<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="347">
<package pkgid="52659fd6ec824392c16dcfb6ebf39204055d1374501b85e31863eb0ae86aef2d" name="bpftool" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="ed8724b49bcb6c930ed11af57b829b4d14bd8faf58971c85085325a29f9ea354" name="bpftool" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="1b3dfb0cdae0a9aad89df668204e03b8b9bc303d33eadf796b68bdf049935ecc" name="bpftool" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="57613e82bfc0acf507fc4a743ef96b994c0648158694cad4d7362d8a8460dff1" name="bpftool" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="e4c2adc6c14524294e95b61831d93ea48cd69f28d0d0ade04271d0b9ee45e1d0" name="bpftool" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="e3d502f40994f9e781a7fcd7aa0c4228508ca8a4330631494ca82e96711c5e9b" name="certwrapper-rocky" arch="x86_64">
  <version epoch="0" ver="0.2" rel="2.el8_ciq"/>
  <changelog author="Michael L. Young &lt;myoung@ciq.com&gt; - 0.2-2" date="1746014400">- Bumping release</changelog>
  <changelog author="Michael L. Young &lt;myoung@ciq.com&gt; - 0.2-1" date="1745496000">- Add aarch64 support</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 0.2" date="1709035200">- Update to latest upstream in preparation for CIQ release
- Add ciq_sbsign pesign override macro</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.co&gt; - 0.1-3" date="1679918400">- Naming adjustment, minor specfile adjustments
- Added the ability to sign binary automatically</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.co&gt; - 0.1-2" date="1679400000">- Fixed build for RHEL/Rocky 8
- Fixed SBAT entry - need 6 columns</changelog>
  <changelog author="Sherif Nagy &lt;sherif@rockylinux.org&gt; - 0.1-1" date="1678968000">- Init certmule</changelog>
</package>
<package pkgid="3fa71ed9f75d1d7b46d16d1a3e5d879d9e1749c0651a1be556b589acd6500db9" name="ciq-rocky-cloud-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.4.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="e064edf5d138fa22c36340a4ccee1aaaf25515a2f129c5d55075c047401936ef" name="ciq-rocky-cloud-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.5.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="84ac0384efb7cdb5db61b759637e42b0cdbe382ec178796e1392dde0419212b1" name="ciq-rocky-cloud-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.6.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.6" date="1746792000">- Point users to Depot's Repo files and docs in stock repo files.</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="57f9353d67eb12c84213d493fc1fb156fa627d9ef7408568186de6835e1edd80" name="ciq-rocky-cloud-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.7.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.7" date="1749902400">- Add support for RLC AWS Cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.6" date="1746792000">- Point users to Depot's Repo files and docs in stock repo files.</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="06f20c9a594c7801a4414a4146fd1ccb068985ce7918cc15a28f02f6c1dca077" name="ciq-rocky-cloud-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.10.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.10" date="1750507200">- Remove $variant variable from repo files</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.8" date="1750334400">- Fixes from real world testing of install/uninstall
- Remove repo_gpgcheck settings to follow upstream defaults</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.7" date="1749902400">- Add support for RLC AWS Cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.6" date="1746792000">- Point users to Depot's Repo files and docs in stock repo files.</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524800">- Repos pointing to depot.ciq.com</changelog>
</package>
<package pkgid="388e95612e874f240f318a4c320e7422dd8d9b23fbb84f0f0f8728f6e05ddc4b" name="ciq-rocky-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.0.el8_10.ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99.1" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="0dc79deffd3c9f5c107d5ddbabb7cd32149796e27d5ec3038c4d7b6163d38f56" name="ciq-rocky-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.1.el8_10.ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="ecbc3280a9f756c290079a6ff3aea60b339819d21ce243aa0774a859713d0060" name="ciq-rocky-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.2.el8_10.ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="639150bb2d3fce8f5849f16f7396767f025ba31ab9c3d556d4dc5a0e9e3149f0" name="ciq-rocky-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.3.el8_10.ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="8d78cfbea20385d42453a65907ae62192944573416e2f212763ba1709871a34c" name="ciq-rocky-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.4.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="36f687333b9e53f8044c97139d870582f01c007480e546904fb19514e18b1a97" name="ciq-rocky-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.5.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="81ec148dd59728397bde6b4fa4abe9069cae88ad046c307dfbcbd4d3eff54666" name="ciq-rocky-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.6.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.6" date="1746792000">- Point users to Depot's Repo files and docs in stock repo files.</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="bc8ab587802c9f1dd3834559248f192b8c84b29159cafa417dd623dc6aae6597" name="ciq-rocky-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.7.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.7" date="1749902400">- Add support for RLC AWS Cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.6" date="1746792000">- Point users to Depot's Repo files and docs in stock repo files.</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="3a508eeaf2af66a38b0bc06f0c601b5d515dd7719e844b79c2678e0035934353" name="ciq-rocky-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.10.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.10" date="1750507200">- Remove $variant variable from repo files</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.8" date="1750334400">- Fixes from real world testing of install/uninstall
