# changelog

author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.19.1.0.1.el10_0.OL10]
changelog:
  - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650]
  - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
  - Disable UKI signing [Orabug: 36571828]
  - Update Oracle Linux certificates (Kevin Lyons)
  - Disable signing for aarch64 (Ilya Okomin)
  - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
  - Update x509.genkey [Orabug: 24817676]
  - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
  - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
  - Add Oracle Linux IMA certificates
  - Update module name for cryptographic module [Orabug: 37400433]


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.20.1.el10_0]
changelog:
  - Bump internal version to 55.20.1
  - Adjust page_pool: Track DMA-mapped pages and unmap them when destroying the pool
  - Adjust dm mpath: Interface for explicit probing of active paths
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes - CVE-2025-21991
  - page_pool: Track DMA-mapped pages and unmap them when destroying the pool
  - page_pool: Move pp_magic check into helper functions
  - scsi: storvsc: Explicitly set max_segment_size to UINT_MAX
  - vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp - CVE-2025-37799
  - dm mpath: replace spin_lock_irqsave with spin_lock_irq
  - dm-mpath: Don't grab work_mutex while probing paths
  - dm mpath: Interface for explicit probing of active paths
  - dm: Allow .prepare_ioctl to handle ioctls directly
  - ipv6: mcast: extend RCU protection in igmp6_send() - CVE-2025-21759


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.21.1.el10_0]
changelog:
  - Bump internal version to 55.21.1
  - ice, irdma: fix an off by one in error handling code
  - irdma: free iwdev->rf after removing MSI-X
  - ice: Fix signedness bug in ice_init_interrupt_scheme()
  - ice: init flow director before RDMA
  - ice: simplify VF MSI-X managing
  - ice: enable_rdma devlink param
  - ice: treat dyn_allowed only as suggestion
  - ice, irdma: move interrupts code to irdma
  - ice: get rid of num_lan_msix field
  - ice: remove splitting MSI-X between features
  - ice: devlink PF MSI-X max and min parameter
  - ice: ice_probe: init ice_adapter after HW init
  - ice: minor: rename goto labels from err to unroll
  - ice: split ice_init_hw() out from ice_init_dev()
  - ice: c827: move wait for FW to ice_init_hw()
  - exfat: fix random stack corruption after get_block - CVE-2025-22036


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.22.1.el10_0]
changelog:
  - Bump internal version to 55.22.1
  - mm/huge_memory: fix dereferencing invalid pmd migration entry - CVE-2025-37958
  - i2c: tegra: check msg length in SMBUS block read
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error - CVE-2025-38089
  - media: uvcvideo: Announce the user our deprecation intentions
  - media: uvcvideo: Allow changing noparam on the fly
  - media: uvcvideo: Invert default value for nodrop module param
  - media: uvcvideo: Propagate buf->error to userspace
  - media: uvcvideo: Flush the control cache when we get an event
  - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set
  - media: uvcvideo: Remove dangling pointers - CVE-2024-58002
  - media: uvcvideo: Remove redundant NULL assignment
  - media: uvcvideo: Only save async fh if success
  - media: uvcvideo: Fix double free in error path - CVE-2024-57980
  - wifi: iwlwifi: limit printed string from FW file - CVE-2025-21905


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.24.1.el10_0]
changelog:
  - Bump internal version to 55.24.1
  - net_sched: hfsc: Fix a UAF vulnerability in class handling - CVE-2025-37797
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() - CVE-2025-22121
  - ext4: introduce ITAIL helper - CVE-2025-22121
  - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access - CVE-2025-38110
  - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() - CVE-2025-38088
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap - CVE-2025-38088
  - net/mlx5: Fill out devlink dev info only for PFs
  - RDMA/mlx5: Fix page_size variable overflow - CVE-2025-22091
  - ACPI: CPPC: Fix _CPC register setting issue


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.25.1.el10_0]
changelog:
  - Bump internal version to 55.25.1
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice - CVE-2025-38001
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() - CVE-2025-38000
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc - CVE-2025-37890
  - sch_hfsc: make hfsc_qlen_notify() idempotent
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem - CVE-2025-38022
  - RDMA/core: Fix use-after-free when rename device name - CVE-2025-22085
  - nvme-tcp: sanitize request list handling - CVE-2025-38264
  - net: tipc: fix refcount warning in tipc_aead_encrypt
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done - CVE-2025-38052
  - tcp: adjust rcvq_space after updating scaling ratio
  - ext4: avoid journaling sb update on error if journal is destroying - CVE-2025-22113
  - ext4: define ext4_journal_destroy wrapper - CVE-2025-22113
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() - CVE-2025-21928
  - HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() - CVE-2025-21929
  - usb: hub: Fix flushing of delayed work used for post resume purposes
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
  - net/sched: fix use-after-free in taprio_dev_notifier - CVE-2025-38087
  - net: ch9200: fix uninitialised access during mii_nway_restart - CVE-2025-38086
  - padata: avoid UAF for reorder_work - CVE-2025-21726
  - padata: fix UAF in padata_reorder - CVE-2025-21727
  - padata: add pd get/put refcnt helper
  - padata: fix sysfs store callback check
  - padata: Clean up in padata_do_multithreaded()
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove -CVE-2025-22020


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.27.1.el10_0]
changelog:
  - Bump internal version to 55.27.1
  - Fix includes for mm: fix copy_vma() error handling for hugetlb mappings
  - Revert sch_htb: make htb_qlen_notify() idempotent
  - Revert sch_drr: make drr_qlen_notify() idempotent
  - Revert sch_qfq: make qfq_qlen_notify() idempotent
  - Revert codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  - Revert sch_htb: make htb_deactivate() idempotent
  - Revert net/sched: Always pass notifications when child class becomes empty
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds - CVE-2025-38159
  - Documentation: Fix pci=config_acs= example
  - PCI/ACS: Fix 'pci=config_acs=' parameter
  - Revert "smb: client: fix TCP timers deadlock after rmmod" - CVE-2025-22077
  - Revert smb: client: Fix netns refcount imbalance causing leaks and use-after-free 
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free
  - wifi: ath12k: fix invalid access to memory - CVE-2025-38292
  - x86/CPU/AMD: Terminate the erratum_1386_microcode array - CVE-2024-56721
  - crypto: algif_hash - fix double free in hash_accept - CVE-2025-38079
  - net/sched: Always pass notifications when child class becomes empty - CVE-2025-38350
  - sch_htb: make htb_deactivate() idempotent - CVE-2025-38350
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() - CVE-2025-38350
  - sch_qfq: make qfq_qlen_notify() idempotent - CVE-2025-38350
  - sch_drr: make drr_qlen_notify() idempotent - CVE-2025-38350
  - sch_htb: make htb_qlen_notify() idempotent - CVE-2025-38350
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race - CVE-2025-38085
  - mm/hugetlb: unshare page tables during VMA split, not before - CVE-2025-38084
  - tools/testing/vma: add missing function stub
  - mm: fix copy_vma() error handling for hugetlb mappings
  - PCI: Use downstream bridges for distributing resources
  - PCI/pwrctrl: Cancel outstanding rescan work when unregistering - CVE-2025-38137
  - bnxt_en: Skip MAC loopback selftest if it is unsupported by FW
  - bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.28.1.el10_0]
changelog:
  - Conflict with xdp-tools < 1.5.4
  - Bump internal version to 55.28.1
  - tls: always refresh the queue when reading sock - CVE-2025-38471
  - selftests: net: bpf_offload: add 'libbpf_global' to ignored maps
  - selftests: net: fix error message in bpf_offload
  - selftests: net: add more info to error in bpf_offload
  - net: fix udp gso skb_segment after pull from frag_list - CVE-2025-38124
  - powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
  - s390/pci: Serialize device addition and removal
  - s390/pci: Allow re-add of a reserved but not yet removed device
  - s390/pci: Prevent self deletion in disable_slot()
  - s390/pci: Remove redundant bus removal and disable from zpci_release_device()
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs
  - s390/pci: Fix missing check for zpci_create_device() error return
  - s390/pci: Fix potential double remove of hotplug slot
  - s390/topology: Improve topology detection
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - CVE-2025-38250
  - selftests/bpf: Adjust data size to have ETH_HLEN - CVE-2025-21867
  - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() - CVE-2025-21867
  - i2c/designware: Fix an initialization issue - CVE-2025-38380


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.29.1.el10_0]
changelog:
  - Bump internal version to 55.29.1
  - ice: fix eswitch code memory leak in reset scenario - CVE-2025-38417
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - net_sched: ets: Fix double list add in class with netem as child qdisc - CVE-2025-37914
  - sch_ets: make est_qlen_notify() idempotent
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw - CVE-2025-38200
  - cxgb4: use port number to set mac addr


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.30.1.el10_0]
changelog:
  - tipc: Fix use-after-free in tipc_conn_close(). - CVE-2025-38464
  - Bump internal version to 55.30.1
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too - CVE-2025-37823
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs
  - s390/pci: Fix handling of isolated VFs
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
  - s390/pci: Fix SR-IOV for PFs initially in standby
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction - CVE-2025-38211
  - udp: Fix memory accounting leak. - CVE-2025-22058
  - udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
  - ext4: only dirty folios when data journaling regular files - CVE-2025-38220
  - vsock: Fix transport_* TOCTOU - CVE-2025-38461
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - CVE-2025-38472


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.31.1.el10_0]
changelog:
  - Adjust sched/fair: Adhere to place_entity() constraints
  - Bump internal version to 55.31.1
  - sched/fair: Adhere to place_entity() constraints
  - sched/fair: Fix update_cfs_group() vs DELAY_DEQUEUE
  - sched/fair: Fix EEVDF entity placement bug causing scheduling lag
  - sched/fair: optimize the PLACE_LAG when se->vlag is zero
  - net/sched: ets: use old 'nbands' while purging unused classes - CVE-2025-38350
  - net/sched: Always pass notifications when child class becomes empty - CVE-2025-38350
  - net_sched: ets: fix a race in ets_qdisc_change() - CVE-2025-38107
  - sch_htb: make htb_deactivate() idempotent - CVE-2025-37953
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() - CVE-2025-37798
  - sch_qfq: make qfq_qlen_notify() idempotent - CVE-2025-38350
  - sch_drr: make drr_qlen_notify() idempotent - CVE-2025-38350
  - sch_htb: make htb_qlen_notify() idempotent - CVE-2025-37932
  - drm/vkms: Fix use after free and double free on init error - CVE-2025-22097
  - Revert "cxl/acpi: Fix load failures due to single window creation failure"
  - udmabuf: fix a buf size overflow issue during udmabuf creation - CVE-2025-37803
  - drm/framebuffer: Acquire internal references on GEM handles - CVE-2025-38449
  - drm/gem: Acquire references on GEM handles for framebuffers - CVE-2025-38449
  - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer
  - nvme-ioctl: fix leaked requests on mapping error


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.32.1.el10_0]
changelog:
  - Bump internal version to 55.32.1
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() - CVE-2025-38352


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.33.1.el10_0]
changelog:
  - Fix kABI for net_namespace.h
  - Bump internal version to 55.33.1
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface - CVE-2025-38500
  - idpf: convert control queue mutex to a spinlock - CVE-2025-38392
  - eth: bnxt: fix missing ring index trim on error path - CVE-2025-37873
  - tcp: Correct signedness in skb remaining space calculation - CVE-2025-38463
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - CVE-2025-38550
  - redhat: selftests/bpf: Add cpuv4 variant
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards - CVE-2025-38200
  - use uniform permission checks for all mount propagation changes - CVE-2025-38498
  - do_change_type(): refuse to operate on unmounted/not ours mounts - CVE-2025-38498
  - ublk: make sure ubq->canceling is set when queue is frozen - CVE-2025-22068
  - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
  - scsi: lpfc: Use memcpy() for BIOS version - CVE-2025-38332
  - net: introduce per netns packet chains


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.34.1.el10_0]
changelog:
  - Bump internal version to 55.34.1
  - sunrpc: fix handling of server side tls alerts - CVE-2025-38566
  - i40e: When removing VF MAC filters, only check PF-set MAC
  - usb: dwc3: gadget: check that event count does not exceed event buffer length - CVE-2025-37810


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.37.1.el10_0]
changelog:
  - fix kABI build errors
  - Adjust new tls selftest for current code
  - Bump internal version to 55.37.1
  - selftests: tls: add tests for zero-length records - CVE-2025-39682
  - tls: fix handling of zero-length records on the rx_list - CVE-2025-39682
  - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass - CVE-2025-38396
  - io_uring/futex: ensure io_futex_wait() cleans up properly on failure - CVE-2025-39698
  - ice: use fixed adapter index for E825C embedded devices
  - ice: use DSN instead of PCI BDF for ice_adapter index
  - tcp: drop secpath at the same time as we currently drop dst
  - cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code
  - cifs: Fix the smbd_response slab to allow usercopy - CVE-2025-38523
  - smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data
  - smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
  - smb: client: make use of common smbdirect_socket_parameters
  - smb: smbdirect: introduce smbdirect_socket_parameters
  - smb: client: make use of common smbdirect_socket
  - smb: smbdirect: add smbdirect_socket.h
  - smb: client: make use of common smbdirect.h
  - smb: smbdirect: add smbdirect.h with public structures
  - smb: client: make use of common smbdirect_pdu.h
  - smb: smbdirect: add smbdirect_pdu.h with protocol definitions
  - s390/sclp: Fix SCCB present check - CVE-2025-39694
  - net: stmmac: fix TSO DMA API usage causing oops
  - smb: client: fix use-after-free in cifs_oplock_break - CVE-2025-38527


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.30.1.el10_0]
changelog:
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-107641] {CVE-2025-37823}
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-95537]
  - s390/pci: Fix handling of isolated VFs (CKI Backport Bot) [RHEL-84462]
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (CKI Backport Bot) [RHEL-84462]
  - s390/pci: Fix SR-IOV for PFs initially in standby (CKI Backport Bot) [RHEL-84462]
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CKI Backport Bot) [RHEL-104285] {CVE-2025-38211}
  - udp: Fix memory accounting leak. (CKI Backport Bot) [RHEL-104102] {CVE-2025-22058}
  - udp: Fix multiple wraparounds of sk->sk_rmem_alloc. (Xin Long) [RHEL-104102]
  - ext4: only dirty folios when data journaling regular files (CKI Backport Bot) [RHEL-106815] {CVE-2025-38220}
  - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106660] {CVE-2025-38464}
  - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-106015] {CVE-2025-38461}
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CKI Backport Bot) [RHEL-106442] {CVE-2025-38472}


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.31.1.el10_0]
changelog:
  - sched/fair: Adhere to place_entity() constraints (Phil Auld) [RHEL-91404]
  - sched/fair: Fix update_cfs_group() vs DELAY_DEQUEUE (Phil Auld) [RHEL-91404]
  - sched/fair: Fix EEVDF entity placement bug causing scheduling lag (Phil Auld) [RHEL-91404]
  - sched/fair: optimize the PLACE_LAG when se->vlag is zero (Phil Auld) [RHEL-91404]
  - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107544] {CVE-2025-38350}
  - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93365] {CVE-2025-38350}
  - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107544] {CVE-2025-38107}
  - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93365] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-37932}
  - drm/vkms: Fix use after free and double free on init error (Jocelyn Falempe) [RHEL-99432] {CVE-2025-22097}
  - Revert "cxl/acpi: Fix load failures due to single window creation failure" (John W. Linville) [RHEL-85055]
  - udmabuf: fix a buf size overflow issue during udmabuf creation (Lyude Paul) [RHEL-99760] {CVE-2025-37803}
  - drm/framebuffer: Acquire internal references on GEM handles (Mika Penttilä) [RHEL-106710] {CVE-2025-38449}
  - drm/gem: Acquire references on GEM handles for framebuffers (Mika Penttilä) [RHEL-106710] {CVE-2025-38449}
  - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Maurizio Lombardi) [RHEL-109753]
  - nvme-ioctl: fix leaked requests on mapping error (Maurizio Lombardi) [RHEL-109753]


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.32.1.el10_0]
changelog:
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport Bot) [RHEL-112784] {CVE-2025-38352}


