  - virtio-snd: fix max_size bounds check in input cb(CVE-2026-3195)
  - virtio-snd: tighten read amount in in_cb(CVE-2026-3195)
  - hw/arm: Close unreleased out_fault_fd
  - pci: avoid the info qtree crash caused by arm-smmuv3-accel


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-73
changelog:
  - target/arm: add kunpeng 920 V1 support
  - target/arm: add kunpeng 950 V1 support
  - target/arm: add kunpeng 920 V2 support
  - hw/virtio/virtio-crypto: verify asym request size(CVE-2025-14876)
  - cryptodev-builtin: Limit the maximum size(CVE-2025-14876)
  - block/vmdk: fix OOB read in vmdk_read_extent()(CVE-2026-2243)
  - lsi53c895a: keep a reference to the device while SCRIPTS execute(CVE-2024-6519)


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-74
changelog:
  - virtio-blk: avoid using ioeventfd state in irqfd conditional
  - machine: Use error handling when CPU type is checked
  - hw/core/cpu: Update description of CPUState::node
  - hw/cpu/core: Cleanup unused included header in core.c
  - hw/cpu/cluster: Cleanup unused included header in cluster.c
  - hw/arm/bcm2836: Simplify use of reset-cbar property
  - hw/arm/bcm2836: Use ARM_CPU mp-affinity property
  - hw: Simplify accesses to the CPUState::start-powered-off property
  - hw/ppc/xive2_regs: Remove unnecessary cpu.h inclusion
  - hw/mips: Inline bios.h definitions
  - docs: use "buses" rather than "busses"
  - hw/ppc/spapr_cpu_core: Access QDev properties with proper API
  - hw/vfio: fix iteration over global VFIODevice list
  - vfio/iommufd: Remove the use of stat() to check file existence
  - vfio/container: Rename vfio_init_container to vfio_set_iommu
  - target/sparc: Simplify qemu_irq_ack
  - tests/avocado: add a simple i386 replay kernel test
  - tests/avocado: modernise the drive args for replay_linux
  - block: Fix crash when loading snapshot on inactive node
  - roms/efi: clean up edk2 build config
  - roms/efi: exclude efi shell from secure boot builds
  - Migration/urma:Avoid polling jfc timeouts resulting from hardware failures.
  - hyperv/syndbg: check length returned by cpu_physical_memory_map()(CVE-2026-3842)
  - ub: fix ers update error
  - kvm/arm/virt: Implement kvm-vtimer-status
  - hw/arm/virt: Implement timer early inject PV support
  - Migration/urma: replace ulseep with usleep in poll_jfc_wait