- Remove repo_gpgcheck settings to follow upstream defaults</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.7" date="1749902400">- Add support for RLC AWS Cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.6" date="1746792000">- Point users to Depot's Repo files and docs in stock repo files.</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524800">- Repos pointing to depot.ciq.com</changelog>
</package>
<package pkgid="68811d99d2e8e3a2d569a49f35a81bae060e8e7a253b200da29fc4234a6e919f" name="ciq-rocky-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.0.el8_10.ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99.1" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="5e666f394ef979e38291ef311b44f7344a6cfaadf7cdd4b10e9d7b721dc0cf72" name="ciq-rocky-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.1.el8_10.ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="ec6b5d672913326259ac0153012e2d5f3f746e631f44ec9e100b3a02cf066feb" name="ciq-rocky-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.2.el8_10.ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="96efe6272b1399bc11b64d3487b5d899e667fd4055a8eb7d6659bdd8e6f4affc" name="ciq-rocky-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.3.el8_10.ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 9.4-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="8f982a28b86c95b1278f11a14deb43de41dc60ed8afd0a674ffd6b2f60bb59f6" name="ciq-rocky-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.4.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="ea9fb425aeb02a566f9861fbe7ccf47afc71a24b287fe4b7cca5d254f5b5ab3e" name="ciq-rocky-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.5.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="0ad42ebd03c683aa8e44a3679fd1f3a1bd0cd246d3204ff4fbf34e0c3a6b6b25" name="ciq-rocky-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.6.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.6" date="1746792000">- Point users to Depot's Repo files and docs in stock repo files.</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="e7ecd63637d2f1858e72ffd44b079c0efbde6c3e29c9c8addc9dd77a74886f19" name="ciq-rocky-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.7.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.7" date="1749902400">- Add support for RLC AWS Cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.6" date="1746792000">- Point users to Depot's Repo files and docs in stock repo files.</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524801">- Repos pointing to depot.ciq.com</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-0.99" date="1727524800">- Initial package</changelog>
</package>
<package pkgid="ff2b05b008d72ff62c7a89d50826c61aa864a237e29fda3ed4d33c5ef791729b" name="ciq-rocky-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.10.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.10" date="1750507200">- Remove $variant variable from repo files</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.8" date="1750334400">- Fixes from real world testing of install/uninstall
- Remove repo_gpgcheck settings to follow upstream defaults</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.7" date="1749902400">- Add support for RLC AWS Cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.6" date="1746792000">- Point users to Depot's Repo files and docs in stock repo files.</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.5" date="1746446400">- Fix obsoletes conflicts when upgrading from a stock rocky system</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.4" date="1745496000">- Add a cloud-repos package and file for updating RLC against cloud mirrors</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.3" date="1728302401">- Change RLFC to RLC</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.2" date="1728302400">- Fixed rocky mirrors to correct the path</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.1" date="1728043200">- Pointed ALL repos to depot.ciq.com
- Added source and debug rlfc repo placeholders</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 8.10-1.0" date="1727524800">- Repos pointing to depot.ciq.com</changelog>
</package>
<package pkgid="7129c8d074eddf504282272ef355ea1bc4787f646468a2cad1c6e77b7e8c5453" name="dnf-plugin-protected-kmods" arch="noarch">
  <version epoch="0" ver="0.9.1" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.9.1-1" date="1741348801">- Fix bug with filtering that occasionally has false negatives</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.9-1" date="1741348800">- Speed up filtering when there are a large number of kernels
- Change default to enforce a kmod blocking kernel updates, even when the kmod
  isn't in a repo</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.8-1" date="1736769600">- Temporarily disable plugin when available package sack isn't populated</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.7-1" date="1734091200">- Fix bug introduced in 0.6