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.33.1.el10_0]
changelog:
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CKI Backport Bot) [RHEL-109530] {CVE-2025-38500}
  - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106061] {CVE-2025-38392}
  - eth: bnxt: fix missing ring index trim on error path (CKI Backport Bot) [RHEL-104564] {CVE-2025-37873}
  - tcp: Correct signedness in skb remaining space calculation (CKI Backport Bot) [RHEL-107844] {CVE-2025-38463}
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CKI Backport Bot) [RHEL-111154] {CVE-2025-38550}
  - redhat: selftests/bpf: Add cpuv4 variant (Viktor Malik) [RHEL-109928]
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen) [RHEL-105138] {CVE-2025-38200}
  - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107306] {CVE-2025-38498}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107306] {CVE-2025-38498}
  - ublk: make sure ubq->canceling is set when queue is frozen (Ming Lei) [RHEL-99437] {CVE-2025-22068}
  - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM JIRA: https://issues.redhat.com/browse/RHEL-109821 Y-JIRA: https://issues.redhat.com/browse/RHEL-79173 (Jakub Ramaseuski)
  - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105936] {CVE-2025-38332}
  - net: introduce per netns packet chains (Paolo Abeni) [RHEL-88923]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.34.1.el10_0]
changelog:
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [RHEL-111073] {CVE-2025-38566}
  - i40e: When removing VF MAC filters, only check PF-set MAC (CKI Backport Bot) [RHEL-109771]
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (CKI Backport Bot) [RHEL-107659] {CVE-2025-37810}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.35.1.el10_0]
changelog:
  - cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (Paulo Alcantara) [RHEL-111177]
  - cifs: Fix the smbd_response slab to allow usercopy (Paulo Alcantara) [RHEL-111177] {CVE-2025-38523}
  - smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Paulo Alcantara) [RHEL-111177]
  - smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Paulo Alcantara) [RHEL-111177]
  - smb: client: make use of common smbdirect_socket_parameters (Paulo Alcantara) [RHEL-111177]
  - smb: smbdirect: introduce smbdirect_socket_parameters (Paulo Alcantara) [RHEL-111177]
  - smb: client: make use of common smbdirect_socket (Paulo Alcantara) [RHEL-111177]
  - smb: smbdirect: add smbdirect_socket.h (Paulo Alcantara) [RHEL-111177]
  - smb: client: make use of common smbdirect.h (Paulo Alcantara) [RHEL-111177]
  - smb: smbdirect: add smbdirect.h with public structures (Paulo Alcantara) [RHEL-111177]
  - smb: client: make use of common smbdirect_pdu.h (Paulo Alcantara) [RHEL-111177]
  - smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Paulo Alcantara) [RHEL-111177]
  - s390/sclp: Fix SCCB present check (CKI Backport Bot) [RHEL-113561] {CVE-2025-39694}
  - net: stmmac: fix TSO DMA API usage causing oops (Izabela Bakollari) [RHEL-105352]
  - smb: client: fix use-after-free in cifs_oplock_break (CKI Backport Bot) [RHEL-111198] {CVE-2025-38527}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.36.1.el10_0]
changelog:
  - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CKI Backport Bot) [RHEL-114341] {CVE-2025-39698}
  - ice: use fixed adapter index for E825C embedded devices (CKI Backport Bot) [RHEL-111792]
  - ice: use DSN instead of PCI BDF for ice_adapter index (CKI Backport Bot) [RHEL-111792]
  - tcp: drop secpath at the same time as we currently drop dst (Sabrina Dubroca) [RHEL-82133]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.37.1.el10_0]
changelog:
  - selftests: tls: add tests for zero-length records (Sabrina Dubroca) [RHEL-114331] {CVE-2025-39682}
  - tls: fix handling of zero-length records on the rx_list (Sabrina Dubroca) [RHEL-114331] {CVE-2025-39682}
  - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Audra Mitchell) [RHEL-110313] {CVE-2025-38396}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.38.1.el10_0]
changelog:
  - hv_netvsc: Fix panic during namespace deletion with VF (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-114930]
  - net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-114930]
  - net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-114930]
  - net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-114930]
  - net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-114930]
  - net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-114930]
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Maxim Levitsky) [RHEL-114930]
  - net: mana: Record doorbell physical address in PF mode (Maxim Levitsky) [RHEL-114930]
  - net: mana: Add support for Multi Vports on Bare metal (Maxim Levitsky) [RHEL-114930]
  - net: mana: Switch to page pool for jumbo frames (Maxim Levitsky) [RHEL-114930]
  - net: mana: Add metadata support for xdp mode (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Handle net event for pointing to the current netdev (Maxim Levitsky) [RHEL-114930]
  - net: mana: Change the function signature of mana_get_primary_netdev_rcu (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Ensure variable err is initialized (Maxim Levitsky) [RHEL-114930]
  - net: mana: Add debug logs in MANA network driver (Maxim Levitsky) [RHEL-114930]
  - hv_netvsc: Use VF's tso_max_size value when data path is VF (Maxim Levitsky) [RHEL-114930]
  - net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: request error CQEs when supported (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Query feature_flags bitmask from FW (Maxim Levitsky) [RHEL-114930]
  - net: mana: Support holes in device list reply msg (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Allocate PAGE aligned doorbell index (Maxim Levitsky) [RHEL-114930]
  - hv_netvsc: Link queues to NAPIs (Maxim Levitsky) [RHEL-114930]
  - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113339] {CVE-2025-38718}
  - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-93626] {CVE-2025-22026}
  - smb: client: fix session setup against servers that require SPN (Paulo Alcantara) [RHEL-107110]
  - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-107110]
  - RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event (CKI Backport Bot) [RHEL-100817]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.39.1.el10_0]
changelog:
  - wifi: ath12k: Decrement TID on RX peer frag setup error handling (CKI Backport Bot) [RHEL-114712] {CVE-2025-39761}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CKI Backport Bot) [RHEL-114695] {CVE-2025-38729}
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (CKI Backport Bot) [RHEL-114695]
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114695] {CVE-2025-39757}
  - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111037] {CVE-2025-38556}
  - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111037] {CVE-2025-38556}
  - HID: simplify snto32() (CKI Backport Bot) [RHEL-111037] {CVE-2025-38556}
  - cxl: core/region - ignore interleave granularity when ways=1 (John W. Linville) [RHEL-107595]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.40.1.el10_0]
changelog:
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119125] {CVE-2025-39841}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118460] {CVE-2025-39817}
  - ibmveth: Add multi buffers rx replenishment hcall support (Mamatha Inamdar) [RHEL-116192]
  - net: ibmveth: Reset the adapter when unexpected states are detected (Mamatha Inamdar) [RHEL-116192]
  - SUNRPC: call xs_sock_process_cmsg for all cmsg (Olga Kornievskaia) [RHEL-110813]
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [RHEL-110813] {CVE-2025-38571}
  - s390/pci: Do not try re-enabling load/store if device is disabled (CKI Backport Bot) [RHEL-114447]
  - s390/pci: Fix stale function handles in error handling (CKI Backport Bot) [RHEL-114447]
  - s390/hypfs: Enable limited access during lockdown (CKI Backport Bot) [RHEL-114430]
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (CKI Backport Bot) [RHEL-114430]
  - ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (Mamatha Inamdar) [RHEL-114438]
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mamatha Inamdar) [RHEL-114438]
  - ibmvnic: Add stat for tx direct vs tx batched (Mamatha Inamdar) [RHEL-114438]
  - ipv6: reject malicious packets in ipv6_gso_segment() (CKI Backport Bot) [RHEL-113248] {CVE-2025-38572}
  - enic: fix incorrect MTU comparison in enic_change_mtu() (John Meneghini) [RHEL-108265]
  - net/enic: Allow at least 8 RQs to always be used (John Meneghini) [RHEL-108265]
  - enic: get max rq & wq entries supported by hw, 16K queues (John Meneghini) [RHEL-106602]
  - enic: cleanup of enic wq request completion path (John Meneghini) [RHEL-106602]
  - enic: added enic_wq.c and enic_wq.h (John Meneghini) [RHEL-106602]
  - enic: remove unused function cq_enet_wq_desc_dec (John Meneghini) [RHEL-106602]
  - enic: enable rq extended cq support (John Meneghini) [RHEL-106602]
  - enic: enic rq extended cq defines (John Meneghini) [RHEL-106602]
  - enic: enic rq code reorg (John Meneghini) [RHEL-106602]
  - enic: Move function from header file to c file (John Meneghini) [RHEL-106602]
  - enic: add dependency on Page Pool (John Meneghini) [RHEL-106602]
  - enic: remove copybreak tunable (John Meneghini) [RHEL-106602]
  - enic: Use the Page Pool API for RX (John Meneghini) [RHEL-106602]
  - enic: Simplify RX handler function (John Meneghini) [RHEL-106602]
  - enic: Move RX functions to their own file (John Meneghini) [RHEL-106602]
  - enic: Fix typo in comment in table indexed by link speed (John Meneghini) [RHEL-106602]
  - enic: Obtain the Link speed only after the link comes up (John Meneghini) [RHEL-106602]
  - enic: Move RX coalescing set function (John Meneghini) [RHEL-106602]
  - enic: Move kdump check into enic_adjust_resources() (John Meneghini) [RHEL-106602]
  - enic: Move enic resource adjustments to separate function (John Meneghini) [RHEL-106602]
  - enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (John Meneghini) [RHEL-106602]
  - enic: Allocate arrays in enic struct based on VIC config (John Meneghini) [RHEL-106602]
  - enic: Save resource counts we read from HW (John Meneghini) [RHEL-106602]
  - enic: Make MSI-X I/O interrupts come after the other required ones (John Meneghini) [RHEL-106602]
  - enic: Create enic_wq/rq structures to bundle per wq/rq data (John Meneghini) [RHEL-106602]
  - scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() (John Meneghini) [RHEL-111542]
  - scsi: fnic: Set appropriate logging level for log message (John Meneghini) [RHEL-111542]
  - scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (John Meneghini) [RHEL-111542]
  - scsi: fnic: Turn off FDMI ACTIVE flags on link down (John Meneghini) [RHEL-111542]
  - scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (John Meneghini) [RHEL-111542]
  - scsi: fnic: Remove unnecessary spinlock locking and unlocking (John Meneghini) [RHEL-111539]
  - scsi: fnic: Replace fnic->lock_flags with local flags (John Meneghini) [RHEL-111539]
  - scsi: fnic: Replace use of sizeof with standard usage (John Meneghini) [RHEL-111539]
  - scsi: fnic: Fix indentation and remove unnecessary parenthesis (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove unnecessary debug print (John Meneghini) [RHEL-111539]
  - scsi: fnic: Propagate SCSI error code from fnic_scsi_drv_init() (John Meneghini) [RHEL-111539]
  - scsi: fnic: Test for memory allocation failure and return error code (John Meneghini) [RHEL-111539]
  - scsi: fnic: Return appropriate error code from failure of scsi drv init (John Meneghini) [RHEL-111539]
  - scsi: fnic: Return appropriate error code for mem alloc failure (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove always-true IS_FNIC_FCP_INITIATOR macro (John Meneghini) [RHEL-111539]
  - scsi: fnic: Fix use of uninitialized value in debug message (John Meneghini) [RHEL-111539]
  - scsi: fnic: Delete incorrect debugfs error handling (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove unnecessary else to fix warning in FDLS FIP (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove extern definition from .c files (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove unnecessary else and unnecessary break in FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Increment driver version (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add support to handle port channel RSCN (John Meneghini) [RHEL-111539]
  - scsi: fnic: Code cleanup (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add stats and related functionality (John Meneghini) [RHEL-111539]
  - scsi: fnic: Modify fnic interfaces to use FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Modify IO path to use FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add functionality in fnic to support FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add and integrate support for FIP (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add and integrate support for FDMI (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add Cisco hardware model names (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add support for unsolicited requests and responses (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add support for target based solicited requests and responses (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add support for fabric based solicited requests and responses (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add headers and definitions for FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Replace shost_printk() with dev_info()/dev_err() (John Meneghini) [RHEL-111539]
  - eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111056] {CVE-2025-38614}
  - mm/memory-tier: fix abstract distance calculation overflow (Rafael Aquini) [RHEL-109447]
  - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CKI Backport Bot) [RHEL-104737] {CVE-2025-38351}


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.41.1.el10_0]
changelog:
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114853] {CVE-2025-39751}
  - erofs: fix blksize < PAGE_SIZE for file-backed mounts (CKI Backport Bot) [RHEL-83885] {CVE-2024-56750}
  - s390/ism: fix concurrency management in ism_cmd() (CKI Backport Bot) [RHEL-114499]
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113614] {CVE-2025-39730}
  - net/mlx5: Generate PPS IN event on new function for shared clock (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Support one PTP device per hardware clock (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Move PPS notifier and out_work to clock_state (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Add devcom component for the clock shared by functions (Michal Schmidt) [RHEL-101997]
  - net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Michal Schmidt) [RHEL-101997]
  - net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Add init and destruction functions for a single HW clock (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Change parameters for PTP internal functions (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Add helper functions for PTP callbacks (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Add support for MRTCQ register (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: use do_aux_work for PHC overflow checks (Michal Schmidt) [RHEL-101997]
  - mlx5_en: use read sequence for gettimex64 (Benjamin Poirier) [RHEL-101997]
  - NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113859] {CVE-2025-39697}
  - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114304] {CVE-2025-39718}
  - mm: swap: fix potential buffer overflow in setup_clusters() (CKI Backport Bot) [RHEL-114863] {CVE-2025-39727}
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117583] {CVE-2025-39849}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.42.1.el10_0]
changelog:
  - platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (CKI Backport Bot) [RHEL-123288]
  - KVM: arm64: Disable MPAM visibility by default and ignore VMM writes (Gavin Shan) [RHEL-121690]
  - KVM: arm64: Add a macro for creating filtered sys_reg_descs entries (Gavin Shan) [RHEL-121690]
  - redhat: rpminspect: update emptyrpm list for kernel variants (Alexandra Hájková)
  - cgroup/psi: Set of->priv to NULL upon file release (CKI Backport Bot) [RHEL-119147] {CVE-2025-39881}
  - kernfs: Fix UAF in polling when open file is released (CKI Backport Bot) [RHEL-119147] {CVE-2025-39881}
  - ipv6: sr: Fix MAC comparison to be constant-time (CKI Backport Bot) [RHEL-116388] {CVE-2025-39702}