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-76
changelog:
  - target/arm: Conditionally add KVM writable properties based on RME
  - Migration/urma:adapt urma to use udma device to process iterative migration
  - Migration/urma: drop unused index in qemu_urma_init_ram_blocks
  - ub_ummu: default uninstall all tecte when cfgi all invalidate and free vdev when tecte uninstall
  - ub ummu: realize mapt_cmdq_ctxt_attr regster process
  - vfio ub: support config fd for vfio-ub device
  - hw/core/machine-smp: Deprecate unsupported "parameter=1" SMP configurations
  - hw/core/machine-smp: Calculate total CPUs once in machine_parse_smp_config()
  - hw/core/machine: Introduce the module as a CPU topology level
  - hw/core/machine: Support modules in -smp
  - hw/core: Introduce module-id as the topology subindex
  - hw/core: Support module-id in numa configuration
  - hw/i386: split x86.c in multiple parts
  - i386/cpu: Fix i/d-cache topology to core level for Intel CPU
  - i386/cpu: Use APIC ID info to encode cache topo in CPUID[4]
  - i386/cpu: Use APIC ID info get NumSharingCache for CPUID[0x8000001D].EAX[bits 25:14]
  - i386/cpu: Consolidate the use of topo_info in cpu_x86_cpuid()
  - i386/cpu: Introduce bitmap to cache available CPU topology levels
  - i386: Split topology types of CPUID[0x1F] from the definitions of CPUID[0xB]
  - i386/cpu: Decouple CPUID[0x1F] subleaf with specific topology level
  - i386: Introduce module level cpu topology to CPUX86State
  - i386: Support modules_per_die in X86CPUTopoInfo
  - i386: Expose module level in CPUID[0x1F]
  - i386: Support module_id in X86CPUTopoIDs
  - i386/cpu: Introduce module-id to X86CPU
  - tests: Add test case of APIC ID for module level parsing
  - hw/i386/pc: Support smp.modules for x86 PC machine
  - i386: Add cache topology info in CPUCacheInfo
  - i386/cpu: Use CPUCacheInfo.share_level to encode CPUID[4]
  - i386/cpu: Use CPUCacheInfo.share_level to encode CPUID[0x8000001D].EAX[bits 25:14]
  - i386: Add support for SUCCOR feature
  - i386/cpu: fixup number of addressable IDs for processor cores in the physical package
  - kvm: Allow kvm_arch_get/put_registers to accept Error**
  - i386/cpu: Don't enumerate the "invalid" CPU topology level
  - hw/core: Make CPU topology enumeration arch-agnostic
  - qapi/qom: Define cache enumeration and properties for machine
  - hw/core: Check smp cache topology support for machine
  - hw/core: Add a helper to check the cache topology level
  - hw/core/machine-smp: Initialize caches_bitmap before reading
  - hw/core/machine-smp: Fix error message parameter
  - i386/cpu: Extract a common fucntion to setup value of MSR_CORE_THREAD_COUNT
  - i386/cpu: Drop the variable smp_cores and smp_threads in x86_cpu_pre_plug()
  - i386/cpu: Drop cores_per_pkg in cpu_x86_cpuid()
  - i386/topology: Update the comment of x86_apicid_from_topo_ids()
  - i386/topology: Introduce helpers for various topology info of different level
  - target/i386/cpu: Consolidate the use of warn_report_once()
  - i386/cpu: Track a X86CPUTopoInfo directly in CPUX86State
  - i386/cpu: Hoist check of CPUID_EXT3_TOPOEXT against threads_per_core
  - cpu: Remove nr_cores from struct CPUState
  - i386/cpu: Set up CPUID_HT in x86_cpu_expand_features() instead of cpu_x86_cpuid()
  - i386/cpu: Set and track CPUID_EXT3_CMP_LEG in env->features[FEAT_8000_0001_ECX]
  - hw/core/machine: Reject thread level cache
  - i386/cpu: Support module level cache topology
  - i386/cpu: Update cache topology with machine's configuration
  - i386/pc: Support cache topology in -machine for PC machine
  - i386/cpu: add has_caches flag to check smp_cache configuration
  - i386/cpu: Introduce enable_cpuid_0x1f to force exposing CPUID 0x1f
  - i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check
  - i386/cpu: Rename enable_cpuid_0x1f to force_cpuid_0x1f
  - i386/cpu: Refine comment of CPUID2CacheDescriptorInfo
  - i386/cpu: Add descriptor 0x49 for CPUID 0x2 encoding
  - i386/cpu: Add default cache model for Intel CPUs with level < 4
  - i386/cpu: Present same cache model in CPUID 0x2 & 0x4
  - i386/cpu: Consolidate CPUID 0x4 leaf
  - i386/cpu: Drop CPUID 0x2 specific cache info in X86CPUState
  - i386/cpu: Add x-vendor-cpuid-only-v2 option for compatibility
  - i386/cpu: Mark CPUID[0x80000005] as reserved for Intel
  - i386/cpu: Rename AMD_ENC_ASSOC to X86_ENC_ASSOC
  - i386/cpu: Fix CPUID[0x80000006] for Intel CPU
  - i386/cpu: Add legacy_intel_cache_info cache model
  - i386/cpu: Add legacy_amd_cache_info cache model
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x2
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x4
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x80000005
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x80000006
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x8000001D
  - i386/cpu: Use a unified cache_info in X86CPUState
  - i386/cpu: Introduce cache model for SierraForest
  - i386/cpu: Introduce cache model for GraniteRapids
  - i386/cpu: Introduce cache model for SapphireRapids
  - i386/cpu: Add a "x-force-cpuid-0x1f" property
  - i386/cpu: Enable 0x1f leaf for SierraForest by default
  - i386/cpu: Enable 0x1f leaf for SierraForest by default
  - i386/cpu: Enable 0x1f leaf for GraniteRapids by default
  - i386/cpu: Enable 0x1f leaf for SapphireRapids by default
  - i386/cpu: Mark EBX/ECX/EDX in CPUID 0x80000000 leaf as reserved for Intel
  - i386/cpu: Mark CPUID 0x80000007[EBX] as reserved for Intel
  - i386/cpu: Mark CPUID 0x80000008 ECX bits[0:7] & [12:15] as reserved for Intel/Zhaoxin
  - i386/cpu: Reorder CPUID leaves in cpu_x86_cpuid()
  - i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX[23:16]
  - i386/cpu: Fix cpu number overflow in CPUID.01H.EBX[23:16]
  - i386/cpu: Honor maximum value for CPUID.8000001DH.EAX[25:14]
  - hw/core: allow parameter=1 for SMP topology on any machine
  - docs/deprecated: Remove undeprecated SMP description
  - i386/tcg: Make CPUID_HT and CPUID_EXT3_CMP_LEG supported
  - i386/hvf: Make CPUID_HT supported
  - target/i386/cpu: Move addressable ID encoding out of compat property in CPUID[0x1]
  - target/i386: add compatibility property for pdcm feature


