<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="13">
<package pkgid="d31d3a0bea109115ad8c52ca42081ebd27415b65bf5011902062972fb7b26456" name="kernel-64k-debug-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="ce3d3b401912c773591b2df35eb917ed09d47d718a8167558c27cf9f229701ce" name="kernel-64k-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="5db8a4e4d5196d7d7ad950c648cf28a455b7628d3d9910b34e32f02e29cbe5c9" name="kernel-debug-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="ebf69d0bb7bf15aef40d790a43734f2f51e699769f621288c719d7be69f72912" name="kernel-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="f9da8e73f3762d0b1529a312af1927515dd05f806a8dae9fdabbeb1ab46b339b" name="kernel-debuginfo-common-aarch64" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="299781a2bb7b94587ffb11440d6bf4012c63d2ebe7bd08d7c1539cbd7a39871f" name="kernel-rt-64k-debug-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="c29d56d56cb88c4d1136151fe015eb02ce05ec9656172a8609a056e4d3de8167" name="kernel-rt-64k-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="29f90c84a79172ad67b7a2d0b0a10f7f9da9fe5ec7c73e7ecc69bb3c1780afd5" name="kernel-rt-debug-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="92d6b36910cb49f0e821eda4e0eaf45a9a9f5ef0fec015009555678c443ab70d" name="kernel-rt-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="5c9a0dcc8da6c4aa3a52f1b404bd87f4f93f5a6013ea7b7db27c7b397e82935d" name="kernel-tools-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="8bcbe5bee44c9ebccdbf8e90a24cc08e059a83d0184a4168b5d334ef7af93b5e" name="libperf-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="5f17de2bbe08b22751ab229f7ac0d5abdeb572a57b941b6151f652ff3b4f48c1" name="perf-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
<package pkgid="189da9fe1606818e53f5547d6e2df4873e14aad14c97a236399feeefa23f76c6" name="python3-perf-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="611.54.1.el9_7.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.47.1.el9_7]" date="1774958400">- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.48.1.el9_7]" date="1775217600">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.49.1.el9_7]" date="1775563200">- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.50.1.el9_7]" date="1775822400">- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
- md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.51.1.el9_7]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.52.1.el9_7]" date="1776772800">- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150464] {CVE-2026-23136}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.53.1.el9_7]" date="1776945600">- tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
- tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
- thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
- thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
- thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-611.54.1.el9_7]" date="1777723200">- crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
- crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-611.54.1" date="1777896000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-611.54.1.0.1" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- rxrpc: Fix potential UAF after skb_unshare() failure (Sultan Alsawaf) [ciqres] {CVE-2026-43500}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
</package>
</otherdata>