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.43.1.el10_0]
changelog:
  - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122878] {CVE-2025-39864}
  - igc: fix lock order in igc_ptp_reset (CKI Backport Bot) [RHEL-118667]
  - igc: add lock preventing multiple simultaneous PTM transactions (CKI Backport Bot) [RHEL-118667]
  - igc: cleanup PTP module if probe fails (CKI Backport Bot) [RHEL-118667]
  - igc: handle the IGC_PTP_ENABLED flag correctly (CKI Backport Bot) [RHEL-118667]
  - igc: move ktime snapshot into PTM retry loop (CKI Backport Bot) [RHEL-118667]
  - igc: increase wait time before retrying PTM (CKI Backport Bot) [RHEL-118667]
  - igc: fix PTM cycle trigger logic (CKI Backport Bot) [RHEL-118667]
  - coredump: Only sort VMAs when core_sort_vma sysctl is set (Herton R. Krzesinski) [RHEL-113363]
  - cxgb4: Avoid removal of uninserted tid (CKI Backport Bot) [RHEL-112148]
  - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Mamatha Inamdar) [RHEL-103014]
  - tools arch x86: Sync the msr-index.h copy with the kernel sources (Waiman Long) [RHEL-92175]
  - Revert "mm/execmem: Unify early execmem_cache behaviour" (Waiman Long) [RHEL-92175]
  - x86/Kconfig: only enable ROX cache in execmem when STRICT_MODULE_RWX is set (Waiman Long) [RHEL-92175]
  - x86/mm/pat: don't collapse pages without PSE set (Waiman Long) [RHEL-92175]
  - tools arch x86: Sync the msr-index.h copy with the kernel sources (Waiman Long) [RHEL-92175]
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (Waiman Long) [RHEL-92175]
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (Waiman Long) [RHEL-92175] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (Waiman Long) [RHEL-92175] {CVE-2025-37948}
  - arm64: proton-pack: Expose whether the branchy loop k value (Waiman Long) [RHEL-92175]
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (Waiman Long) [RHEL-92175]
  - arm64: insn: Add support for encoding DSB (Waiman Long) [RHEL-92175]
  - selftest/x86/bugs: Add selftests for ITS (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/ibt: Keep IBT disabled during alternative patching (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - mm/execmem: Unify early execmem_cache behaviour (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - redhat/configs: Enable CONFIG_MITIGATION_ITS for x86 (Waiman Long) [RHEL-92175]
  - x86/its: Add support for ITS-safe return thunk (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count transitions (Waiman Long) [RHEL-92175]
  - x86/bugs: Add RSB mitigation document (Waiman Long) [RHEL-92175]
  - x86/bugs: Don't fill RSB on context switch with eIBRS (Waiman Long) [RHEL-92175]
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Waiman Long) [RHEL-92175]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Waiman Long) [RHEL-92175]
  - x86/bugs: Use SBPB in write_ibpb() if applicable (Waiman Long) [RHEL-92175]
  - x86/bugs: Rename entry_ibpb() to write_ibpb() (Waiman Long) [RHEL-92175]
  - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Waiman Long) [RHEL-92175]
  - x86/bugs: Use the cpu_smt_possible() helper instead of open-coded code (Waiman Long) [RHEL-92175]
  - x86/bugs: Add AUTO mitigations for mds/taa/mmio/rfds (Waiman Long) [RHEL-92175]
  - x86/bugs: Relocate mds/taa/mmio/rfds defines (Waiman Long) [RHEL-92175]
  - x86/bugs: Add X86_BUG_SPECTRE_V2_USER (Waiman Long) [RHEL-92175]
  - x86/bugs: Remove X86_FEATURE_USE_IBPB (Waiman Long) [RHEL-92175]
  - KVM: nVMX: Always use IBPB to properly virtualize IBRS (Waiman Long) [RHEL-92175]
  - x86/bugs: Use a static branch to guard IBPB on vCPU switch (Waiman Long) [RHEL-92175]
  - x86/bugs: Remove the X86_FEATURE_USE_IBPB check in ib_prctl_set() (Waiman Long) [RHEL-92175]
  - x86/mm: Remove X86_FEATURE_USE_IBPB checks in cond_mitigation() (Waiman Long) [RHEL-92175]
  - x86/bugs: Move the X86_FEATURE_USE_IBPB check into callers (Waiman Long) [RHEL-92175]
  - x86/bugs: KVM: Add support for SRSO_MSR_FIX (Waiman Long) [RHEL-92175]
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Waiman Long) [RHEL-92175]
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Waiman Long) [RHEL-92175]
  - x86/rfds: Exclude P-only parts from the RFDS affected list (Waiman Long) [RHEL-92175]
  - x86/cpu: Update x86_match_cpu() to also use cpu-type (Waiman Long) [RHEL-92175]
  - x86/cpu: Add cpu_type to struct x86_cpu_id (Waiman Long) [RHEL-92175]
  - x86/cpu: Shorten CPU matching macro (Waiman Long) [RHEL-92175]
  - x86/cpu: Fix the description of X86_MATCH_VFM_STEPS() (Waiman Long) [RHEL-92175]
  - module: don't annotate ROX memory as kmemleak_not_leak() (Waiman Long) [RHEL-92175]
  - module: drop unused module_writable_address() (Waiman Long) [RHEL-92175]
  - Revert "x86/module: prepare module loading for ROX allocations of text" (Waiman Long) [RHEL-92175]
  - module: switch to execmem API for remapping as RW and restoring ROX (Waiman Long) [RHEL-92175]
  - execmem: add API for temporal remapping as RW and restoring ROX afterwards (Waiman Long) [RHEL-92175]
  - execmem: don't remove ROX cache from the direct map (Waiman Long) [RHEL-92175]
  - x86/mm/pat: restore large ROX pages after fragmentation (Waiman Long) [RHEL-92175]
  - x86/mm/pat: drop duplicate variable in cpa_flush() (Waiman Long) [RHEL-92175]
  - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Waiman Long) [RHEL-92175]
  - x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Waiman Long) [RHEL-92175]
  - x86/cpu: Fix typo in x86_match_cpu()'s doc (Waiman Long) [RHEL-92175]
  - x86/cpu: Expose only stepping min/max interface (Waiman Long) [RHEL-92175]
  - x86/cpu: Introduce new microcode matching helper (Waiman Long) [RHEL-92175]
  - KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Waiman Long) [RHEL-92175]
  - x86/bugs: Add SRSO_USER_KERNEL_NO support (Waiman Long) [RHEL-92175]
  - module: fix writing of livepatch relocations in ROX text (Waiman Long) [RHEL-92175]
  - x86/execmem: fix ROX cache usage in Xen PV guests (Waiman Long) [RHEL-92175]
  - alloc_tag: load module tags into separate contiguous memory (Waiman Long) [RHEL-92175]
  - alloc_tag: introduce shutdown_mem_profiling helper function (Waiman Long) [RHEL-92175]
  - maple_tree: add mas_for_each_rev() helper (Waiman Long) [RHEL-92175]
  - x86/module: enable ROX caches for module text on 64 bit (Waiman Long) [RHEL-92175]
  - execmem: add support for cache of large ROX pages (Waiman Long) [RHEL-92175]
  - x86/module: prepare module loading for ROX allocations of text (Waiman Long) [RHEL-92175]
  - arch: introduce set_direct_map_valid_noflush() (Waiman Long) [RHEL-92175]
  - module: prepare to handle ROX allocations for text (Waiman Long) [RHEL-92175]
  - asm-generic: introduce text-patching.h (Waiman Long) [RHEL-92175]
  - mm: vmalloc: don't account for number of nodes for HUGE_VMAP allocations (Waiman Long) [RHEL-92175]
  - mm: vmalloc: group declarations depending on CONFIG_MMU together (Waiman Long) [RHEL-92175]
  - x86/cpu: Add CPU type to struct cpuinfo_topology (Waiman Long) [RHEL-92175]
  - x86/cpufeatures: Add X86_FEATURE_AMD_HETEROGENEOUS_CORES (Waiman Long) [RHEL-92175]
  - ice: fix Rx page leak on multi-buffer frames (Petr Oros) [RHEL-116542]
  - ice: fix NULL access of tx->in_use in ice_ll_ts_intr (Petr Oros) [RHEL-116534]
  - ice: fix NULL access of tx->in_use in ice_ptp_ts_irq (Petr Oros) [RHEL-116534]
  - ice: default to TIME_REF instead of TXCO on E825-C (Petr Oros) [RHEL-107466]
  - ice: move TSPLL init calls to ice_ptp.c (Petr Oros) [RHEL-107466]
  - ice: fall back to TCXO on TSPLL lock fail (Petr Oros) [RHEL-107466]
  - ice: wait before enabling TSPLL (Petr Oros) [RHEL-107466]
  - ice: add multiple TSPLL helpers (Petr Oros) [RHEL-107466]
  - ice: use bitfields instead of unions for CGU regs (Petr Oros) [RHEL-107466]
  - ice: read TSPLL registers again before reporting status (Petr Oros) [RHEL-107466]
  - ice: clear time_sync_en field for E825-C during reprogramming (Petr Oros) [RHEL-107466]
  - ice: add TSPLL log config helper (Petr Oros) [RHEL-107466]
  - ice: use designated initializers for TSPLL consts (Petr Oros) [RHEL-107466]
  - ice: remove ice_tspll_params_e825 definitions (Petr Oros) [RHEL-107466]
  - ice: fix E825-C TSPLL register definitions (Petr Oros) [RHEL-107466]
  - ice: rename TSPLL and CGU functions and definitions (Petr Oros) [RHEL-107466]
  - ice: move TSPLL functions to a separate file (Petr Oros) [RHEL-107466]
  - ice: enable timesync operation on 2xNAC E825 devices (Petr Oros) [RHEL-107466]
  - ice: refactor ice_sbq_msg_dev enum (Petr Oros) [RHEL-107466]
  - ice: remove SW side band access workaround for E825 (Petr Oros) [RHEL-107466]
  - ice/ptp: fix crosstimestamp reporting (Petr Oros) [RHEL-115351]
  - ice: fix rebuilding the Tx scheduler tree for large queue counts (Petr Oros) [RHEL-115351]
  - ice: create new Tx scheduler nodes for new queues only (Petr Oros) [RHEL-115351]
  - ice: fix Tx scheduler error handling in XDP callback (Petr Oros) [RHEL-115351]
  - ice: Fix LACP bonds without SRIOV environment (Petr Oros) [RHEL-115351]
  - ice: fix vf->num_mac count with port representors (Petr Oros) [RHEL-115351]
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Petr Oros) [RHEL-115351]
  - ice: fix Get Tx Topology AQ command error on E830 (Petr Oros) [RHEL-115351]
  - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Petr Oros) [RHEL-115351]
  - ice: fix input validation for virtchnl BW (Petr Oros) [RHEL-115351]
  - ice: validate queue quanta parameters to prevent OOB access (Petr Oros) [RHEL-115351]
  - ice: stop truncating queue ids when checking (Petr Oros) [RHEL-115351]
  - virtchnl: make proto and filter action count unsigned (Petr Oros) [RHEL-115351]
  - ice: fix reservation of resources for RDMA when disabled (Petr Oros) [RHEL-115351]
  - ice: health.c: fix compilation on gcc 7.5 (Petr Oros) [RHEL-115351]
  - ice: E825C PHY register cleanup (Petr Oros) [RHEL-115351]
  - ice: Refactor E825C PHY registers info struct (Petr Oros) [RHEL-115351]
  - ice: rename ice_ptp_init_phc_eth56g function (Petr Oros) [RHEL-115351]
  - ice: Add E830 checksum offload support (Petr Oros) [RHEL-115351]
  - ice: register devlink prior to creating health reporters (Petr Oros) [RHEL-115351]
  - ice: Fix switchdev slow-path in LAG (Petr Oros) [RHEL-115351]
  - ice: fix memory leak in aRFS after reset (Petr Oros) [RHEL-115351]
  - ice: do not configure destination override for switchdev (Petr Oros) [RHEL-115351]
  - ice: dpll: Remove newline at the end of a netlink error message (Petr Oros) [RHEL-115351]
  - virtchnl: add enumeration for the rxdid format (Petr Oros) [RHEL-115351]
  - ice: support Rx timestamp on flex descriptor (Petr Oros) [RHEL-115351]
  - virtchnl: add support for enabling PTP on iAVF (Petr Oros) [RHEL-115351]
  - ice: refactor ice_fdir_create_dflt_rules() function (Petr Oros) [RHEL-115351]
  - ice: Implement PTP support for E830 devices (Petr Oros) [RHEL-115351]
  - ice: Refactor ice_ptp_init_tx_* (Petr Oros) [RHEL-115351]
  - ice: Add unified ice_capture_crosststamp (Petr Oros) [RHEL-115351]
  - ice: Process TSYN IRQ in a separate function (Petr Oros) [RHEL-115351]
  - ice: Use FIELD_PREP for timestamp values (Petr Oros) [RHEL-115351]
  - ice: Remove unnecessary ice_is_e8xx() functions (Petr Oros) [RHEL-115351]
  - ice: Don't check device type when checking GNSS presence (Petr Oros) [RHEL-115351]
  - ice: use generic unrolled_count() macro (Petr Oros) [RHEL-115351]
  - ice: count combined queues using Rx/Tx count (Petr Oros) [RHEL-115351]
  - ice: Add check for devm_kzalloc() (Petr Oros) [RHEL-115351]
  - ice: remove invalid parameter of equalizer (Petr Oros) [RHEL-115351]
  - ice: fix ice_parser_rt::bst_key array size (Petr Oros) [RHEL-115351]
  - ice: Add in/out PTP pin delays (Petr Oros) [RHEL-115351]
  - ice: use string choice helpers (Petr Oros) [RHEL-115351]
  - ice: add fw and port health reporters (Petr Oros) [RHEL-115351]
  - ice: add recipe priority check in search (Petr Oros) [RHEL-115351]
  - ice: Add MDD logging via devlink health (Petr Oros) [RHEL-115351]
  - ice: add Tx hang devlink health reporter (Petr Oros) [RHEL-115351]
  - ice: rename devlink_port.[ch] to port.[ch] (Petr Oros) [RHEL-115351]
  - ice: cleanup Rx queue context programming functions (Petr Oros) [RHEL-115351]
  - ice: move prefetch enable to ice_setup_rx_ctx (Petr Oros) [RHEL-115351]
  - ice: reduce size of queue context fields (Petr Oros) [RHEL-115351]
  - ice: use <linux/packing.h> for Tx and Rx queue context data (Petr Oros) [RHEL-115351]
  - ice: use structures to keep track of queue context size (Petr Oros) [RHEL-115351]
  - ice: remove int_q_state from ice_tlan_ctx (Petr Oros) [RHEL-115351]
  - ice: fix incorrect PHY settings for 100 GB/s (Petr Oros) [RHEL-115351]
  - ice: fix max values for dpll pin phase adjust (Petr Oros) [RHEL-115351]
  - ice: Fix VLAN pruning in switchdev mode (Petr Oros) [RHEL-115351]
  - ice: Fix NULL pointer dereference in switchdev (Petr Oros) [RHEL-115351]
  - ice: fix PHY timestamp extraction for ETH56G (Petr Oros) [RHEL-115351]
  - ice: Unbind the workqueue (Petr Oros) [RHEL-115351]
  - ice: use stack variable for virtchnl_supported_rxdids (Petr Oros) [RHEL-115351]
  - ice: initialize pf->supported_rxdids immediately after loading DDP (Petr Oros) [RHEL-115351]
  - ice: only allow Tx promiscuous for multicast (Petr Oros) [RHEL-115351]
  - ice: support optional flags in signature segment header (Petr Oros) [RHEL-115351]
  - ice: refactor "last" segment of DDP pkg (Petr Oros) [RHEL-115351]
  - ice: extend dump serdes equalizer values feature (Petr Oros) [RHEL-115351]
  - ice: rework of dump serdes equalizer values feature (Petr Oros) [RHEL-115351]
  - ice: Support VF queue rate limit and quanta size configuration (Petr Oros) [RHEL-115351]
  - virtchnl: fix m68k build. (Petr Oros) [RHEL-115351]
  - virtchnl: support queue rate limit and quanta size configuration (Petr Oros) [RHEL-115351]
  - ice: Cleanup unused declarations (Petr Oros) [RHEL-115351]
  - ice: Use common error handling code in two functions (Petr Oros) [RHEL-115351]
  - ice: Make use of assign_bit() API (Petr Oros) [RHEL-115351]
  - ice: store max_frame and rx_buf_len only in ice_rx_ring (Petr Oros) [RHEL-115351]
  - ice: consistently use q_idx in ice_vc_cfg_qs_msg() (Petr Oros) [RHEL-115351]
  - ice: Implement ethtool reset support (Petr Oros) [RHEL-115351]
  - ice: Add correct PHY lane assignment (Petr Oros) [RHEL-115351]
  - ice: Fix ETH56G FC-FEC Rx offset value (Petr Oros) [RHEL-115351]
  - ice: Fix quad registers read on E825 (Petr Oros) [RHEL-115351]
  - ice: Fix E825 initialization (Petr Oros) [RHEL-115351]
  - unroll: add generic loop unroll helpers (CKI Backport Bot) [RHEL-115351]
  - devlink: add devlink_fmsg_dump_skb() function (Petr Oros) [RHEL-115351]
  - devlink: add devlink_fmsg_put() macro (Petr Oros) [RHEL-115351]
  - redhat: configs: enable CONFIG_PACKING (Petr Oros) [RHEL-115351]
  - lib: packing: catch kunit_kzalloc() failure in the pack() test (CKI Backport Bot) [RHEL-115351]
  - lib: packing: document recently added APIs (CKI Backport Bot) [RHEL-115351]
  - lib: packing: add pack_fields() and unpack_fields() (CKI Backport Bot) [RHEL-115351]
  - lib: packing: demote truncation error in pack() to a warning in __pack() (CKI Backport Bot) [RHEL-115351]
  - lib: packing: create __pack() and __unpack() variants without error checking (CKI Backport Bot) [RHEL-115351]
  - lib: packing: use GENMASK() for box_mask (CKI Backport Bot) [RHEL-115351]
  - lib: packing: use BITS_PER_BYTE instead of 8 (CKI Backport Bot) [RHEL-115351]
  - lib: packing: fix QUIRK_MSB_ON_THE_RIGHT behavior (CKI Backport Bot) [RHEL-115351]
  - lib: packing: add additional KUnit tests (CKI Backport Bot) [RHEL-115351]
  - lib: packing: add KUnit tests adapted from selftests (CKI Backport Bot) [RHEL-115351]
  - lib: packing: duplicate pack() and unpack() implementations (CKI Backport Bot) [RHEL-115351]
  - lib: packing: add pack() and unpack() wrappers over packing() (CKI Backport Bot) [RHEL-115351]
  - lib: packing: remove kernel-doc from header file (CKI Backport Bot) [RHEL-115351]
  - lib: packing: adjust definitions and implementation for arbitrary buffer lengths (CKI Backport Bot) [RHEL-115351]
  - lib: packing: refuse operating on bit indices which exceed size of buffer (CKI Backport Bot) [RHEL-115351]


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.1.1.el10_0]
changelog:
  - redhat: adjust rhel branch name (Jan Stancek)
  - redhat: set defaults for RHEL 10.0 (Jan Stancek)
  - Revert "x86/kvm: Override default caching mode for SEV-SNP and TDX" (Vitaly Kuznetsov) [RHEL-76109]


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.2.1.el10_0]
changelog:
  - Documentation/powerpc/fadump: add additional parameter feature details (Mamatha Inamdar) [RHEL-70827]
  - powerpc: increase MIN RMA size for CAS negotiation (Mamatha Inamdar) [RHEL-70827]
  - powerpc/fadump: fix additional param memory reservation for HASH MMU (Mamatha Inamdar) [RHEL-70827]
  - powerpc: export MIN RMA size (Mamatha Inamdar) [RHEL-70827]
  - scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Avoid reply queue full condition (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Fix possible crash when setting up bsg fails (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Handling of fault code for insufficient power (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Start controller indexing from 0 (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (Chandrakanth Patil) [RHEL-30789] {CVE-2024-57804}
  - scsi: mpi3mr: Synchronize access to ioctl data buffer (Chandrakanth Patil) [RHEL-30789]
  - redhat: regenerate self-test data for new RHDISTGIT_BRANCH (Patrick Talbert)


author: EL Errata <el-errata_ww@oracle.com> - 31-11.0.1
changelog:
  - weak-modules: Fix add_kernel to handle suffix [Orabug: 34623248] (Todd Vierling)
  - add weak-modules patch for [Orabug: 26672773]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> - 31-11.0.2
changelog:
  - Add improvement to modprobe to handle UEK8 packaging better [Orabug: 37771059] (Harshit Mogalapalli)


author: EL Errata <el-errata_ww@oracle.com> - 31-12.0.1
changelog:
  - Add improvement to modprobe to handle UEK8 packaging better [Orabug: 37771059] (Harshit Mogalapalli)
  - weak-modules: Fix add_kernel to handle suffix [Orabug: 34623248] (Todd Vierling)
  - add weak-modules patch for [Orabug: 26672773]


author: Julien Rische <jrische@redhat.com> - 1.21.3-1
changelog:
  - New upstream version (1.21.3)
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45387 RHEL-45378
  - Fix memory leak in GSSAPI interface
    Resolves: RHEL-47284
  - Fix memory leak in PMAP RPC interface
    Resolves: RHEL-47287
  - Fix memory leak in failing UTF-8 to UTF-16 re-encoding for PAC
    Resolves: RHEL-47285
  - Make TCP waiting time configurable
    Resolves: RHEL-47278


author: Julien Rische <jrische@redhat.com> - 1.21.3-4
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-55427
  - Fix various issues detected by static analysis
    Resolves: RHEL-45165
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-56070


author: Julien Rische <jrische@redhat.com> - 1.21.3-6
changelog:
  - Support PKCS11 EC client certs in PKINIT
    Resolves: RHEL-74373
  - kdb5_util: fix DB entry flags on modification
    Resolves: RHEL-56058
  - Add ECDH support for PKINIT (RFC5349)
    Resolves: RHEL-71881


author: Julien Rische <jrische@redhat.com> - 1.21.3-8
changelog:
  - Do not block HMAC-MD4/5 in FIPS mode
    Resolves: RHEL-88705
  - Don't issue RC4 session keys by default (CVE-2025-3576)
    Resolves: RHEL-88047
  - Add PKINIT paChecksum2 from MS-PKCA v20230920
    Resolves: RHEL-74295


author: Mark Will <mark.will@oracle.com> - 0:4.21.3-104
changelog:
  - resolves: RHEL-75587 - Fix deadlock between two smbd processes
  - resolves: RHEL-85348 - Fix winbindd memory leak


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 0:4.21.3-113
changelog:
  - Rebuild for zstream
  - Fix 'net ads join' in setups with multiple DCs
  - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.21.3-106)
  - Fix winbind fork bomb in 'IPA with AD trust'
    environment
  - Fix samba-gpupdate to process empty GPO Link
  - Fix 'net ads kerberos kinit'
  - smb.conf: Remove the '@' for NIX groups, we
    removed NIS support


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-104
changelog:
  - resolves: RHEL-101759 - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.22.2-103.el10)


author: Lukas Javorsky <ljavorsk@redhat.com> - 3.7.7-1
changelog:
  - Rebase to version 3.7.7
  - Fixing SAST issues, accepted by upstream
  - Resolves: RHEL-39391 RHEL-67895


author: Karel Zak <kzak@redhat.com> - 2.40.2-3
changelog:
  - revert recent uuidd mode changes
  - rebase rhel specific patches
  - fix uuidd-tmpfiles.conf (upstream patch)
  - remove unused patches


author: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.69-1
changelog:
  - Update to 2.69 (with contribs from Yanko Kaneti <yaneti@declera.com>, and Andrew G. Morgan <morgan@kernel.org>)
  - Update license to SPDX (by Anderson Toshiyuki Sasaki <ansasaki@redhat.com>)
  - Make file lists more explicit to avoid accidental ABI changes (Dominik Mierzejewski <dominik@greysector.net>)


author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 2.69-4
changelog:
  - Add manpages for pam_cap and capability.conf (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>)
  - Fix incompatibility of the build with go 1.22 (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>)
  - Reenable PIE in the captree tool (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>)
  - Use sbindir location provided by rpm (by Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>)
  - Include hardening flags by setting CGO_CFLAGS=CFLAGS and CGO_LDFLAGS=LDFLAGS


author: Steve Grubb <sgrubb@redhat.com> 0.8.4-1
changelog:
  - New upstream bugfix release
  - Drop libcap-ng-0.8.3-apply-disable.patch since things should be fixed


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 0.7.0-8
changelog:
  - Update license to SPDX format
  - spec file tidy/modernization
    - use modern cmake build and install
    - properly own include directories in the devel package
    - de-glob some files to follow packaging guidelines