- Add documentation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.6-1" date="1734004800">- Ensure that available_modules are sorted by evr_key in reverse order
- Exclude kernels if they're in a higher priority value repo
- Exclude kmods without any matching kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.5-1" date="1732881600">- Fix output when no kmods are available</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.4-1" date="1732708800">- Fix kmod sort order when reporting</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.3-1" date="1732622400">- Rename to dnf-plugin-protected-kmods</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.2-1" date="1732104000">- Initial release
- Add and own config directory</changelog>
</package>
<package pkgid="e78cb1a9022bdc8ee439c0ce593a37a0ffa14bf1a678df3dc889738f4335db93" name="eglexternalplatform-devel" arch="noarch">
  <version epoch="0" ver="1.2" rel="3.el8_10.cld_next"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.2-3" date="1737028800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 1.2-2" date="1725451200">- Adjust path of generated pkg-config file so it's still considered noarch.</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 1.2-1" date="1723118400">- Update to 1.2.</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1-9" date="1721217600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1-8" date="1706097600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1-7" date="1705665600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Jos&#xE9; Exp&#xF3;sito &lt;jexposit@redhat.com&gt; - 1.1-6" date="1694088000">- SPDX migration: license is already SPDX compatible</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1-5" date="1689768000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1-4" date="1674129600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1-3" date="1658404800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild</changelog>
</package>
<package pkgid="7ea54e69c0a827ba3ed949d23162a2d8c478d81cfd808529ba86ba8d1e25a5d5" name="egl-gbm" arch="x86_64">
  <version epoch="2" ver="1.1.2.20240919gitb24587d" rel="3.el8_10.cld_next"/>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 2:1.1.2^20240919gitb24587d-3" date="1726833600">- Update to latest snapshot.
- ICD is installed directly from source.</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 2:1.1.2-2" date="1726747200">- Add the library ICD (moved from egl-wayland).</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 2:1.1.2-1" date="1723550400">- Update to final 1.1.2.</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 2:1.1.1-6.20240412git649c079" date="1723032000">- Update to latest snapshot with required commits for driver 560+.</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:1.1.1-5" date="1721217600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 2:1.1.1-4" date="1709121600">- Add an epoch as some fool addded an epoch to their thirdparty repo!</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.1-3" date="1706097600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.1-2" date="1705665600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.1-1" date="1704283200">- Update to 1.1.1</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.0-5" date="1689768000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild</changelog>
</package>
<package pkgid="a7234922b2b235e72e6b6c64b394ff8dc02d8a8d805219c54ebc580419236a8d" name="egl-gbm" arch="i686">
  <version epoch="2" ver="1.1.2.20240919gitb24587d" rel="3.el8_10.cld_next"/>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 2:1.1.2^20240919gitb24587d-3" date="1726833600">- Update to latest snapshot.
- ICD is installed directly from source.</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 2:1.1.2-2" date="1726747200">- Add the library ICD (moved from egl-wayland).</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 2:1.1.2-1" date="1723550400">- Update to final 1.1.2.</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 2:1.1.1-6.20240412git649c079" date="1723032000">- Update to latest snapshot with required commits for driver 560+.</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:1.1.1-5" date="1721217600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 2:1.1.1-4" date="1709121600">- Add an epoch as some fool addded an epoch to their thirdparty repo!</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.1-3" date="1706097600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.1-2" date="1705665600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.1-1" date="1704283200">- Update to 1.1.1</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.0-5" date="1689768000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild</changelog>
</package>
<package pkgid="8a54a36aba544a3cb64828d2c892066a043d0d774e1f5313042deac99388e775" name="egl-wayland" arch="i686">
  <version epoch="0" ver="1.1.13.1" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.13.1-1" date="1739534400">- Update to 1.1.13.1</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.13-1" date="1697803200">- Update to 1.1.13</changelog>
  <changelog author="Jos&#xE9; Exp&#xF3;sito &lt;jexposit@redhat.com&gt; - 1.1.12-4" date="1694088000">- SPDX migration: license is already SPDX compatible</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.12-3" date="1689768001">- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.12-2" date="1689768000">- Add patch to fix rhbz#2223856</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.12-1" date="1686312000">- Update to 1.1.12</changelog>