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-77
changelog:
  - system/physmem: Fix possible double free when destroy cpu address space
  - Migration: add virtcca secure CVM live migration support
  - Migration: add virtcca secure CVM live migration support
  - virtcca migration: bugfix, meson option 'virtcca_migration' default value set to disabled
  - ub: update VFIO UB IRQ index enum definitions
  - ub: add VFIO_UB_REINIT_IRQ_INDEX for reinit interrupt support
  - ub: return error code to vm
  - ub: fix passthrough errno to vm
  - ub: reinit irq set failed don't stop vm
  - migration/cgs: fix some function name spell error
  - migration/cgs: Fix mismatched allocator in write_numa_info_to_sysfs
  - ub: fix fill_rq_cq not checking fill_cq return value
  - ub: fix ub cq depth
  - ub: pass ub feature to guest os
  - migration/cgs: bugfix, adding poison ignore CONFIG_VIRTCCA_MIGRATION when building non-aarch64 target to avoid error


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-78
changelog:
  - system/physmem: disable guest RAM core dump for cca
  - vhost: Remove unused log_fd variable in vhost_dev_log_resize()
  - i386/cpu: Allow cache to be shared at thread level
  - hw/vfio: Allow multiple vfio devices migration if none support P2P_MIGRATION


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-79
changelog:
  - virtio-gpu: fix overflow check when allocating 2d image (CVE-2026-3886)
  - ui/vnc: fix OOB read updating VNC update frequency stats(CVE-2026-48003)
  - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914)


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-81
changelog:
  - hw/net/rocker_of_dpa: Check group ID pointers are not NULL(CVE-2022-36648)
  - hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match()
  - ub_ummu: support CMD_TLBI_OS_ASID_U and CMD_TLBI_HYP_ASID_U command
  - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare(CVE-2026-5763)


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-82
changelog:
  - tcg: move free_tcg_plugin_context to the correct macro range
  - hw/arm/virt: Fix build error on ARM
  - virtio-blk: fix zone report buffer out-of-memory (CVE-2026-5761)
  - iotests/copy-before-write: lower throttle rate to fix cbw-timeout flakiness