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 0.10.2-1
changelog:
  - Update to version 0.10.2 ( resolves: rhbz#1880885 )
  - Revise specs per packaging guidelines for globs of soname


author: Tom Hromatka <tom.hromatka@oracle.com> - 2.0
changelog:
  - Add cgroup v2 support to all libcgroup tools -
    cgclassify, cgclear, cgconfigparser, cgcreate, cgdelete, cgexec, cgget,
    cgrulesengd, cgset, cgsnapshot, lscgroup, lssubsys. See github issue #12.
  - Fix an issue with parallel builds
  - Add extensive functional tests
  - Remove .libs from Makefile.am files
  - Major refactor of cgget to make it more closely align with the other tools
  - Fix many string truncation and possible buffer overflow warnings


author: Tom Hromatka <tom.hromatka@oracle.com> - 2.0.1
changelog:
  - Allow reading/writing from cgroup.* files in cgroup v2
  - Add support for cgroup v2's cgroup.threads file
  - Fix issue where libcgroup/pam wasn't working properly when
  - cgrulesengd is disabled
  - Fix a bug where the cgroup version wasn't initialized in a
  - named cgroup v1 hierarchy
  - Various automake bug fixes
  - Build PAM module as unversioned DSO
  - Fix build issues with musl libc
  - Fix potential TOCTOU race in cgroup_get_procs()


author: Tom Hromatka <tom.hromatka@oracle.com> - 2.0.2-1.0.1
changelog:
  - Fix extra spaces in configure.ac's --enable-bindings
  - Fix potential segfault if there are more than 100 cgroup mount points


author: Tom Hromatka <tom.hromatka@oracle.com> - 3.0.0-1.0.1
changelog:
  - Introduce cgxget and cgxset - tools to abstract cgroup v1 and v2 systems
  - Introduce new C APIs that abstract the cgroup v1 and v2 interfaces for the user
    Remove the cgclear tool
  - Introduce modern Cython-based Python bindings, replacing the old bindings
  - Add spdx license tags across the files
  - Introduce a process for handling security-related vulnerabilities
  - Fix many warnings and errors reported by coverity
  - Add full cgroup v2 support to continuous integration
  - Add code quality analysis to continuous integration
  - Add Linux kernel syntax style and add checking to continuous integration


author: Tom Hromatka <tom.hromatka@oracle.com> - 3.1.0-1.0.1
changelog:
  - Add systemd C APIs
  - Add systemd support to all command line tools, including cgcreate,
    cgconfigparser, cgexec, and cgclassify. Note the usage of the -b flag in many
    tools to ignore the default systemd hierarchy and operate from the root of
    the cgroup hierarchy
  - Add python systemd APIs
  - Improved handling of legacy (cgroup v1), hybrid (v1/v2), and unified (v2)
    cgroup hierarchies
  - Add several new C APIs, including:
    cg_setup_mode_t() - A function that returns the current cgroup setup mode
    (legacy, hybrid, or unified)
    Various functions for better traversal through a struct cgroup
    cgroup_create_scope() and cgroup_create_scope2() for creating systemd scopes
    cgconfigparser now supports a systemd section
  - Libcgroup python bindings have matured greatly but are still considered
    experimental and subject to change. Community feedback here would be greatly
    appreciated
    Add rudimentary logging support
    Add systemd support
    Add setup mode (legacy, hybrid, unified) support
    Add several APIs for operating on struct cgroup in a Pythonic manner
    Add methods for moving processes within cgroups
    Rename blacklist to denylist
    Rename whitelist to allowlist
    Add many functional tests
  - Remove ExecStop from extras-3.1.0/cgconfig.service unit
  - Add dependency of selinux-policy package for libcgroup-tools


author: Tom Hromatka <tom.hromatka@oracle.com> - 3.2.0-1.0.1
changelog:
  - Update to upstream version v3.2.0 of libcgroup
  - Add Provides tag for packages/applications that depend upon libcgroup
  - Obsolete all packages from libcgroup v3.1.0 and previous


author: Jan Kolarik <jkolarik@redhat.com> - 0.1.20-1
changelog:
  - Update to 0.1.20
  - Fixes of xml parsing
  - Fix non-optimized builds by removing inline keyword
  - Use Py_hash_t instead of long


author: Pavol Žáčik <pzacik@redhat.com> - 0.6.5-3
changelog:
  - Patch bugs found by static analysis tools
  - Add %{name}-fix-handle-leaks-in-rdmsr-c.patch
  - Add %{name}-fix-cpuid_get_hypervisor.patch
  - Add %{name}-prevent-intel_fn11-array-overruns.patch


author: Pavol Žáčik <pzacik@redhat.com> - 0.7.0-1
changelog:
  - Rebase to 0.7.0
  - Begin building the package for aarch64
  - Add Python bindings as a subpackage (python3-libcpuid)


author: EL Errata <el-errata_ww@oracle.com> - 0.73.1-12.0.1
changelog:
  - Recognise new kernel-uek RPMs as multiversion and installonlypkg [Orabug: 36053872]
  - Replaced bugzilla.oracle.com references [Orabug: 34202300]
  - Update OL9 dnf to recognize UEK7(kernel-uek-core & kernel-uek-modules) as installonlypkgs package [Orabug: 33861607]
  - Replaced bugzilla.redhat.com with bugzilla.oracle.com in config [Orabug: 29656932]
  - Add support for apps that use libdnf to access yum url with 'ociregion' variable [Orabug: 30121584]
  - Update OL8 dnf to recognise kernel-uek as installonlypkgs package [Orabug: 31018668]
  - Disable rhsm [Orabug: 29901202]


author: Evan Goode <egoode@redhat.com> - 0.73.1-1
changelog:
  - Update to 0.73.1 (RHEL-38831)
  - Fix https://issues.redhat.com/browse/RHEL-27657 (RHEL-32935)
  - subject-py: Fix memory leak (RHEL-32924)
  - MergedTransaction: Calculate RPM difference between two same versions as
    no-op (RHEL-33541)
  - Onboard packit tests
  - Add virtual destructor to TransactionItem (RHEL-32943)


author: Petr Pisar <ppisar@redhat.com> - 0.73.1-2
changelog:
  - Fix reinstalling packages which conflicts with themselves in
    dnf_transaction_commit() (RHEL-32919)
  - Fix an invalid memory access when dropping an item in MergedTransaction
    class (RHEL-33541)


author: Pavol Žáčik <pzacik@redhat.com> - 2.1.12-13
changelog:
  - Update license identifiers to SPDX in subpackages
  - Add Apache-2.0 license which appears in sample/ssl-client-mbedtls.c


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 1.13.0-1
changelog:
  - Update to 1.13.0 release ( resolves: rhbz#2172297 )
  - Perform some deglobing of files per packaging guidelines


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.0-1
changelog:
  - Resolves: RHEL-62725 - Rebase SSSD for RHEL 10.0
  - Resolves: RHEL-56701 - sss_ssh_knownhosts is breaking ansible-pull
  - Resolves: RHEL-55993 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.1-1
changelog:
  - Resolves: RHEL-62725 - Rebase SSSD for RHEL 10.0
  - Resolves: RHEL-4984 - Mismatch between input and parsed domain name when default_domain_suffix is set.
  - Resolves: RHEL-65848 - sssd password authentication broken in sssd-2.10.0~beta2-2 and later
  - Resolves: RHEL-67669 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option
  - Resolves: RHEL-68421 - sssd ldap_child process segfaults when krb5.conf is invalid [rhel-10]
  - Resolves: RHEL-66935 - Avoid log flooding in case an app keeps making invalid `getservbyport(0, ...)` request
  - Resolves: RHEL-65736 - ipa: sudo commands doesn't check threshold correctly
  - Resolves: RHEL-68319 - Please deprecate/remove ad_allow_remote_domain_local_groups


author: Masahiro Matsuya <mmatsuya@redhat.com> - 2.10.2-3.3
changelog:
  - Resolves: RHEL-120286 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.11.0-1
changelog:
  - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1
  - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found
  - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack
  - Resolves: RHEL-25593 - Improve sssd-simple man page description
  - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust
  - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem
  - Resolves: RHEL-4981 - p11_child currently has an infinite timeout
  - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir
  - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE
  - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names


author: Alexey Tikhonov <atikhono@redhat.com> - 2.11.1-1
changelog:
  - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1
  - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache


author: Alexey Tikhonov <atikhono@redhat.com> - 2.11.1-2
changelog:
  - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache
    Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted.


author: Sumit Bose <sbose@redhat.com> - 2.11.1-2.1
changelog:
  - Resovles: RHEL-120288 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows
    privilege escalation on AD-joined Linux systems [rhel-10.1.z]


author: Wen Liang <wenliang@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved from the main package
    to the utils sub package causing a file conflict on multilib systems between the
    old 32 bit main package and the new 64 bit utils sub package.


author: Scott Mayhew <smayhew@redhat.com> 2.8.2-0
changelog:
  - Updated to the latest release: nfs-utils-2-8-2 (RHEL-67786)
    Resolves: RHEL-65826
    Resolves: RHEL-67041
    Resolves: RHEL-67168
    Resolves: RHEL-67786
    Resolves: RHEL-68575


author: Scott Mayhew <smayhew@redhat.com> 2.8.2-3
changelog:
  - fix ownership of /var/lib/nfs/statd/state (RHEL-77913)
  - /var/lib/nfs/{etab,rmtab} should not be marked as config files (RHEL-77912)


author: Scott Mayhew <smayhew@redhat.com> 2.8.3-0
changelog:
  - Updated to nfs-utils-2-8-3 plus additional fixes from 2-8-4-rc1 (RHEL-88768)
    Resolves: RHEL-71286
    Resolves: RHEL-82418
    Resolves: RHEL-82557
    Resolves: RHEL-85409
    Resolves: RHEL-85413
    Resolves: RHEL-88768


author: Scott Mayhew <smayhew@redhat.com> 2.8.3-2
changelog:
  - mountd: Minor refactor of get_rootfh() (RHEL-127092)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127092)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127092)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127092)
    Resolves: CVE-2025-12801


author: Jan Macku <jamacku@redhat.com> 1.60.0-1
changelog:
  - update to the latest upstream release
  - update PGP key from https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x7e8403d5d673c366


author: Jan Macku <jamacku@redhat.com> 1.61.0-1
changelog:
  - update to the latest upstream release
  - fixes CVE-2024-28182 - HTTP/2 CONTINUATION frames can be utilized for DoS attacks


author: José Expósito <jexposit@redhat.com> - 0.16-13
changelog:
  - Fix findings from static application security testing (SAST)
    Resolves: https://issues.redhat.com/browse/RHEL-29742


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-8.1
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131422)
  - CVE-2025-65018: heap buffer overflow (RHEL-131435)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133212)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-8.2
changelog:
  - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148323)
  - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148818)
  - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146645)


author: Lukáš Zaoral <lzaoral@redhat.com> - 0.21.2-5
changelog:
  - migrate to SPDX license format
    - the old and new license tags are identical, this changelog entry just
      indicates that it was checked to be correct


author: Jan Kolarik <jkolarik@redhat.com> - 1.17.0-1
changelog:
  - Update to 1.17.0
  - lr_gpg_check_signature: Forward PGP error messages from RPM
  - PGP: fix: Support importing binary public keys in librpm backend
  - PGP: Enable creating a UID directory for GnuGP agent socket in /run/gnupg/user
  - PGP: Set a default creation SELinux labels on GnuPG directories


author: Jan Kolarik <jkolarik@redhat.com> - 1.17.1-1
changelog:
  - Update to 1.17.1 (RHEL-38831)
  - gpg_gpgme.c: fix build errors with older gcc
  - Change header files to match a configured ABI regarding a zchunk support
  - Fix building zchunk code if zchunk is enabled
  - Fix compiler warnings


author: Evan Goode <egoode@redhat.com> - 1.18.0-1
changelog:
  - Update to 1.18.0 (RHEL-35699)
  - API: Add LRO_USERNAME and LRO_PASSWORD options
  - Add a private dependency on zck to librepo.pc if zchunk support is enabled
  - Hash cache: Improved work with extended file attributes
  - Improve performance of large number of package downloads
  - Fix error handling, Fix examples and build them


author: Petr Pisar <ppisar@redhat.com> - 1.18.0-2
changelog:
  - Use librpmio instead of gpgme for handling PGP keys (RHEL-47106)
  - Fix a memory leak in select_next_target() (RHEL-35699)


author: Petr Pisar <ppisar@redhat.com> - 0.0.3-14
changelog:
  - Improve a documentation (RHEL-38831)
  - Refactor parse_entitlement_data() (RHEL-32365)
  - Fix relocating certificate paths to /etc/rhsm-host (RHEL-37866)


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-3
changelog:
  - restorecon: Include <selinux/label.h> (RHEL-53852)
  - Fix integer comparison issues when compiling for 32-bit


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-5
changelog:
  - setexecfilecon: Remove useless rc check (RHEL-35586)
  - matchpathcon: RESOURCE_LEAK: Variable "con" (RHEL-35584)


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-4
changelog:
  - cil: Check that sym_index is within bounds (RHEL-34823)
  - cil: Initialize avtab_datum on declaration (RHEL-34810)
  - mls: Do not destroy context on memory error (RHEL-34810)
  - cil/cil_post: Initialize tmp on declaration (RHEL-34810)
  - Initialize "strs" on declaration (RHEL-34810)


author: Kate Hsuan <hpa@redhat.com> - 1.0.28-1
changelog:
  - Update to the upstream version 1.0.28
  - Update to the upstream version 1.0.28
  - Fix automake-1.17 issue since the release was based on automake-1.17


author: David King <dking@redhat.com> - 2.12.5-6
changelog:
  - Fix CVE-2025-6021 (RHEL-96495)
  - Fix CVE-2025-49794 (RHEL-96395)
  - Fix CVE-2025-49795 (RHEL-96408)
  - Fix CVE-2025-49796 (RHEL-96421)


author: Martin Osvald <mosvald@redhat.com> - 2.1.1-1
changelog:
  - New version 2.1.1 (rhbz#2250290)
  - Fix incorrect upstream URL and SourceX (rhbz#2249526)
  - SPDX migration


author: Tom Callaway <spot@fedoraproject.org> - 5.4.6-3
changelog:
  - disable "corrupted binary dump" test that has issues on big-endian architectures
  - apply upstream fix for 5.4.6 bug 1


author: DJ Delorie <dj@redhat.com> - 1:4.4.1-3
changelog:
  - Migrate License field to SPDX identifiers for
    https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2


author: Lianbo Jiang <lijiang@redhat.com> - 1.7.5-11
changelog:
  - Fix failure of hugetlb pages exclusion on Linux 6.9 and later
  - Fix wrong exclusion of Slab pages on Linux 6.10-rc1 and later


author: EL Errata <el-errata_ww@oracle.com> - 1.7.6-4.0.1
changelog:
  - Rebase makedumpfile to v1.7.6 [Orabug: 37396521]
  - Mark mem-usage not supported for arm64 architecure [Orabug: 30352094]


author: EL Errata <el-errata_ww@oracle.com> - 1.7.7-2.0.1
changelog:
  - Rebase makedumpfile to v1.7.7 [Orabug: 37932707]
  - Rebase makedumpfile to v1.7.6 [Orabug: 37396521]
  - Mark mem-usage not supported for arm64 architecure [Orabug: 30352094]


author: Patsy Griffin <pfrankli@redhat.com> - 6.06-7
changelog:
  - Break up man-pages-additional-20140218.tar.xz (RHEL-101696)
  - Add rtas.2, swapcontext.2 and cons.saver.8 man pages as a patch.


author: Jakub Čajka <jcajka@redhat.com> - 3:200-1
changelog:
  - Update to latest upstream version
  - Resolves: RHEL-20091, RHEL-20085, RHEL-20556, RHEL-47461 and RHEL-37248


author: Xiao Ni <xni@redhat.com> - 4.4-1
changelog:
  - Update to mdadm 4.4 and latest upstream
  - Resolves: RHEL-86676, RHEL-72803, RHEL-88793, RHEL-88791


author: Todd Vierling <todd.vierling@oracle.com> - 4:20250211-1.0.1
changelog:
  - enable use with UEK8 kernels
  - don't bother calling dracut if virtualized
  - ensure UEK also rebuilds initramfs
  - enable early update for 06-4f-01
  - enable early and late load on RHCK


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20240910-1
changelog:
  - Update Intel CPU microcode to microcode-20240910 release, addresses
    CVE-2024-23984, CVE-2024-24853, CVE-2024-24968, CVE-2024-24980,
    CVE-2024-25939 (RHEL-58058):
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003605 up to 0x5003707;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002802
      up to 0x7002904;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003d1
      up to 0xd0003e7;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000290
      up to 0x10002b0;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc4
      up to 0xc6;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode from revision
      0xb6 up to 0xb8;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x36 up
      to 0x38;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x50 up
      to 0x52;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
      0xf4 up to 0xf6;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
      revision 0xf4 up to 0xf6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xf4 up
      to 0xf6;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode from revision 0xfa up to 0xfc;
    - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x19 up
      to 0x1a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x35 up to 0x36;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x35 up to 0x36;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x35 up to 0x36;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x35 up to 0x36;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x35 up to 0x36;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x35
      up to 0x36;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x35 up to 0x36;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x35 up to 0x36;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x433 up to 0x434;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x433 up to 0x434;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x433 up to 0x434;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x433
      up to 0x434;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
      0xf6 up to 0xf8;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
      0xf6 up to 0xf8;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0xfc up to 0x100;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfa up
      to 0xfc;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfa
      up to 0xfc;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfa
      up to 0xfc;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfa
      up to 0xfe;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xfa up to 0xfc;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5e up
      to 0x62;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1c
      up to 0x1f;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x123 up
      to 0x129;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4121 up to 0x4122;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4121 up to 0x4122;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4121
      up to 0x4122;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4121 up to 0x4122;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122;
    - Update of 06-ba-08/0xe0 microcode from revision 0x4121 up to 0x4122;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x35 up to 0x36;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x35 up to 0x36;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x35 up
      to 0x36;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x35 up to 0x36;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x35 up to 0x36;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x35 up to 0x36;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x35 up to 0x36;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x35 up
      to 0x36;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x17 up
      to 0x1a (old pf 0x11).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20241112-1
changelog:
  - Update Intel CPU microcode to microcode-20241112 release, addresses
    CVE-2024-21820, CVE-2024-21853, CVE-2024-23918, CVE-2024-23984 (RHEL-67335):
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0005c0
      up to 0x2b000603;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0005c0
      up to 0x2b000603;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b0005c0 up to 0x2b000603;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x36 up to 0x37;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x36 up to 0x37;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x36 up to 0x37;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x36 up to 0x37;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x36 up to 0x37;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x36
      up to 0x37;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x36 up to 0x37;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x36 up to 0x37;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x434 up to 0x435;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x434 up to 0x435;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x434 up to 0x435;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x434
      up to 0x435;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1f
      up to 0x20;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x129 up
      to 0x12b;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4122 up to 0x4123;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4122 up to 0x4123;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4122
      up to 0x4123;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4122 up to 0x4123;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123;
    - Update of 06-ba-08/0xe0 microcode from revision 0x4122 up to 0x4123;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x36 up to 0x37;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x36 up to 0x37;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x36 up
      to 0x37;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x36 up to 0x37;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x36 up to 0x37;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x36 up to 0x37;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x36 up to 0x37;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x36 up
      to 0x37;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000230
      up to 0x21000283;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000230 up to 0x21000283;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000230 up to 0x21000283;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000230
      up to 0x21000283.


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20241112-1.20250211.1
changelog:
  - Update Intel CPU microcode to microcode-20250211 release, addresses
    CVE-2023-34440, CVE-2023-43758, CVE-2024-24582, CVE-2024-28047,
    CVE-2024-28127, CVE-2024-29214, CVE-2024-31068, CVE-2024-31157,
    CVE-2024-37020, CVE-2024-39279, CVE-2024-39355, CVE-2024-36293 (RHEL-79184,
    RHEL-79185, RHEL-79188, RHEL-79189, RHEL-79191, RHEL-79193, RHEL-79203):
    - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) at
      revision 0x38;
    - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) at
      revision 0x38;
    - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) at
      revision 0x38;
    - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) at
      revision 0x38;
    - Addition of 06-af-03/0x01 (SRF-SP C0) microcode at revision 0x3000330;
    - Addition of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) at
      revision 0x12c;
    - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) at
      revision 0x38;
    - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) at
      revision 0x38;
    - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) at
      revision 0x38;
    - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) at
      revision 0x38;
    - Removal of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000603;
    - Removal of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) at
      revision 0x2c000390;
    - Removal of 06-8f-05/0x87 (SPR-SP E2) microcode at revision 0x2b000603;
    - Removal of 06-8f-05/0x10 (SPR-HBM B1) microcode at revision
      0x2c000390;
    - Removal of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000603;
    - Removal of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) at
      revision 0x2c000390;
    - Removal of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000603;
    - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000603;
    - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) at revision 0x2c000390;
    - Removal of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000603;
    - Removal of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) at
      revision 0x2c000390;
    - Removal of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000603;
    - Removal of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) at revision 0x2c000390;
    - Removal of 06-8f-06/0x87 (SPR-SP E3) microcode at revision 0x2b000603;
    - Removal of 06-8f-06/0x10 microcode at revision 0x2c000390;
    - Removal of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000603;
    - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000603;
    - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) at revision 0x2c000390;
    - Removal of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) at revision 0x4123;
    - Removal of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) at revision 0x4123;
    - Removal of 06-ba-08/0xe0 microcode at revision 0x4123;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003e7
      up to 0xd0003f5;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002b0
      up to 0x10002c0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000603 up to 0x2b000620;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000603 up to 0x2b000620;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x37 up to 0x38;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x37 up to 0x38;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x37 up to 0x38;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x37 up to 0x38;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x37 up to 0x38;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x37
      up to 0x38;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x37 up to 0x38;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x37 up to 0x38;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x435 up to 0x436;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x435 up to 0x436;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x435 up to 0x436;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x435
      up to 0x436;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x7 up
      to 0x9;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
      0xf8 up to 0xfa;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0x100 up to 0x102;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x62 up
      to 0x63;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12b up
      to 0x12c;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4123 up to 0x4124;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4123 up to 0x4124;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4123
      up to 0x4124;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4123 up to 0x4124;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1a up
      to 0x1c;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x37 up to 0x38;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x37 up to 0x38;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x37 up
      to 0x38;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x37 up to 0x38;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x37 up to 0x38;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x37 up to 0x38;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x37 up to 0x38;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x37 up
      to 0x38;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000283
      up to 0x21000291;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000283 up to 0x21000291;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000283 up to 0x21000291;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000283
      up to 0x21000291.


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20241112-1.20250512-1
changelog:
  - Add a caveat to provide ability to persistently disable SPR-EE updates
    beyond 0x2b0005c0 on systems where absence of latency spikes
    is more important than lack of the latest CVE mitigations.
  - Update Intel CPU microcode to microcode-20250512 release, addresses
    CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420,
    CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012
    (RHEL-96912):
    - Addition of 06-8f-04/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-06/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision
      0xa0000d1;
    - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision
      0x10003a2;
    - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa;
    - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) at revision 0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in
      intel-ucode/06-c6-02) at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision
      0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003707 up to 0x5003901;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904
      up to 0x7002b01;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5
      up to 0xd000404;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0
      up to 0x10002d0;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up
      to 0x26;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6
      up to 0xca;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode from revision
      0xb8 up to 0xbc;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up
      to 0x3c;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up
      to 0x56;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode from revision 0xfc up to 0x100;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38
      up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x436 up to 0x437;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x436 up to 0x437;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x436 up to 0x437;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up
      to 0xa;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436
      up to 0x437;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0x102 up to 0x104;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up
      to 0x100;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe
      up to 0x102;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xfc up to 0x100;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up
      to 0x64;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20
      up to 0x24;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330
      up to 0x3000341;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up
      to 0x12f;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12c up to 0x12f;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124
      up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4124 up to 0x4128;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up
      to 0x1d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291
      up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291
      up to 0x210002a9;


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20241112-1.20250812-1
changelog:
  - Update Intel CPU microcode to microcode-20250812 release
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000404
      up to 0xd000410;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002d0
      up to 0x10002e0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000639 up to 0x2b000643;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000639 up to 0x2b000643;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x24
      up to 0x25;
    - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision
      0xa0000d1 up to 0xa000100;
    - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision
      0x10003a2 up to 0x10003d0;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000341
      up to 0x3000362;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4128 up to 0x4129;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4128 up to 0x4129;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4128
      up to 0x4129;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4128 up to 0x4129;
    - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x11f up
      to 0x123;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x118 up
      to 0x119;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) from revision 0x118 up to 0x119;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x118 up to 0x119;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x118 up to 0x119;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02)
      from revision 0x118 up to 0x119;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision
      0x118 up to 0x119;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x118 up to 0x119;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x118 up to 0x119;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x210002a9 up to 0x210002b3;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002a9
      up to 0x210002b3.


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250512-1
changelog:
  - Add a caveat to provide ability to persistently disable SPR-EE updates
    beyond 0x2b0005c0 on systems where absence of latency spikes
    is more important than lack of the latest CVE mitigations.
    (RHEL-94853)
  - Update Intel CPU microcode to microcode-20250512 release, addresses
    CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420,
    CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012
    (RHEL-91227, RHEL-91242, RHEL-91234):
    - Addition of 06-8f-04/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-06/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision
      0xa0000d1;
    - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision
      0x10003a2;
    - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa;
    - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) at revision 0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in
      intel-ucode/06-c6-02) at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision
      0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003707 up to 0x5003901;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904
      up to 0x7002b01;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5
      up to 0xd000404;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0
      up to 0x10002d0;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up
      to 0x26;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6
      up to 0xca;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode from revision
      0xb8 up to 0xbc;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up
      to 0x3c;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up
      to 0x56;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode from revision 0xfc up to 0x100;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38
      up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x436 up to 0x437;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x436 up to 0x437;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x436 up to 0x437;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up
      to 0xa;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436
      up to 0x437;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0x102 up to 0x104;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up
      to 0x100;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe
      up to 0x102;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xfc up to 0x100;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up
      to 0x64;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20
      up to 0x24;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330
      up to 0x3000341;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up
      to 0x12f;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12c up to 0x12f;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124
      up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4124 up to 0x4128;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up
      to 0x1d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291
      up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291
      up to 0x210002a9;


author: Todd Vierling <todd.vierling@oracle.com> - 4:20250812-1.0.1
changelog:
  - enable use with ueknext and UEK8 kernels
  - don't bother calling dracut if virtualized
  - ensure UEK also rebuilds initramfs
  - enable early update for 06-4f-01
  - enable early and late load on RHCK


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250812-1.20251111-1
changelog:
  - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config
  - Update Intel CPU microcode to microcode-20251111 release (RHEL-128259)
    - Addition of 06-ae-01/0x97 microcode at revision 0x1000273;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000643 up to 0x2b000650;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000401 up to 0x2c000410;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000401 up to 0x2c000410;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000401 up to 0x2c000410;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000401 up to 0x2c000410;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000643 up to 0x2b000650;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x3a up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x3a
      up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x437 up to 0x43a;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x437 up to 0x43a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x437 up to 0x43a;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0xa up
      to 0xb;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x437
      up to 0x43a;
    - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision
      0xa000100 up to 0xa000124;
    - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision
      0x10003d0 up to 0x10003f0;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000362
      up to 0x3000382;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12f up
      to 0x132;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12f up to 0x132;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4129 up to 0x6133;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4129 up to 0x6133;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4129 up to 0x6133;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4129 up to 0x6133;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4129
      up to 0x6133;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4129 up to 0x6133;
    - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x123 up
      to 0x125;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1d up
      to 0x1e;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x3a up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x3a up
      to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x3a up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x3a up
      to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x119 up
      to 0x11a;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) from revision 0x119 up to 0x11a;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02)
      from revision 0x119 up to 0x11a;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision
      0x119 up to 0x11a;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x210002b3 up to 0x210002c0;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002b3
      up to 0x210002c0.


author: Evan Goode <egoode@redhat.com> - 3.10.1-1
changelog:
  - Update to 3.10.1
  - Correct spelling of summary
  - Print more helpful error message when reinstalling non-installed pkg
    Resolves: RHEL-53430


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-6
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-11
changelog:
  - Fix bind-now annocheck failure by passing the proper LDFLAGS to the C++ library
  Resolves: RHEL-33509


author: Lukáš Zaoral <lzaoral@redhat.com> - 8.0-1
changelog:
  - rebase to latest upstream version (RHEL-35944)
  - remove `nano-default-editor` from the specfile (RHEL-30790)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.64.20160912git
changelog:
  - Resolves: #2077846 - net-tools utilities display incorrect statistics for interfaces with 15-character names


author: Vit Mojzis <vmojzis@redhat.com> - 0.30.0-21
changelog:
  - Improve "help/usage" message (RHEL-38477)
  - libnetlabel: fix a header file guard typo
  - netlabel-config: Fix IPv4/IPv6 addresses parsing in nlbl_reset_unlbl()
  - netlabel: Update man page to clarify SELinux labeling
  - tests: add a basic CALIPSO pass through test
  - doc: fix a typo in the netlabel-config man page


author: Pavel Reichl <preichl@redhat.com> - 0.4.2-3
changelog:
  - Actually change License from BSD to LGPL, based on content of COPYING file
  - Convert License tag to SPDX format


author: Phil Sutter <psutter@redhat.com> - 1:1.0.9-1
changelog:
  - Fix devel sub-package description
  - Utilize pyproject-rpm-macros for the python sub-package
  - new version 1.0.9


author: Phil Sutter <psutter@redhat.com> [1.1.1-1.el10]
changelog:
  - monitor: Recognize flowtable add/del events (Phil Sutter) [RHEL-65346]
  - tests: py: Fix for storing payload into missing file (Phil Sutter) [RHEL-65346]
  - json: Support typeof in set and map types (Phil Sutter) [RHEL-65346]
  - json: collapse set element commands from parser (Phil Sutter) [RHEL-65346]
  - doc: extend description of fib expression (Phil Sutter) [RHEL-65346]
  - tests: monitor: fix up test case breakage (Phil Sutter) [RHEL-65346]
  - src: fix extended netlink error reporting with large set elements (Phil Sutter) [RHEL-65346]
  - rule: netlink attribute offset is uint32_t for struct nlerr_loc (Phil Sutter) [RHEL-65346]
  - mnl: update cmd_add_loc() to take struct nlmsghdr (Phil Sutter) [RHEL-65346]
  - mnl: rename to mnl_seqnum_alloc() to mnl_seqnum_inc() (Phil Sutter) [RHEL-65346]
  - src: collapse set element commands from parser (Phil Sutter) [RHEL-65346]
  - libnftables-json: fix raw payload expression documentation (Phil Sutter) [RHEL-65346]
  - tests: shell: fix spurious dump failure in vmap timeout test (Phil Sutter) [RHEL-65346]
  - Rebase onto version 1.1.1 (Phil Sutter) [RHEL-65346]


author: Phil Sutter <psutter@redhat.com> [1.1.1-5.el10]
changelog:
  - src: add conntrack information to trace monitor mode (Phil Sutter) [RHEL-102994]
  - src: split monitor trace code into new trace.c (Phil Sutter) [RHEL-102994]


author: Phil Sutter <psutter@redhat.com> [1.1.1-6.el10]
changelog:
  - Makefile: Fix for 'make CFLAGS=...' (Phil Sutter) [RHEL-108851]
  - table: Embed creating nft version into userdata (Phil Sutter) [RHEL-108851]
  - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-106743]
  - trace: Fix for memleak in trace_alloc_list() error path (Phil Sutter) [RHEL-111205]


author: Lukáš Zaoral <lzaoral@redhat.com> - 0.5-42.20150602git
changelog:
  - recognize the -m option
  - modernize the specfile
      - use recommended systemd macros
      - fix manual pages installation
      - sort file list and BuildRequires
      - use modern make macros
      - simplify %install section


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.1-4
changelog:
  - Install NetworkManager override for nbft interfaces
  - Rename reconnect NetworkManager hook to 99-nvme-nbft-connect.sh


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-8.el6
changelog:
  - BUILDINFO: commit=f0e130273b7eed12385e1d0aa7704b414bceeff0
  - vendor: rhel5: fix build failure (Junxiao Bi)
  - tunefs.ocfs2: fix double free bug (Junxiao Bi)
  - fsck.ocfs2: the members of 'o2fsck_state' need to be freed at the end of main() (Jun Piao)
  - fsck.ocfs2: fix the mistake of clearing valid flag in o2fsck_check_blocks() (Jun Piao)
  - mkfs.ocfs2: disable append-dio feature by default (Junxiao Bi)
  - fsck.ocfs2: support append direct io incompat feature (Joseph Qi)
  - tunefs.ocfs2: support append direct io incompat feature (Joseph Qi)
  - mkfs.ocfs2: support append direct io incompat feature (Joseph Qi)
  - mkfs.ocfs2: clean up deadcode in is_cluster_info_valid() (Jun Piao)
  - fsck.ocfs2: return error if o2fsck_check_journals fails (Joseph Qi)
  - ocfs2: fix cluster unlocked if journal is replayed (Joseph Qi)
  - fsck.ocfs2: close ost_fs in case of check superblock fails (Joseph Qi)
  - mkfs.ocfs2: fix a potential segment fault in main() (Jun Piao)
  - fsck.ocfs2: clean up useless assignment in dup_insert() (piaojun)
  - o2info: clean up useless branch in o2info_append_task() (piaojun)
  - tunefs.ocfs2: fix the parameter misuse of tunefs_dlm_lock (Weiwei Wang)
  - debugfs.ocfs2: encode 'M' lockname with generation only for sysfile (piaojun)
  - mkfs.ocfs2: fix memory leak problems in main() (piaojun)
  - tunefs.ocfs2: fix memory leak problems in tunefs_journal_check() and parse_options() (piaojun)
  - o2image: fix a memory leak problem in ocfs2_image_free_bitmap() (piaojun)
  - debugfs.ocfs2: fix NULL pointer dereference risk in dump_dir_entry (Joseph Qi)
  - o2image: clean up unused variable 'install_flag' in o2image_initialize() (piaojun)
  - libocfs2: close fd if read fails in create_generation (Joseph Qi)
  - o2image: Free 'filepath' before return in prompt_image_creation() (Jun Piao)
  - libocfs2: fix risk of using uninitialized variables (Joseph Qi)
  - mkfs.ocfs2: fix command line segfault (Valentin Vidic)
  - debugfs.ocfs2: fix command line segfault (Valentin Vidic)
  - Update udev rule for newer kernels (Valentin Vidic)
  - ocfs2-tools: add support for vd devices (Valentin Vidić)
  - fsck.ocfs2: Free 'ci' in each cycle of for loop in check_journal_walk (Jun Piao)


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-9.el6
changelog:
  - BUILDINFO: commit=8b8e9d3b017f6e9bb23bd137878669831eec0f4d
  - o2cb.service: drop unknown lvalue ExecRestart (Junxiao Bi)


author: Ashish Samant <ashish.samant@oracle.com> - 1.8.6-11
changelog:
  - tunefs.ocfs2: read journal superblock even for online operations (Ashish
    Samant)  [Orabug: 28804934]


author: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com> - 1.8.6-15
changelog:
  - fsck.ocfs2: Avoid taking all available physical pages for cache (Gautham
    Ananthakrishna)  [Orabug: 31069094]


author: Than Ngo <than@redhat.com> - 3.23.0-1
changelog:
  - 3.23.0
     * EP11: Add support for FIPS-session mode
     * Updates to harden against RSA timing attacks
     * Bug fixes


author: Than Ngo <than@redhat.com> - 3.24.0-1
changelog:
  - Resolves: RHEL-58996, update to 3.24.0
  - Resolves: RHEL-39004, provide opencryptoki CCA Token also on x86_64 and ppc64le
  - Resolves: RHEL-43675, openCryptoki cca token RSA OAEP v2.1 support
  - Resolves: RHEL-43674, openCryptoki CCA token support of Dilithium
  - Resolves: RHEL-43676, openCryptoki cca token SHA3 support
  - Resolves: RHEL-24036, support protected keys for extractable keys


author: Than Ngo <than@redhat.com> - 3.24.0-5
changelog:
  - Use systemd-sysusers
  - Modifie the unit file to change file ownership
  - opencryptoki doesn't work in image mode
    Resolves: RHEL-77146


author: Than Ngo <than@redhat.com> - 3.24.0-7
changelog:
  - Resolves: RHEL-80632, tokens are deleted on reboot
  - Related: RHEL-77146, opencryptoki doesn't work in image mode


author: Than Ngo <than@redhat.com> - 3.25.0-1
changelog:
  - Resolves: RHEL-85376, ep11 token: PKCS #11 3.0 - support SHA3
  - Resolves: RHEL-90589, CCA token: basic support of AES-GCM
  - Resolves: RHEL-72964, cca token support cipher keys
  - Resolves: RHEL-72968, Support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens
  - Resolves: RHEL-73343, Upgrade openCryptoki to latest version
  - Resolves: RHEL-75144, p11kmip: a tool to import/export PKCS #11 keys from to a KMIP server
  - Resolves: RHEL-75761, ep11 token: import and export of secure key objects
  - Resolves: RHEL-85374, cca token: Support ECDH to derive AES keys


author: Than Ngo <than@redhat.com> - 3.25.0-2
changelog:
  - Related: RHEL-73343, Fix detection of EC curve not supported by OpenSSL-3.5.x
  - Related: RHEL-77146, Fix the image mode issue again as bootc expects to use /run/lock


author: Than Ngo <than@redhat.com> - 3.25.0-3
changelog:
  - Fix incorrect effective group id of pkcsslotd daemon
  - Fix covscan findings
    Resolves: RHEL-104598


author: Than Ngo <than@redhat.com> - 3.25.0-5.1
changelog:
  - Fix unwrapping of attribute bound EC keys
  - Fix private secure key blob import
    Resolves: RHEL-131645


author: Simon Pichugin <spichugi@redhat.com> - 2.6.7-1
changelog:
  - Rebase to version 2.6.7 (rhbz#2261163)
  - Use systemd-sysusers for ldap user and group (rhbz#2173965)
  - Fix compiler errors (rhbz#2261427)
  - Replace License with SPDX identifier


author: Simon Pichugin <spichugi@redhat.com> - 2.6.7-2
changelog:
  - Remove libslapi from the main package (RHEL-35581)
  - Add "servers" conditional which includes libslapi


author: Simon Pichugin <spichugi@redhat.com> - 2.6.8-1
changelog:
  - Rebase to version 2.6.8 (RHEL-71052)
  - Avoid SSL context cleanup during library destruction (RHEL-68424)


author: Veronika Hanulikova <vhanulik@redhat.com> - 0.26.1-1
changelog:
  - Rebase to new upstream release (RHEL-71523)
  - Separate OpenSC into libraries and binaries (RHEL-73314)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-5
changelog:
  - Fix regression of Match directive processing
    Resolves: RHEL-76317
  - Avoid linking issues for openssl logging
    Related: RHEL-63190


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-6
changelog:
  - Fix regression of Match directive processing
    Related: RHEL-76317
  - Fix missing error codes set and invalid error code checks in OpenSSH. It
    prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
    is on (CVE-2025-26465, CVE-2025-26466).
    Resolves: RHEL-78699
    Resolves: RHEL-78943