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-83
changelog:
  - hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise() (CVE-2026-16043)
  - hw/9pfs: add xattr FID limit to prevent memory exhaustion (CVE-2026-8348)
  - ui/vnc: validate SetPixelFormat field ranges (CVE-2026-15578)
  - usbredir: fix use-after-free on buffered bulk packet overflow (CVE-2026-15705)
  - usbredir: fix infinite loop and SIGFPE with zero max_packet_size (CVE-2026-63319)
  - hw/9pfs: add response_buffer_size transport callback
  - 9pfs/virtio: implement response_buffer_size callback
  - 9pfs/xen: implement response_buffer_size callback
  - hw/9pfs: cap Treaddir allocation (CVE-2026-9238)
  - ui/vnc: fix OOB write in VNC stats array (CVE-2026-48002)
  - ui/vnc: fix OOB write in lossy rect worker code (CVE-2026-48002)
  - ui/vnc: fix OOB write in vnc_refresh_lossy_rect (CVE-2026-48002)
  - ui/vnc: fix out-of-bounds write in lossy refresh dirty marking (CVE-2026-61475)
  - ui/vnc: remove redundant rows computation
  - hw/9pfs: fix O_TRUNC bypass on read-only export (CVE-2026-63318)
  - ub: support UBUS-FIRMWARE version exchange function


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-84
changelog:
  - hw/arm/virt: add legacy_cpu_hotplug for virt-6.2 and older board
  - arm_gicv3: handle GICR propbaser correctly in cross-version migration


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-85
changelog:
  - ub: support --enable-ub/--disable-ub configure option and update unit tests with reference ACPI tables
  - ub:supprt call id service table
  - ub: update UBRT test reference table


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-86
changelog:
  - virtio-balloon: add host-initiated memory operation virtqueue
  - hw/block/pflash_cfi01: limit backing file size to 64MB and skip writes beyond 1MB on aarch64


author: lifeifei <lifeifei@kylinos.cn> - 2.19-3
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Add the socket option IPV6_MULTICAST_LOOP to prevent the interface from autoconfiguring using RA messages sent by itself.


author: wangkai <13474090681@163.com> - 7.2.7-1
changelog:
  - Update to 7.2.7
  - Fix CVE-2021-32626 CVE-2021-32627 CVE-2021-32762 CVE-2021-32675
    CVE-2021-41099 CVE-2021-32628 CVE-2021-32687 CVE-2022-24735
    CVE-2022-24736 CVE-2022-3647 CVE-2022-3734 CVE-2022-35977
    CVE-2023-25155 CVE-2024-46981


author: Funda Wang <fundawang@yeah.net> - 3.2.7-6
changelog:
  - fix CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087,
    CVE-2024-12088, CVE-2024-12747


author: jinlun<jinlun@huawei.com> - 40.7-1
changelog:
  - update version to 40.7
    - Allow chronyd-restricted read chronyd key files
    - Allow systemd-sleep set attributes of efivarfs files
    - Make name_zone_t and named_var_run_t a part of the mountpoint attribute
    - Update cifs interfaces to include fs_search_auto_mountpoints()
    - Allow map xserver_tmpfs_t files when xserver_clients_write_xshm is on
    - Add map_read map_write to kernel_prog_run_bpf
    - Add policy for nvme-stas
    - Make new virt drivers permissive
    - Allow named and ndc use the io_uring api
    - Allow sssd send SIGKILL to passket_child running in ipa_otpd_t


author: yueyuankun <yueyuankun@kylinos.cn> - 15.7-21
changelog:
  - spec: Remove debugsource requirement from debuginfo
  - Allow debuginfo to be installed alone without pulling in the debugsource package.