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-8
changelog:
  - OpenSSH should not use its own implementation of MLKEM
    Resolves: RHEL-58252
  - Correct processing of Compression directive
    Resolves: RHEL-68346
  - Supress systemd warning
    Resolves: RHEL-84816


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-9
changelog:
  - CVE-2025-32728: Fix logic error in DisableForwarding option
    Resolves: RHEL-86819
  - Provide better error for non-supported private keys
    Resolves: RHEL-68124
  - Ignore bad hostkeys in known_hosts file
    Resolves: RHEL-83644


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-12
changelog:
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-128397
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-128387


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-1
changelog:
  - Update to OpenSSH 9.9p1
    Resolves: RHEL-60564
  - Separate ssh-keysign to a dedicated package
    Resolves: RHEL-62112
  - Use FIPS KEX defaults in FIPS mode
    Resolves: RHEL-58986


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-2
changelog:
  - Resolve memory management issues after rebase
    Related: RHEL-60564
  - Add extra help information on ssh early failure
    Resolves: RHEL-62718


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-3
changelog:
  - Extra help information should not be printed if stderr is not a TTY
    Resolves: RHEL-63061
  - Provide details on crypto error instead of "error in libcrypto"
    Resolves: RHEL-63190


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-10
changelog:
  - Use PBMAC1 by default when creating PKCS#12 files in FIPS mode
    Related: RHEL-36659
  - Support key encapsulation/decapsulation in openssl pkeyutl command
    Resolves: RHEL-54156
  - Fix typo in the patch numeration
    Related: RHEL-41261
  - Enable KTLS, temporary disable KTLS tests
    Related: RHEL-47335
  - Speedup SSL_add_{file,dir}_cert_subjects_to_stack
    Resolves: RHEL-54232
  - Resolve SAST package scan results
    Resolves: RHEL-37561


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-15
changelog:
  - Fix providers no_cache behavior
    Resolves: RHEL-71903
  - Fix pkcs12 command line segfault
    Resolves: RHEL-70878
  - Print key exchange group for hybrid PQC
    Resolves: RHEL-66163
  - Ensure correct fips.so checksum calculation
    Resolves: RHEL-73170
  - Locally configured providers should not interfere with openssl build-time tests
    Resolves: RHEL-76182
  - Load system default cipher string from crypto-policies configuration file
    include /etc/crypto-policies/back-ends/opensslcnf.config and remove
    /etc/crypto-policies/back-ends/openssl.config.
    Resolves: RHEL-71132


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-16
changelog:
  - Fix timing side-channel in ECDSA signature computation (CVE-2024-13176)
    Resolves: RHEL-70879
  - Load system default cipher string from crypto-policies configuration file
    should ignore errors.
    Related: RHEL-71132
  - RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
    Resolves: RHEL-76754
  - Fix segfault on printing the temp key from s_client when connection is not established
    Resolves: RHEL-79045


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-3
changelog:
  - Fix `openssl speed` running in FIPS mode
    Resolves: RHEL-88908
  - pkeyutl ecdsa signature with sha1 shouldn't work by default
    Resolves: RHEL-88911
  - Expose settable params for EVP_SKEY
    Resolves: RHEL-88913
  - Restore RHEL9-style indicators defines
    Resolves: RHEL-88906
  - Enable sslkeylog support
    Resolves: RHEL-90853
  - Fix UEFI builds
    Resolves: RHEL-89137


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-4
changelog:
  - Fix regressions caused by rebase to OpenSSL 3.5
    Related: RHEL-80811
  - Fix UEFI builds on double function definitions
    Resolves: RHEL-93168


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-5
changelog:
  - Compact patches for better maintainability
    Related: RHEL-80811
  - Make hybrid MLKEM work with our FIPS provider (3.0.7)
    Resolves: RHEL-94614


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.1-1
changelog:
  - Rebasing to OpenSSL 3.5.1
    Resolves: RHEL-90350
    Resolves: RHEL-95613
    Resolves: RHEL-97796
    Resolves: RHEL-99353
    Resolves: RHEL-100168


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-2
changelog:
  - Move fips.so to a seprate subpackage
    Reverts FIPS self test for SLH-DSA
    Add Suggests to try to prefer the openssl-fips-provider package
    over the fips-provider-next package by default
    Revolves: RHEL-102408
    Related: RHEL-80811


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-3
changelog:
  - Add custom define to disable symbol versioning in downstream patched code
    Also add stricter Suggests for openssl-fips-provider
    Resolves: RHEL-101548
  - Fix Requires/Provider to fix default install of fips providers
    Resolves: RHEL-105010


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.1-7
changelog:
  - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469
    CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420
    CVE-2025-69421 CVE-2026-22795 CVE-2026-22796
    Resolves: RHEL-142062
    Resolves: RHEL-141985
    Resolves: RHEL-142053
    Resolves: RHEL-142049
    Resolves: RHEL-142045
    Resolves: RHEL-142041
    Resolves: RHEL-142037
    Resolves: RHEL-142033
    Resolves: RHEL-142029
    Resolves: RHEL-142008
    Resolves: RHEL-142025
    Resolves: RHEL-142021


author: Simo Sorce <ssorce@redhat.com> - 3.0.7-3
changelog:
  - Change tarball source contents
  - Rework file extraction process
  - Fixes debug packages
    Resolves: RHEL-32123


author: Simo Sorce <ssorce@redhat.com> - 3.0.7-5
changelog:
  - Add an empty metapackage and proper requires to correctly
    handle upgrades.
    Related: RHEL-32123


author: Craig Guiller <craig.guiller@oracle.com> - 3.0.7-6.0.1
changelog:
  - Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files
  - Update extract-src.sh script to support non-hobbled openssl tarball


author: EL Errata <el-errata_ww@oracle.com> - 3.0.7-8.0.1
changelog:
  - Update RPM dependencies for openssl v3.5.1 [Orabug: 38342295]
  - Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files
  - Update extract-src.sh script to support non-hobbled openssl tarball


author: Ray Strode <rstrode@redhat.com> - 90.2-1
changelog:
  - Strip RHEL 8 branding and use graytones until until RHEL 9 branding is available
    Resolves: #1975387


author: Darren Archibald <darren.archibald@oracle.com> - 10-1.0.2
changelog:
  - Replaced upstream references [Orabug: 34032132]
  - Add redhat-indexhtml Obsoletes and Provides.
  - Oracle rebranding.


author: Alan Steinberg <alan.steinberg@oracle.com> - 10.1-1.0.3
changelog:
  - Updated released notes for OL10.1 GA.
  - Updated SWID tags for OL10.1 GA.
  - Updated /var/lib/supportinfo to show correct minimum RAM value [Orabug: 38637697]


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-2
changelog:
  - Fix static analyzer detected issues. Resolves: RHEL-36475
  - pam_env: fixes for NULL environment variables


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-6
changelog:
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-65223


author: Brian C. Lane <bcl@redhat.com> - 3.5-11
changelog:
  - parted: Fix ending sector location when using kibi IEC suffix (bcl)
  - tests: Fix formatting and snprintf warnings in tests. (bcl)
  - ui: Add checks for prompt being NULL (bcl)
  - strlist: Handle realloc error in wchar_to_str (bcl)
  - libparted: Fix potential NULL dereference in ped_disk_next_partition (bcl)
  - filesys: Check for null from close_fn (bcl)


author: Brian C. Lane <bcl@redhat.com> - 3.5.28-1
changelog:
  - Upstream 3.5.28 Alpha release
  - Dropped all patches included in new upstream release
  - Bumped minor version on libparted.so and libparted-fs-resize.so


author: Brian C. Lane <bcl@redhat.com> - 3.6-7
changelog:
  - tests: Add test for dvh with a bad checksum (bcl)
    Related: RHEL-73220
  - libparted: Fix dvh disklabel unhandled exception (bcl)
    Related: RHEL-73220
  - tests: Add test for SUN disklabel handling (bcl)
    Related: RHEL-73220
  - libparted: Fix sun disklabel unhandled exception (bcl)
    Resolves: RHEL-73220


author: Gulam Mohamed <gulam.mohamed@oracle.com> - 3.6-7.0.1
changelog:
  - Fix race between systemd and parted command [Orabug: 38651793]
  - Add test to detect race between parted and systemd


author: Michal Hlavinka <mhlavink@redhat.com> - 3.13.0-1
changelog:
  - updated to 3.13, adds support for cxl1.1 device link status information (#RHEL-29153)
  - add riscv64 build support (#RHEL-40383)


author: Jan Rybar <jrybar@redhat.com> - 125-4
changelog:
  - changing log level via dbus is now restricted to root
  - backport of https://github.com/polkit-org/polkit/commit/5a4ba7dfdcc3f
  - Resolves: RHEL-90807


author: Jan Rybar <jrybar@redhat.com> - 0.1-26
changelog:
  - use build macros, on behalf of original author Tom Stellard (tstellar)
  - Pagure doesn't allow one-click rebase, AFAIK


author: Jan Rybar <jrybar@redhat.com> - 6.6.4-17
changelog:
  - migrate to autosetup; convert specfile script to a patch
  - FORTIFY_SOURCE_3 detected a buffer overflow
  - Resolves: bz#2190057


author: Miro Hrončok <mhroncok@redhat.com> - 23.3.1-5
changelog:
  - Switched to autogenerated BuildRequires for test dependencies,
    which removed some that were no longer necessary


author: Charalampos Stratakis <cstratak@redhat.com> - 23.3.2-2
changelog:
  - Use tarfile.data_filter for extracting (CVE-2007-4559, PEP-721, PEP-706)
  - Require Python with tarfile filters
  - Resolves: RHEL-25820


author: Miro Hrončok <mhroncok@redhat.com> - 2.28.2-7
changelog:
  - Do not package requests[security] and requests[socks] on RHEL
  - Make the package build even when urllib3 won't pull in pysocks


author: Lumír Balhar <lbalhar@redhat.com> - 2.32.3-1
changelog:
  - Update to 2.32.3
  - Fix for CVE-2024-35195
  Resolves: RHEL-37604
  - Add support for IPv6 CIDR in no_proxy setting
  Resolves: RHEL-32523


author: Miro Hrončok <mhroncok@redhat.com> - 2.32.4-1
changelog:
  - Update to 2.32.4
  - Security fix for CVE-2024-47081: .netrc credentials leak via malicious URLs
  Resolves: RHEL-105460


author: Miro Hrončok <mhroncok@redhat.com> - 1.26.19-2.1
changelog:
  - Security fix for CVE-2025-66471
  - Security fix for CVE-2025-66418
  - Security fix for CVE-2026-21441
  Resolves: RHEL-139387


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Security fix for CVE-2024-9287 and CVE-2024-12254
  Resolves: RHEL-64877, RHEL-70450


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-3
changelog:
  - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
  - This fixes random flakiness of test_ssl on stressed machines
  Resolves: RHEL-90555


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
changelog:
  - Update to 3.12.11
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98060, RHEL-98047, RHEL-97813, RHEL-98062, RHEL-98180


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-3.1
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143054 RHEL-143105 RHEL-144852


author: Akshata Konala <akshata.konala@oracle.com> - 3.12.9-2.2
changelog:
  - Enable PAC and BTI protections for aarch64
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  - Resolves: RHEL-98058, RHEL-98020, RHEL-97809, RHEL-98184, RHEL-98211


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-3
changelog:
  - Fix potential use of uninitialized pipe array (RHEL-54012)
  - Fix potential use of uninitialized pgp struct (RHEL-54013)
  - Fix memory leak in rpmsign(8) (RHEL-37564)


author: Panu Matilainen <pmatilai@redhat.com> - 4.19.1.1-4
changelog:
  - Remove hardcoded GPG references from signing error messages
  - Support switching between GnuPG and Sequoia for package signing (RHEL-56363)


author: Panu Matilainen <pmatilai@redhat.com> - 4.19.1.1-9
changelog:
  - Revert the gnupg/sequoia sub-packages, too much headache
  - Ship sequoia-signing enablement macros as documentation instead
  - Generate binary signatures with Sequoia too


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-10
changelog:
  - Report unsafe symlinks during installation as a specific case (RHEL-73186)
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-54386)
  - Rebuild for ima-evm-utils 1.6 soname bump (RHEL-65378)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-11
changelog:
  - Fix possible package corruption on --delsign/resign/addsign (RHEL-69518)
  - Fix regression on build-id generation from compressed ELF (RHEL-54000)
  - Fix root relocation regression (RHEL-56613)
  - Update sequoia macros for sq 1.0 (RHEL-56363)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-13
changelog:
  - Make %_passwd_path and %_group_path into lists (RHEL-78693)
  - Fix memory leak in rpmspec --shell (RHEL-55284)
  - Fix memory leak in rpmsign (RHEL-82284)
  - Fix command references in rpmsign(8) man page (RHEL-73173)
  - Fix exit code regression on update failure (RHEL-87384)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-14
changelog:
  - Store configurable digest(s) on packages in rpmdb (RHEL-84062)
  - Fix command references in rpmsign(8) man page, take II (RHEL-73173)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-15
changelog:
  - Add support for spec local file attributes and generators (RHEL-84057)
  - Ensure binary and source headers are identified as such (RHEL-87383)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-18
changelog:
  - Add support for multiple OpenPGP signatures per package (RHEL-100571)
  - Add support for OpenPGP v6 signature pre-salting (RHEL-100571)
  - Add support for PQC algorithms from RFC-9580 (RHEL-100571)
  - Add --list and --erase commands to rpmkeys(8) (RHEL-105421)
  - Fix regression on dynamic subpackage RPMTAG_SOURCERPM missing (RHEL-102023)


author: Petr Lautrbach <lautrbach@redhat.com> - 4.4.2-4
changelog:
  - Disable/remove neverallow options in sediff.
  - Improve man pages
  - seinfoflow: Add -r option to get flows into the source type.
  - seinfoflow.1: Remove references to sepolgen permission map.
  - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy.
  - SELinuxPolicy: Add explicit cast for libspol message


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-5
changelog:
  - Split packages for variable fonts.
  - Drop unnecessary/duplicate fonts from packages.
  - Worked around broken family name in variable fonts.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-8
changelog:
  - Use no VF in family name version of ttf for -vf packages.
  - Adjust properties in VF to avoid confusion.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-11
changelog:
  - Add a provide line of font(redhatdisplayvf), font(redhattextvf),
    and font(redhatmonovf) to each sub-packages for backward compatibility.
  - Fix invalid License field.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-14
changelog:
  - Remove Italic variable fonts to workaround a crash issue
    and unexpected italic rendering.
    Resolves: RHEL-69430


author: Mark Will <mark.will@oracle.com> - 10.0-14.4.0.1
changelog:
  - Removed Secure Boot Signing certs
  - Set the epoch to prevent upgrade conflict with OL7 version [Orabug: 20681742]
  - Remove Provides: system-release and base-module platform as this is provided by oraclelinux-release
  - Remove content provided by oraclelinux-release package


author: Stephen Gallagher <sgallagh@redhat.com> - 1:0.4-0.54.b47
changelog:
  - Fixes for -WError=implicit-function-declaration on RHEL
  - Reinstates the dump headers without compiling the implementations


author: Vladis Dronov <vdronov@redhat.com> - 6.17-2
changelog:
  - Add Intel CET IBT instrumentation to assembly code
  - Update to the upstream v6.17 @ ac43f912 (RHEL-36771)


author: Michal Ruprich <mruprich@redhat.com> - 3.4.1-1
changelog:
  - New version 3.4.1
  - Resolves: RHEL-70151 - Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
  - Resolves: RHEL-70159 - Info Leak via Uninitialized Stack Contents
  - Resolves: RHEL-70203 - rsync server leaks arbitrary client files
  - Resolves: RHEL-72500 - Path traversal vulnerability in rsync
  - Resolves: RHEL-72501 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-71658 - Race Condition in rsync Handling Symbolic Links
  - Resolves: RHEL-71293 - Build rsync with --with-rrsync


author: Paolo Bonzini <pbonzini@redhat.com> - 4.9-1
changelog:
  - Rebase to 4.9
  - Update downstream patches
  - Resolves: rhbz#2140486
  - Remove change to gnulib tests, they pass anyway
  - Install valgrind and langpacks to increase test coverage


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.20-1
changelog:
  - Allow virtqemud domain transition on numad execution
  Resolves: RHEL-65789
  - Support virt live migration using ssh
  Resolves: RHEL-53972
  - Allow ssh_t read systemd config files
  Resolves: RHEL-53972
  - Allow virtqemud permissions needed for live migration
  Resolves: RHEL-43217
  - Allow virtqemud the getpgid process permission
  Resolves: RHEL-46357
  - Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  Resolves: RHEL-71068
  - Allow virtqemud relabelfrom virt_log_t files
  Resolves: RHEL-48236
  - Allow virtqemud relabel tun_socket
  Resolves: RHEL-71394
  - Allow gnome-remote-desktop dbus chat with policykit
  Resolves: RHEL-35877
  - Update ktlsh policy
  Resolves: RHEL-42672
  - Confine the ktls service
  Resolves: RHEL-42672
  - Allow request-key to read /etc/passwd
  Resolves: RHEL-71490
  - Allow request-key to manage all domains' keys
  Resolves: RHEL-71490


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.21-1
changelog:
  - Allow init create vsock socket for sshd
  Resolves: RHEL-72549
  - Support ssh connections via systemd-ssh-generator
  Resolves: RHEL-72549
  - Allow ssh generator work with systemd unit files
  Resolves: RHEL-72549
  - Confine systemd system-ssh-generator
  Resolves: RHEL-72549
  - Allow login_userdomain getattr nsfs files
  Resolves: RHEL-72549
  - Allow virtqemud send a generic signal to the ssh client domain
  Resolves: RHEL-53972
  - Add the auth_dontaudit_read_passwd_file() interface
  Resolves: RHEL-71490
  - Dontaudit request-key read /etc/passwd
  Resolves: RHEL-71490


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.22-1
changelog:
  - Allow staff user dbus chat with virt-dbus
  Resolves: RHEL-73914
  - Allow virtqemud domain transition to nbdkit
  Resolves: RHEL-69118
  - Add nbdkit interfaces defined conditionally
  Resolves: RHEL-69118
  - Allow svirt_t read sysfs files
  Resolves: RHEL-71270
  - Label /dev/pmem[0-9]+ with fixed_disk_device_t
  Resolves: RHEL-71656
  - Add support for the KVM guest memfd anon inodes
  Resolves: RHEL-69128
  - Allow sysadm user dbus chat with virt-dbus
  Resolves: RHEL-73914
  - Allow initrc_t transition to passwd_t
  Resolves: RHEL-71665
  - Allow unconfined_service_t transition to passwd_t
  Resolves: RHEL-71665


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.23-1
changelog:
  - Remove the lockdown class from the policy
  Resolves: RHEL-36741
  - Remove socket from unconfined_domain_type allow rule
  Resolves: RHEL-36741
  - Include key_socket in socket_class_set
  Resolves: RHEL-36741


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.24-1
changelog:
  - Allow systemd-generator connect to syslog over a unix datagram socket
  Resolves: RHEL-75879
  - Allow ssh_t to change role to system_r
  Resolves: RHEL-53972
  - Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  Resolves: RHEL-39893
  - Allow virtqemud manage fixed disk device nodes
  Resolves: RHEL-71656
  - Allow samba-bgqd connect to cupsd over an unix domain stream socket
  Resolves: RHEL-72861
  - Allow systemd-machined read the vsock device
  Resolves: RHEL-74280
  - Allow pcmsensor write nmi_watchdog state information
  Resolves: RHEL-52838
  - Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  Resolves: RHEL-52838


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.25-1
changelog:
  - Update ktlshd policy to read /proc/keys and domain keyrings
  Resolves: RHEL-42672
  - Allow pcmsensor read nmi_watchdog state information
  Resolves: RHEL-52838
  - Support peer-to-peer migration of vms using ssh
  Resolves: RHEL-77351
  - Allow virt_domain read hardware state information unconditionally
  Resolves: RHEL-71270
  - Allow timemaster write to sysfs files
  Resolves: RHEL-44637
  - Allow virtqemud map svirt_image_t plain files
  Resolves: RHEL-40080
  - Allow virtqemud unmount a filesystem with extended attributes
  Resolves: RHEL-40080
  - Allow virtqemud work with nvdimm devices
  Resolves: RHEL-71656
  - Update virtqemud policy regarding the svirt_tcg_t domain
  Resolves: RHEL-71270
  - Allow virtqemud use hostdev usb devices conditionally
  Resolves: RHEL-74230
  - Support saving and restoring a VM to/from a block device
  Resolves: RHEL-76138
  - Allow virtnwfilterd dbus chat with firewalld
  Resolves: RHEL-76138
  - Allow virt_domain to use pulseaudio - conditional
  Resolves: RHEL-62763
  - Allow virtstoraged write to sysfs files
  Resolves: RHEL-44637
  - Allow irqbalance to run unconfined scripts conditionally
  Resolves: RHEL-54019
  - Allow rhsmcertd notify virt-who
  Resolves: RHEL-77114
  - Allow init mounton crypto sysctl files
  Resolves: RHEL-56250


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.26-1
changelog:
  - Rename winbind_rpcd_* types to samba_dcerpcd_*
  Resolves: RHEL-14759
  - Allow samba-dcerpcd work with ctdb cluster
  Resolves: RHEL-14759
  - Revert "Remove socket from unconfined_domain_type allow rule"
  Resolves: RHEL-77327
  - Dontaudit access of virt-related permissive domains
  Resolves: RHEL-77808
  - Add selinux_requires_min macro
  Resolves: RHEL-54715
  - Filter out EPEL related modules
  Resolves: RHEL-73505


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com>- 40.13.26-1.0.1
changelog:
  - Allow systemd_fstab_generator_t to read udev pid files [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to read sysfs filesystem [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to get attributs of fixed_disk_device_t and
    removable_device_t [Orabug: 37139639]
  - Change reference in /etc/selinux/config to point to Oracle doc [Orabug: 36899915]
  - Allow user_mail_domain to manage exim_log_t and exim_spool_t link files [Orabug: 36617121]
  - Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36430005]
  - Allow cgred_t to get attributes of cgroup filesystems [Orabug: 36176655]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make lsmd and rngd work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.3-1
changelog:
  - Allow svirt read virtqemud fifo files
  Resolves: RHEL-104069
  - Allow virtqemud handle virt_content_t chr files
  Resolves: RHEL-76104
  - Allow "hostapd_cli ping" run as a systemd service
  Resolves: RHEL-77047
  - All sblim-sfcbd the dac_read_search capability
  Resolves: RHEL-98287
  - Allow sblim domain read systemd session files
  Resolves: RHEL-98287
  - Allow sblim-sfcbd execute dnsdomainname
  Resolves: RHEL-98287
  - Allow systemd-importd create and unlink init pid socket
  Resolves: RHEL-98490


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.4-1
changelog:
  - Allow systemd-coredump the sys_chroot capability
  Resolves: RHEL-97586
  - Add the rhcd_rw_fifo_files() interface
  Related: RHEL-99318
  - Add insights_client_delete_lib_dirs() interface
  Related: RHEL-99318


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.5-1
changelog:
  - Confine nfs-server generator
  Resolves: RHEL-106119
  - Support virtqemud handle hotplug hostdev devices
  Resolves: RHEL-65266
  - Allow virtstoraged create qemu /var/run files
  Resolves: RHEL-104344
  - Allow virtqemud write to sysfs files
  Resolves: RHEL-104378
  - Allow unconfined_domain_type cap2_userns capabilities
  Resolves: RHEL-93656


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.6-1
changelog:
  - Apply generator template to selinux-autorelabel generator
  Resolves: RHEL-107516
  - Allow systemd-coredumpd capabilities in the user namespace
  Resolves: RHEL-97586
  - Allow virtqemud start a vm which uses nbdkit
  Resolves: RHEL-69118
  - Add nbdkit_signal() and nbdkit_signull() interfaces
  Resolves: RHEL-69118
  - Allow openvswitch read virtqemud process state
  Resolves: RHEL-65322
  - Add binsbin-convert.sh script
  Resolves: RHEL-69118


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.7-1
changelog:
  - Revert "Add policy for insights-core"
  Resolves: RHEL-110651
  - Revert "Add insights_core interfaces"
  Resolves: RHEL-110651


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com>- 42.1.7-1.0.1
changelog:
  - Allow systemd_fstab_generator_t to read udev pid files [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to read sysfs filesystem [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to get attributs of fixed_disk_device_t and
    removable_device_t [Orabug: 37139639]
  - Change reference in /etc/selinux/config to point to Oracle doc [Orabug: 36899915]
  - Allow user_mail_domain to manage exim_log_t and exim_spool_t link files [Orabug: 36617121]
  - Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36430005]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make lsmd and rngd work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Ilya Okomin <ilya.okomin@oracle.com> - 42.1.7-1.0.2
changelog:
  - Fix specfile triggers for fapolicyd and usbguard DSP modules [Orabug: 38681740] [Orabug: 38579739]


author: EL Errata <el-errata_ww@oracle.com> - 42.1.7-1.0.2.el10_1.1
changelog:
  - Fix specfile triggers for fapolicyd and usbguard DSP modules [Orabug: 38681740] [Orabug: 38579739]
  - Allow systemd_fstab_generator_t to read udev pid files [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to read sysfs filesystem [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to get attributs of fixed_disk_device_t and
    removable_device_t [Orabug: 37139639]
  - Change reference in /etc/selinux/config to point to Oracle doc [Orabug: 36899915]
  - Allow user_mail_domain to manage exim_log_t and exim_spool_t link files [Orabug: 36617121]
  - Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36430005]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make lsmd and rngd work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Vit Mojzis <vmojzis@redhat.com> - 42.1.7-1.2
changelog:
  - Update specfile triggers for DSP modules (RHEL-132492)
  - Update specfile trigger for smartmontools
  - Update specfile trigger for openwsman
  - Move triggerin scriptlets to the parent packages (RHEL-150914)
  - Rebuild policy before running {binsbin|varrun}-convert.sh (RHEL-128498)


author: Martin Osvald <mosvald@redhat.com> - 2.14.3-1
changelog:
  - sysusers.d: add script and generate configuration fragment for users
  - Add fallback to hostname determination for csh.login (rhbz#2079768)
  - Remove ancient Conflicts
  - files: mark /run/motd as an ephemeral ghost entry


author: Martin Osvald <mosvald@redhat.com> - 2.14.4-1
changelog:
  - protocols: add mptcp (262)
  - setup.spec: make setup protected package (rhbz#2155547)
  - setup.spec: don't report rpm -Va error on /run/motd (rhbz#2160954)
  - services: replace hostmon with llmnr for port 5355 (rhbz#2216914)


author: Martin Osvald <mosvald@redhat.com> - 2.14.5-1
changelog:
  - bashrc: switch PROMPT_COMMAND to be an array (rhbz#2097525)
  - profile: don't overwrite the HISTSIZE environment variable
  - hosts: use "example.org" as example domain (rhbz#2246220)
  - csh.login: source csh.local (RHEL-17226)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.48-7
changelog:
  - udev rules: avoid spurious warning for non-SCSI devices (RHEL-40861,RHEL-54607)
  - Install missing 00-scsi-sg3_config.rules
  - Fix file references to other udev rules


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
changelog:
  - passwd: Provide binary from this package. Enable libpam and
    disable account-tools-setuid. Provide passwd PAM service file.
    Resolves: #2233275
  - passwd: provide --stdin option


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
changelog:
  - Rebase to version 4.15.0
  - getdef: avoid spurious error messages about unknown configuration options


author: Milan Crha <mcrha@redhat.com> - 2.3-6
changelog:
  - Co-own /usr/share/gettext and /usr/share/gettext/its
  - Related to rhbz#2280150
  - Resolves: RHEL-38682 (Backport Fedora 40 changes)


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.6-1.0.4
changelog:
  - Rebase to shim v15.6-1 [Orabug: 34821869]
  - Update vendor certs [Orabug: 34821869]
  - Update oracle(grub2-sig-key) [Orabug: 34821869]
  - Update shim-unsigned to v15.6-1.0.3 [Orabug: 34821869]


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.7-1.0.3
changelog:
  - Update to shim-unsigned v15.7-1.0.2 [Orabug: 34821869]
  - Update shimx64.efi and shimaa64.efi signed by Microsoft [Orabug: 34821869]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 15.8-1.0.1
changelog:
  - Update to 15.8 [Orabug: 36072879]
  - fix CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 [Orabug: 36072879]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 15.8-1.0.2
changelog:
  - Use binaries with correct shim.ol generation [Orabug: 36072879]
  - Set SBAT_AUTOMATIC_DATE=2021030218 [Orabug: 36072879]


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.8-1.0.3
changelog:
  - Update shimx64.efi and shimaa64.efi v15.8 signed by Microsoft [Orabug: 36072879]
  - Update shim fb and mm binaries to match unsigned releases [Orabug: 36072879]


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.8-1.0.7
changelog:
  - Add support for Oracle signed shim [Orabug: 38029694]
  - Add vendor shim binaries signed with Oracle Secure Boot Signing (key 2) [Orabug: 38029694]


author: Ilya Okomin <ilya.okomin@oracle.com> - 16.1-1.0.2.el10
changelog:
  - Update shimx64.efi and shimaa64.efi v16.1 signed by Microsoft [Orabug: 38397604]
  - Update vendor shim v16.1 binaries signed with Oracle Secure Boot Signing (key 2) [Orabug: 38397604]


author: Craig Guiller <craig.guiller@oracle.com> - 4.10.0-4.0.1
changelog:
  - Disable all upload options [Orabug: 37854589]
  - Update the enabled and skipped plugins lists to match ExaDatas requirements. [Orabug: 37440321]
  - Add Keyboard exception handler to collector [Orabug: 37854316]
  - Print stack of all un-interrupted process [Orabug: 37713383]
  - Remove file type check and append string to file name [Orabug: 37241057]
  - Remove rpc_clnt directory from sunrpc debugfs [Orabug: 37129232]
  - Disable ethtool EEPROM dump for link down interfaces [Orabug: 37129428]
  - Modify sos.spec to make python3-file-magic as dependency for sos package [Orabug: 36834417]
  - Append .txt extension to files rejected by MOS policy [Orabug: 36727763]
  - Collecting last 50k lines of ftrace file trace [Orabug: 36590767]
  - Adding socket statistics command output [Orabug: 36594481]
  - Add IO queue depth of all the devices on node [Orabug: 36594679]
  - Disable upload option to sos report collector [Orabug: 36068606]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Collect all rsyslogs files for all-logs option [Orabug: 36402382]
  - Set SIGPIPE to default action for Broken Pipe Error [Orabug: 35969973]
  - Modifying dnf history info transaction index [Orabug: 35497720]
  - Adding virsh guest cgroup configuration [Orabug: 35145501]
  - Adding virsh qemu-monitor info tree command [Orabug: 35148435]
  - Adding Plugin option support for ksplice and btrfs [Orabug: 35115193]
  - append .txt to .com domain named files [Orabug: 34527958]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Fix ksplice plugin does not show description [Orabug: 32886513]


author: Craig Guiller <craig.guiller@oracle.com> - 4.10.2-2.0.1
changelog:
  - Add kvm debugfs to sosreport [Orabug: 39073014]
  - Disable all upload options [Orabug: 37854589]
  - Update the enabled and skipped plugins lists to match ExaDatas requirements. [Orabug: 37440321]
  - Add Keyboard exception handler to collector [Orabug: 37854316]
  - Print stack of all un-interrupted process [Orabug: 37713383]
  - Remove file type check and append string to file name [Orabug: 37241057]
  - Remove rpc_clnt directory from sunrpc debugfs [Orabug: 37129232]
  - Disable ethtool EEPROM dump for link down interfaces [Orabug: 37129428]
  - Modify sos.spec to make python3-file-magic as dependency for sos package [Orabug: 36834417]
  - Append .txt extension to files rejected by MOS policy [Orabug: 36727763]
  - Collecting last 50k lines of ftrace file trace [Orabug: 36590767]
  - Adding socket statistics command output [Orabug: 36594481]
  - Add IO queue depth of all the devices on node [Orabug: 36594679]
  - Disable upload option to sos report collector [Orabug: 36068606]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Collect all rsyslogs files for all-logs option [Orabug: 36402382]
  - Set SIGPIPE to default action for Broken Pipe Error [Orabug: 35969973]
  - Modifying dnf history info transaction index [Orabug: 35497720]
  - Adding virsh guest cgroup configuration [Orabug: 35145501]
  - Adding virsh qemu-monitor info tree command [Orabug: 35148435]
  - Adding Plugin option support for ksplice and btrfs [Orabug: 35115193]
  - append .txt to .com domain named files [Orabug: 34527958]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Fix ksplice plugin does not show description [Orabug: 32886513]


author: EL Errata <el-errata_ww@oracle.com> - 4.8.2-2.0.1
changelog:
  - Remove file type check and append string to file name [Orabug: 37241057]
  - Remove rpc_clnt directory from sunrpc debugfs [Orabug: 37129232]
  - Disable ethtool EEPROM dump for link down interfaces [Orabug: 37129428]
  - Modify sos.spec to make python3-file-magic as dependency for sos package [Orabug: 36834417]
  - Append .txt extension to files rejected by MOS policy [Orabug: 36727763]
  - Collecting last 50k lines of ftrace file trace [Orabug: 36590767]
  - Adding socket statistics command output [Orabug: 36594481]
  - Add IO queue depth of all the devices on node [Orabug: 36594679]
  - Disable upload option to sos report collector [Orabug: 36068606]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Collect all rsyslogs files for all-logs option [Orabug: 36402382]
  - Set SIGPIPE to default action for Broken Pipe Error [Orabug: 35969973]
  - Modifying dnf history info transaction index [Orabug: 35497720]
  - Adding virsh guest cgroup configuration [Orabug: 35145501]
  - Adding virsh qemu-monitor info tree command [Orabug: 35148435]
  - Adding Plugin option support for ksplice and btrfs [Orabug: 35115193]
  - append .txt to .com domain named files [Orabug: 34527958]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Fix ksplice plugin does not show description [Orabug: 32886513]


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 4.8.2-2.0.2
changelog:
  - Update the enabled and skipped plugins lists to match ExaDatas requirements. [Orabug: 37440321]
  - Add Keyboard exception handler to collector [Orabug: 37854316]
  - Print stack of all un-interrupted process [Orabug: 37713383]


author: Zuzana Miklankova <zmiklank@redhat.com> - 3.45.0-1
changelog:
  - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html)
  - List versioned soname in files, preventing unnoticed soname bumps
  - Disable func4 tests for i686 arch due to failing float<->int conversions


author: Bruno Wolff III <bruno@wolff.to> - 4.6-1
changelog:
  - 4.6 release
  - PR #231 was merged
  - See https://github.com/plougher/squashfs-tools/blob/master/CHANGES


author: Bruno Wolff III <bruno@wolff.to> - 4.6.1-1
changelog:
  - Phillip is now doing two tags per release and we can
  - use the one that works better with forgemeta
  - There are a few fixes after the 4.6 release. I think only
  - one applies to Fedora because of the build options we use.
  - It was not something that affects image builds.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-5
changelog:
  - Fix incorrect syscall name reporting in restart_syscall() on attach when
    PTRACE_GET_SYSCALL_INFO is in use (RHEL-65108).
  - Update net-yy-inet* and linkat--secontext_mismatch tests.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-6
changelog:
  - Avoid failures of creat.gen test on kernels that include commit
    v6.11-rc1~242^2~19 ("fs: don't block i_writecount during exec").