author: wjiang <app@cameyan.com> -15.7-22
changelog:
  - Backport bugfix patches from upstream
  - Fix build with binutils 2.46 (c4665d2)
  - Fix memory leak on TPM log error in mirror_one_mok_variable (92630f2)


author: xinghe <xingheyd@163.com> - 7:6.6-8
changelog:
  - Type:cves
  - ID:CVE-2026-33526 CVE-2026-33515 CVE-2026-32748
  - SUG:NA
  - DESC:fix CVE-2026-33526 CVE-2026-33515 CVE-2026-32748


author: wjiang <app@cameyan.com> - 255-52
changelog:
  - backport community patches and skip bios_version test:
        backport-login-user-runtime-dir-free-ignored-sd_bus_error-avo.patch
        backport-login-user-runtime-dir-use-STRLEN-where-appropriate.patch
        backport-systemctl-gracefully-adjust-bus-transport-and-runtim.patch
        backport-journal-do-not-rotate-journal-when-MaxRetentionSec-i.patch
        backport-nspawn-use-strv_extend-and-friends-to-build-director.patch
        backport-nspawn-only-remount-usr-with-idmap-when-volatile-yes.patch
        backport-nspawn-mount-var-after-remount_idmap-when-volatile-s.patch
        backport-compress-avoid-a-bunch-of-div-by-zeroes.patch


author: Linux_zhang <244695981@qq.com> - 255-53
changelog:
  - sync community patches
    backport-journal-use-EBADMSG-for-invalid-data-in-file-mmap.patch
    backport-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch


author: wulinfeng <wulinfeng@xfusion.com> - 255-55
changelog:
  - fix coredump generation when systemd-resolved and systemd-networkd service is started then uninstalled


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


author: yaoxin <1024769339@qq.com> - 1:9.0.119-1
changelog:
  - Update to 9.0.119 for fix CVEs: CVE-2026-50229, CVE-2026-53404,
    CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956,
    CVE-2026-55957


author: langfei <langfei@huawei.com> - 2024a-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Aysén Region moves from -04/-03 to -03; new zone;
  -	Improve recent commentary for Chilean decrees;
  -	No need for America/Coyhaique in zonenow.tab.


author: Liu Chao <liuchao173@huawei.com> - 2024a-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Moldova has used EU transition times since 2022
  	Most of BC moves from PDT to Pacific Time on 03-09
  	Delay America/Vancouver tm_isdst transition


author: yaoxin <1024769339@qq.com> - 0.9.9-1
changelog:
  - Update to 0.9.9:
    * Changed: Require CMake >=3.10.0
    * Fixed: Dissolve undefined behavior in parsing of URIs
    * Fixed: Normalized percent-encoded octets should have uppercase letters
      in the host
    * Fixed: Fix macros URI_VER_SUFFIX_UNICODE and URI_VER_UNICODE
    * Improved: CMake: Compile with -std=c90 by default
    * Improved: Convert remaining DOS (CR/LF) newlines to Unix newlines


author: herengui <herengui@kylinsec.com.cn> - 7.4.3-5
changelog:
  - Fix CVE-2026-34475: Fix http/1.1 absolute form dissection edge case leading to cache poisoning or authentication bypass


author: chenyanpan <chenyanpan@xfusion.com> - 1.21.4-4
changelog:
  - Fix CVE-2026-15146
  - Fix CVE-2026-58469
  - Fix CVE-2026-58470
  - Fix CVE-2026-58471
  - Fix CVE-2026-58472


author: Witty Team <intelligence@openeuler.org> - 3.0.0-1
changelog:
  - Rename source package to euler-copilot-shell; binary subpackage is witty
  - Provides/Obsoletes euler-copilot-shell and witty-assistant for upgrade from 1.x/2.x
  - Vendor + Go toolchain bundling; static build with CGO_ENABLED=0, GOAMD64=v1


author: Witty Team <intelligence@openeuler.org> - 3.1.0-1
changelog:
  - Add witty-builtin-agent subpackage with built-in agent, skills, and MCP config
  - Ship Role Prompt and config.d fragment for Witty Assistant as default agent (mode=primary)
  - Download 5 SkillHub skills (manpage-skill, log-anomaly-detector, html-report-generator,
    brainstorm-beagle, plantuml-skill) at build time via prepare-release.sh
  - witty now Requires witty-builtin-agent for out-of-the-box agent experience
  - Skill versions centralized in skill-versions.sh, spec Sources use real URLs for CI