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.9.14-1.p3
changelog:
  - Rebase to 1.9.14p3
  - sudo-1_9_14p2 is available Resolves: rhbz#2175672
  - sudo fails to build with Python 3.12: FAILED: testcase
    check_example_group_plugin_is_able_to_debug() Resolves: rhbz#2186412


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-1.p5
changelog:
  - Rabase to 1.9.15p5
  - sudo-1_9_15p5 is available Resolves: rhbz#2248505
  - TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack
    Variables Resolves: rhbz#2255569


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-5.p5
changelog:
  - RHEL 10.0 ERRATUM
  - sudo-1.9.15-2.p5.el10: RHEL SAST Automation: address 4 High impact true
    positive(s) Resolves: RHEL-44436
  - sudo subpackage sudo-logsrvd should not be built Resolves: RHEL-52864


author: Craig Guiller <craig.guiller@oracle.com> - 1.9.15-8.p5.2
changelog:
  - RHEL 10.1 ERRATUM
  - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100009
  - CVE-2025-32463 sudo: LPE via chroot option Resolves: RHEL-100022


author: systemd maintenance team <systemd-maint@redhat.com> - 257-8
changelog:
  - Rebase to new upstream stable release v257.3 (RHEL-71409)
  - udev: introduce several features to make debugging rules easier (RHEL-75774)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-10
changelog:
  - resolved: pick up new DNSSEC KSC from 2024 (RHEL-77718)
  - test_ukify: Skip on riscv64 (RHEL-85854)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-11
changelog:
  - fuzz-journal-remote: use ASSERT_OK() and friends (RHEL-79976)
  - logs-show: skip journal entry with an invalid timestamp (RHEL-79976)
  - man: mention that rhel-9.0 net naming scheme is the same as v251 (RHEL-87179)
  - backlight: Drop support for actual_brightness (RHEL-86713)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-12
changelog:
  - mkosi: use C10S repo for building RPMs (RHEL-79976)
  - test: adapt TEST-22 to the downstream --purge behavior (RHEL-79976)
  - mkosi: reconfigure the CI for CentOS Stream 10 (RHEL-79976)
  - test: skip tests for components not shipped in RHEL 10 (RHEL-79976)
  - ci: add a unique identifier to each GH Actions job (RHEL-79976)
  - test: limit logging when running TEST-21-DFUZZER (RHEL-79976)
  - man: mention RHEL documentation in systemctl's man page (RHEL-97762)
  - ukify: switch from zstd to zstandard (RHEL-97625)
  - ukify: fix zboot parsing with zstd (RHEL-97625)
  - ukify: if the specified kernel is not a valid PE file try to decompress it (RHEL-97625)
  - ukify: fix version detection for aarch64 zboot kernels with gzip or lzma compression (RHEL-97625)
  - ukify: when decompressing kernel before signing, call verify on decompressed file (RHEL-97625)
  - udev/net_id: introduce naming scheme for RHEL-10.1 (RHEL-44419)
  - udev/net_id: introduce naming scheme for RHEL-9.7 (RHEL-44419)
  - sd-event: drop inotify event from buffer when no event source is triggered (RHEL-104555)
  - test: add test case for issue #38265 (RHEL-104555)
  - tree-wide: check more log message format in log_struct() and friends (RHEL-106260)
  - core: output log cycle path in one log message, not many (RHEL-106260)
  - core: make log cycle messages recognizable via message IDs (RHEL-106260)
  - core: change ordering cycle log message log levels (RHEL-106260)
  - core: cast log_oom() got void (RHEL-106260)
  - core: when removing a job from a transaction, include in structured log message which (RHEL-106260)
  - catalog: add entries for the order cycle log messages (RHEL-106260)
  - flush_ports: flush POSIX message queues properly (RHEL-100553)
  - Add --entry-type=type1|type2 option to kernel-install. (RHEL-103354)
  - kernel-install: regroup options in help meesage (RHEL-103354)
  - kernel-install: do not mix || and && (RHEL-103354)
  - man/kernel-install: mention --entry-type= option in the man page (RHEL-103354)
  - bootspec: rename boot_entry_type_to_string() to boot_entry_type_description_to_string() (RHEL-103354)
  - bootspec: include 'UKI' in descriptive name for type #2 (RHEL-103354)
  - bootspec: rename BootEntryType values (RHEL-103354)
  - bootspec: rename boot_entry_source_to_string() to boot_entry_source_description_to_string() (RHEL-103354)
  - bootspec: boot_entry_source_to_json_string() to boot_entry_source_to_string() (RHEL-103354)
  - 90-uki-copy.install: Skip removing UKI related when BOOT_ENTRY_TYPE=type1 (RHEL-103354)
  - hwdb: add front button support for MSI Claw 7 AI+ A2VM (RHEL-72701)
  - hwdb: add accel orientation and location for the BMAX Y14 (RHEL-72701)
  - hwdb.d: add support for Akoya P15645 (RHEL-72701)
  - hwdb.d: add ANP09 Intel n100 tablet sensor configuration (#36390) (RHEL-72701)
  - hwdb: add axis range corrections for the Lenovo Yoga Slim 7 14ARE05 (RHEL-72701)
  - hwdb: add GOLD WARRIOR SIM PhoenixRC 10411R (RHEL-72701)
  - hwdb: add Code Mercenaries Hard- und Software GmbH Virtual RC USB (RHEL-72701)
  - hwdb: Add accel orientation quirk for the GPD Pocket 4 (RHEL-72701)
  - hwdb: add rotation profile matrix for Rog Ally X (2024) (#36591) (RHEL-72701)
  - hwdb: fix backspace not working on HP Pavilion laptop (#36777) (RHEL-72701)
  - hwdb/keyboard: Map FN key on TUXEDO NB02 devices (RHEL-72701)
  - hwdb/keyboard: Map FN key on TUXEDO InfinityFlex 14 Gen1 (RHEL-72701)
  - hwdb: add G-Mode key support (#37175) (RHEL-72701)
  - Add emulated release to G-Mode key (RHEL-72701)
  - hwdb: keyboard: Add Alienware special keys (RHEL-72701)
  - hwdb: add bladeRF SDR devices (RHEL-72701)
  - hwdb: append ID_SOFTWARE_RADIO to hwdb parser (RHEL-72701)
  - hwdb.d: reword and simplify boilerplate texts (RHEL-72701)
  - hwdb.d: update/expand boilerplate on various hwdb files (RHEL-72701)
  - hwdb: say that settings can be also set to 0 (RHEL-72701)
  - hwdb: add Analog Devices PLUTO SDR (RHEL-72701)
  -  hwdb: append ID_MM_DEVICE_IGNORE to hwdb parser (RHEL-72701)
  - hwdb: run "update-hwdb" (RHEL-72701)
  - hwdb: run "update-hwdb-autosuspend" (RHEL-72701)
  - hwdb: add missing PLUTO SDR vendor name (RHEL-72701)
  - hwdb: add Ettus Research SDR devices (RHEL-72701)
  - hwdb: add RTL-SDR devices (RHEL-72701)
  - hwdb: merge entries for Ettus Research B200 (RHEL-72701)
  - hwdb: make Saitek PLC Pro Flight Rudder Pedals a joystick (#37601) (RHEL-72701)
  - hwdb: fix touchpad for ASUS X1504ZA (#37696) (RHEL-72701)
  - hwdb: add support for Loupedeck devices (RHEL-72701)
  - hwdb: Acer Nitro ANV15-51 Mic Toggle (RHEL-72701)
  - hwdb: Added Beacn and TC-Helicon Audio controllers (#37798) (RHEL-72701)
  - hwdb: Add support for Lenovo IdeaPad Slim 5 series (RHEL-72701)
  - hwdb: Add hwbd definitions for maker tools (RHEL-72701)
  - hwdb: Add accel orientation quirk for the Microtech e-tab Pro (RHEL-72701)
  - hwdb: add 70-maker-tools.hwdb to meson.build (RHEL-72701)
  - hwdb: fix typo in 70-maker-tools.hwdb (RHEL-72701)
  - hwdb: update (RHEL-72701)
  - Fix Positivo K116J search key and www shortcut (RHEL-72701)
  - hwdb: Acer Nitro ANV15-51 Nitro Sense Toggle (RHEL-72701)
  - hwdb: several cleanups (RHEL-72701)
  - hwdb: disable Asus ROG keyboards sending poweroff (RHEL-72701)
  - hwdb: update (RHEL-72701)
  - hwdb: update autosuspend rules (RHEL-72701)
  - hwdb: set touchpad resolution for ThinkPad T14 Gen2a (RHEL-72701)
  - Revert "hwdb: disable Asus ROG keyboards sending poweroff" (RHEL-72701)
  - hwdb: Add launch emoji keyboard mapping for Asus M1607KA (RHEL-72701)
  - Enable KEY_PERFORMANCE key present on Linux 6.17 (RHEL-72701)
  - hwdb: add HP 150 Wired Mouse (#37341) (RHEL-72701)


author: Darren Archibald <darren.archibald@oracle.com> - 257-13.0.1
changelog:
  - Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877]
  - Avoid udevadm warnings when using udev valid configs [Orabug: 37503197]
  - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469]
  - set "RemoveIPC=no" in logind.conf as default [Orabug: 22224874]
  - Fix missing netdev for iscsi entry in fstab [Orabug: 25897792]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - Remove upstream references [Orabug: 33995357]
  - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407]
  - Removed unneeded patches from the systemd.spec
  - 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490]
  - 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490]
  - 1006-orabug34467234-shutdown-get-only-active-md-arrays.patch [Orabug: 34467234]
  - 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110]
  - 1008-path-drop-IN_ATTRIB-from-parent-directory-watches.patch [Orabug: 36780432]


author: Jan Macku <jamacku@redhat.com> - 257-3
changelog:
  - udev/net_id: introduce naming scheme for RHEL-9.6 (RHEL-44417)
  - Rebase to new upstream stable release v257.2 (RHEL-71409)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-4
changelog:
  - ci: use ubuntu 22:04 for deploy of man pages (RHEL-57603)
  - tree-wide: Fix python formatting (RHEL-57603)
  - ci: fix Packit (RHEL-57603)
  - ci: drop testing farm test (RHEL-57603)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-73780)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-73780)
  - shared/bus-util: move bus_message_read_id128() to bus-message-util (RHEL-73780)
  - shared/bus-util: move bus_message_hash_ops to bus-message-util (RHEL-73780)
  - shared/bus-util: move string set append/get funcs to bus-message-util and bus-get-properties, respectively (RHEL-73780)
  - shared/serialize: make input params const (RHEL-73780)
  - shared/serialize: introduce serialize_id128() (RHEL-73780)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-73780)
  - core/manager: use FOREACH_ARRAY at one more place (RHEL-73780)
  - core/manager: drop duplicate bus track deserialization (RHEL-73780)
  - bus-util: introduce bus_get_instance_id() (RHEL-73780)
  - core: serialize API bus id and validate before deserializing bus tracks (RHEL-73780)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-73780)
  - shared/bus-util: add missing `set.h` include (RHEL-73780)
  - udevadm-test: add missing oom check (RHEL-75774)
  - udev-rules: replace 'type *func()' -> 'type* func()' (RHEL-75774)
  - udev-rules: do not change maximum log level when running in test mode (RHEL-75774)
  - udevadm-test: introduce -v/--verbose option to show verbose log messages (RHEL-75774)
  - udev-rules: show original token string in log_event_error() and friends (RHEL-75774)
  - udev-rules: logs result of format substitution (RHEL-75774)
  - udev-rules: add more trace logs for string match (RHEL-75774)
  - udev-rules: introduce udev_replace_chars_and_log() (RHEL-75774)
  - udev-rules: ignore whole command result if it is too long and does not contain newline (RHEL-75774)
  - udev-rules: update log messages (RHEL-75774)
  - udev-rules: add trace logs for GOTO and parent conditions (RHEL-75774)


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-8
changelog:
  - Backport upstream changes to jailify extraction directory
    Includes related gnulib changes to add openat2
    Fixes CVE-2025-45582


author: David Cantrell <dcantrell@redhat.com> - 1:1.11.1-3
changelog:
  - Use %license for the COPYING file in the %files section
  - Convert the License tag to an SPDX expression


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1:1.6.0-8
changelog:
  - migrated to SPDX license
  - resolves: rhbz#2219549* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.6.0-5

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild


author: John Kacur <jkacur@redhat.com> - 0.19-7
changelog:
  - Add missing patch to prevents tuna gui from starting if display not available
  - remove oscilloscope which is unsupported in rhel
  - Add rpmsinpect.yaml and gating.yaml
  - Add tests dir
  - update the current version of python-linux-procfs as a requires
  Resolves: RHEL-30171


author: John B. Wyatt IV <jwyatt@redhat.com> - 0.19-11
changelog:
  - Fix syntax warnings
  - Switch RHEL10 pkg to use autosetup like c9s does in tuna, -v makes it more verbose
  Resolves: RHEL-106288


author: John B. Wyatt IV <jwyatt@redhat.com> - 0.19-12
changelog:
  - Reverting the previous syntax warnings fix patch and replacing it with the
  tuna-Fix-string-syntax-warnings-with-raw-strings patch.
  Resolves: RHEL-106288


author: John B. Wyatt IV <jwyatt@redhat.com> - 0.19-13
changelog:
  - Applied tuna: Fix help.py syntax warnings and tuna: help.py
  - Requested to remove resolves statement from previous entry.
  Resolves: RHEL-106290


author: John Kacur <jkacur@redhat.com> - 0.19-14
changelog:
  - Update man page with cpu_power command
  - Fix show_threads -t and show_irqs -q to not match everything if no match
  - Fix run command failing to apply BATCH policy
  - Add -U and -K to the move command
  Resolves: RHEL-107914 RHEL-106070 RHEL-93776 RHEL-106068


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-50567
    - spec: create /etc/tuned/profiles directory
      resolves: RHEL-46721
    - hotplug: wait for device initialization
    - sap-netweaver: increased vm.max_map_count
    - daemon: buffer sighup signal
    - added an option to configure profile directories
    - api: added commands to dynamically create/destroy instances
    - functions: added 'intel_recommended_pstate'
    - functions: added 'log' which helps with debugging
    - functions: added 'package2cpus' and 'packages2uncores' matchers
    - functions: added 'lscpu' to list CPU details
    - plugins: added plugin_irq
    - plugin_video: added support for amdgpu `panel_power_savings` attribute
    - plugin_cpu: check that writes are necessary if they may cause redundant IPIs
    - plugin_uncore: allow to configure frequency limits using percent
    - amd-pstate: added support for controlling core performance boost
    - plugin_scheduler: adjusted error logging in _set_affinity
    - plugin_audio: enabled controller reset to fix suspend with NVIDIA
    - plugin_irq: fixed expansion of variables
    - plugin_irqbalance: switched to IRQBALANCE_BANNED_CPULIST


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-50567
    - clear plugin repository when stopping tuning
    - man: add description of the balanced-battery profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-3
changelog:
  - Fixed privileged execution of arbitrary scripts by active local user,
    (CVE-2024-52336)
    Resolves: RHEL-66636
  - Added sanity checks for API methods parameters, (CVE-2024-52337)
    Resolves: RHEL-66613


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-0.1.rc1
changelog:
  - new release
    - tuned-ppd: removed the use of StrEnum
    - tuned-ppd: fixed traceback
      resolves: RHEL-74384
    - tuned-ppd: multiple fixes and updates
    - docs: plugins docs are now automatically generated from the docstrings
    - plugin_cpu: fixed no_turbo boolean option parsing
    - plugin_cpu: allowed raw energy_performance_preference values
    - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    - plugin_bootloader: added variables to BLS entries only if grub is used
    - plugin_scheduler: do not assume that perf events have type attribute
    - plugin_scheduler: updated sched knobs for kernels 6.6+
    - plugin_scheduler: log process info when its affinity cannot be changed
      resolves: RHEL-69933
    - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    - plugin_scheduler: made perf support optional
    - plugin_net: added support for hotplug and rename
    - makefile: added support for installation to custom $BINDIR/$SBINDIR
    - functions: dropped cpuspeed support


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70454
    - sap-hana: Set transparent_hugepages to madvise
      resolves: RHEL-68454
    - plugin_bootloader: export Grub variables to make them available in submenus
    - utils.commands: fixed CPU online detection when not present
    - plugin_net: handled cqe-mode-rx ethtool option
    - profiles: correct CPU governor settings


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70454
    - plugins: added missing instance parameters
    - disk: added missing remove parameter
    - plugin_scheduler: added switch to disable processing of kthreads
    - Makefile: added support for installation to custom LIBEXECDIR
    - functions: create a new parser object for each string expansion


author: EL Errata <el-errata_ww@oracle.com> - 2.25.1-1.0.1
changelog:
  - Fix RPS/XPS and busy polling optimization not getting applied [Orabug: 32153315]
  - Fix error in uninstalling tuned [Orabug: 351528377]
  - Updated patch with the more recent version [Orabug: 30730976]
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.26.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-94809
    - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
    - tuned-ppd: enabled sysfs_acpi_monitor by default
    - tuned-ppd: fixed inotify watch for performance degradation
    - tuned-ppd: pinned virtual files in memory for inotify
    - fixed instance priority inheritance
      resolves: RHEL-94842
    - hotplug: added fixes for device remove race condition
    - tuned-main.conf: added startup_udev_settle_wait option
      resolves: RHEL-88238
    - functions: silenced errors if module kvm_intel does not exist
    - functions: make calc_isolated_cores return CPU ranges
    - scsi: used 'med_power_with_dipm' for SATA ALPM
    - scsi: do not set ALPM on external SATA ports
      resolves: RHEL-79913
    - network_latency: Set non-zero rcutree.nohz_full_patience_delay
    - realtime: disable appropriate P-State drivers
    - plugin_disk: added support for MMC (MultiMediaCard) devices
    - udev: fix possible traceback in device matcher
      resolves: RHEL-97087
    - udev-settle: obey udev buffer size and handle possible tracebacks
      resolves: RHEL-92637
    - daemon: re-raise daemon init exception in no-daemon mode
    - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    - gui: fix the profile deleter script


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Patsy Griffin <patsy@redhat.com> - 2024a-3
changelog:
  - Add java patch to fix incorrect calculations for
    Africa/Casablanca starting in 2027. (RHEL-32178)
  - Remove hardcoded versioned path to javac.


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.
  - Harden against links to removed zones


author: Patsy Griffin <pats@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (RHEL-74296)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  - Update to tzdata-2025b (RHEL-84740)
    - Chile's Aysén Region moves from -04/-03
      to -03 year-round, diverging from America/Santiago and
      creating a new zone America/Coyhaique.


author: Patsy Griffin <patsy@redhat.com> - 2026a-1
changelog:
  - Update to tzdata-2026a (RHEL-154023)
    - Correct the transition times for Moldova.
    - The POSIXRULES option is now obsolete.


author: Jakub Martisko <jamartis@redhat.com> - 6.0-65
changelog:
  - Fix: Unzip Fails on Large Zip Files
  - Use the patch from Debian dealing with this
  Resolves: RHEL-45993


author: Jakub Martisko <jamartis@redhat.com> - 6.0-67
changelog:
  - zipinfo: remove the extra %c that caused invalid reads
  - zipinfo: fix the whitespaces in the output
  - Zipbombs: Port Another patch, orinally made by Mark Adler
  - https://github.com/madler/unzip/commit/af0d07f95809653b669d88aa0f424c6d5aa48ba0
    Resolves: RHEL-59972
    Resolves: RHEL-6286


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.076-2
changelog:
  - enable building without GPM support - build with GPM in Fedora
  - 2262371 - gvim: symbol lookup error: gvim: undefined symbol: g_once_init_enter_pointer


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-5.1
changelog:
  - RHEL-113550 CVE-2025-53906 vim: Vim path traversal
  - RHEL-113544 CVE-2025-53905 vim: Vim path traversial


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-6
changelog:
  - RHEL-113549 CVE-2025-53906 vim: Vim path traversal
  - RHEL-113543 CVE-2025-53905 vim: Vim path traversial


author: Davide Cavalca <dcavalca@fedoraproject.org> - 1:2.10-8
changelog:
  - Backport WPA3 support for Broadcom devices. Fixes: rhbz#2226569
  - Enable parsing of IPv6 addresses in RADIUS configuration (#2095296)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.10-10
changelog:
  - Fix package configuration/add missing patches to avoid regressions when
    upgrading from rhel-9 (RHEL-43250)
  - Backport P2P fix causing nmci failures (RHEL-17701)
  - Disable OpenSSL ENGINE API (RHEL-33750)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.11-1
changelog:
  - Update to version 2.11 (RHEL-59010)
  - backport fix for known regression on brcmfmac (rhbz#2302577)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.11-4
changelog:
  - Use pkcs11 provider to resolve PKCS11 URIs (RHEL-86951)
  - De-clutter syslog from CTRL-EVENT-SIGNAL-CHANGE messages (RHEL-71344)


author: EL Errata <el-errata_ww@oracle.com> - 6.11.0-1.0.1
changelog:
  - mkfs.xmem: fix agcount issue when formatting pmem filesystems
  - mkfs: add mkfs.xmem wrapper script
  - mkfs: add configuration files for OL support


author: Jakub Martisko <jamartis@redhat.com> - 3.0-42
changelog:
  - Use C implementation of some functions instead of asm
  - Fix the missing compiler/linker flags
  - Minor spec clean up
  Resolves: RHEL-33526