author: Witty Team <intelligence@openeuler.org> - 3.1.1-1
changelog:
  - feat: Prompt for provider API key interactively on TTY
  - fix: Make permission handling synchronous to prevent terminal desync
  - refactor: permission display with multi-line title support
  - fix: Change QuestionInfo.Custom from bool to *bool with helper method
  - fix: Refine shell command routing with precise NL detection and Bash generation
  - chore: Adjust builtin agent permissions for read, external directory, and bash
  - chore: Widen witty-builtin-agent permissions and refine prompt
  - chore: Allow witty dirs and experience-skill by default


author: Witty Team <intelligence@openeuler.org> - 3.1.2-1
changelog:
  - fix: Refactor doctor to treat not-running server as OK, remove agent-packages check
  - fix: Move /new force-next detection into dispatch
  - chore: Allow context, websearch, and grep MCPs in builtin agent
  - chore: Extract dev setup dependencies into a shared script
  - chore: Add Go PATH to profile for all setup scripts
  - chore: Clean old release artifacts before building


author: Witty Team <intelligence@openeuler.org> - 3.1.3-1
changelog:
  - feat: Handle session.error events from opencode
  - fix: add bare /session command help in REPL
  - feat(shellbridge): route bare /session to session usage help
  - docs: clarify shell routing, session list, and server status behavior
  - docs: Add comprehensive usage documentation for Witty CLI
  - feat: Stream reasoning echo in EchoRenderer


author: Witty Team <intelligence@openeuler.org> - 3.1.4-1
changelog:
  - fix: timeout when ask receives no events from server
  - fix: guard loader filetriggerpostun during loader removal


author: Witty Team <intelligence@openeuler.org> - 3.1.5-1
changelog:
  - fix(wittyd): read /etc/witty/daemon.toml for socket path, idle timeout and config watch paths
  - fix(wittyd): create /run/wittyd and /var/lib/witty via RuntimeDirectory/StateDirectory to fix systemd startup on clean systems


author: openEuler <contact@openeuler.org> - 0.10.2-2
changelog:
  - Add internationalization support (currently supports English and Simplified Chinese)
  - Fix issue where settings page may reopen multiple times


author: openEuler <contact@openeuler.org> - 0.10.2-4
changelog:
  - Fix timeout when executing complex MCP tasks
  - Feature: Add login through browser (requires proper desktop environment)


author: openEuler <contact@openeuler.org> - 0.10.2-6
changelog:
  - installer: Add support for package name and alternative package name formats
  - cli: Fix TUI keyboard interaction issue in some environments


author: openEuler <contact@openeuler.org> - 2.0.0-3
changelog:
  - feat: Add Witty Assistant welcome screen & LOGO
  - refactor: Improve Markdown rendering performance in TUI


author: openEuler <contact@openeuler.org> - 2.0.1-1
changelog:
  - feat: Set defautl chat model during installation
  - feat: Add shell completion installation command
  - fix: Markdown rendering issue in TUI
  - chore: Remove deprecated scripts in installer


author: openEuler <contact@openeuler.org> - 2.0.2-1
changelog:
  - feat: Add option to launch OpenCode through Witty Assistant
  - installer: Install OpenCode-AI during deployment


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: Wang Kui <wangkui35@h-partners.com> - 1.20.11-41
changelog:
  - Fix CVE-2025-49176 CVE-2025-49179 CVE-2025-49180 CVE-2022-49737
    CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-42
changelog:
  - fix CVE-2022-49737 CVE-2025-49175 CVE-2025-49176 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-45
changelog:
  - fix CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264


author: xu_ping <707078654@qq.com> - 0.2.44-2
changelog:
  - Remove redundant fc-cache scriptlets, fontconfig provides global %transfiletrigger 
    to refresh font cache automatically