  <changelog author="Jonathan Schleifer &lt;js@nil.im&gt; - 1.1.11-3" date="1681128000">- Fix Firefox and Thunderbird crashing on start</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.11-2" date="1674129600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.11-1" date="1662811200">- Update to 1.1.11</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.10-7.20220806git885f0a5" date="1660046400">- Update snapshot</changelog>
</package>
<package pkgid="fc73de66410e0e762bb9325b4022c7e55c08f910e517e90946402e1c5aea2f6e" name="egl-wayland" arch="x86_64">
  <version epoch="0" ver="1.1.13.1" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.13.1-1" date="1739534400">- Update to 1.1.13.1</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.13-1" date="1697803200">- Update to 1.1.13</changelog>
  <changelog author="Jos&#xE9; Exp&#xF3;sito &lt;jexposit@redhat.com&gt; - 1.1.12-4" date="1694088000">- SPDX migration: license is already SPDX compatible</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.12-3" date="1689768001">- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.12-2" date="1689768000">- Add patch to fix rhbz#2223856</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.12-1" date="1686312000">- Update to 1.1.12</changelog>
  <changelog author="Jonathan Schleifer &lt;js@nil.im&gt; - 1.1.11-3" date="1681128000">- Fix Firefox and Thunderbird crashing on start</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.11-2" date="1674129600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.11-1" date="1662811200">- Update to 1.1.11</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.10-7.20220806git885f0a5" date="1660046400">- Update snapshot</changelog>
</package>
<package pkgid="4a3ab1b3cdc84cbbf9a590ddab066edd1d1716b876d316131e45c7283c0cf8be" name="egl-wayland-devel" arch="i686">
  <version epoch="0" ver="1.1.13.1" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.13.1-1" date="1739534400">- Update to 1.1.13.1</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.13-1" date="1697803200">- Update to 1.1.13</changelog>
  <changelog author="Jos&#xE9; Exp&#xF3;sito &lt;jexposit@redhat.com&gt; - 1.1.12-4" date="1694088000">- SPDX migration: license is already SPDX compatible</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.12-3" date="1689768001">- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.12-2" date="1689768000">- Add patch to fix rhbz#2223856</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.12-1" date="1686312000">- Update to 1.1.12</changelog>
  <changelog author="Jonathan Schleifer &lt;js@nil.im&gt; - 1.1.11-3" date="1681128000">- Fix Firefox and Thunderbird crashing on start</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.11-2" date="1674129600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.11-1" date="1662811200">- Update to 1.1.11</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.10-7.20220806git885f0a5" date="1660046400">- Update snapshot</changelog>
</package>
<package pkgid="b63d49d1eda3f0e209eb84a979b331a362a6d4443b36499d55bb0b4c4aa018f1" name="egl-wayland-devel" arch="x86_64">
  <version epoch="0" ver="1.1.13.1" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.13.1-1" date="1739534400">- Update to 1.1.13.1</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.13-1" date="1697803200">- Update to 1.1.13</changelog>
  <changelog author="Jos&#xE9; Exp&#xF3;sito &lt;jexposit@redhat.com&gt; - 1.1.12-4" date="1694088000">- SPDX migration: license is already SPDX compatible</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.12-3" date="1689768001">- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.12-2" date="1689768000">- Add patch to fix rhbz#2223856</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.12-1" date="1686312000">- Update to 1.1.12</changelog>
  <changelog author="Jonathan Schleifer &lt;js@nil.im&gt; - 1.1.11-3" date="1681128000">- Fix Firefox and Thunderbird crashing on start</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.1.11-2" date="1674129600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.11-1" date="1662811200">- Update to 1.1.11</changelog>
  <changelog author="Leigh Scott &lt;leigh123linux@gmail.com&gt; - 1.1.10-7.20220806git885f0a5" date="1660046400">- Update snapshot</changelog>
</package>
<package pkgid="ea73ec17dae99a8ceb03f00fa879d35f2f879da8235ca5411d608b5edb624c54" name="ibacm" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="8a3a00d76da2f8d0f1acd3b6410039dca9d900fa3359c8c16ca11b9d921b5a62" name="ibacm" arch="i686">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="2aedeaa28d614b8d29bdd9fbc010b3b5c41dd7d6765fe3d7ab99b7e2a3b8fe97" name="infiniband-diags" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="dbe8e8e7a82bea12c7cef61a62b7cd35e57f9723b356fa7e9f9d179b2b969d37" name="infiniband-diags" arch="i686">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="81c83f1057b3e2f5ff87d8566d7000f3580c98674da098b15804206d7aa33356" name="iwpmd" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="ed0aa06850b8844ae27a4bc2aa4326812cf50cabd4f744630383978ebde735b3" name="kernel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="f02ca1241014b12e20ce3137aaf72ca0347fd8bf7480ab683779379fbb567105" name="kernel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="0b74b8ccc2a451e65f8e0cc49d248a34c49bfec8106e8701cf41df9fed96a10c" name="kernel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="58e6e9bd32572cfa0da314f6beac32c8cab5cfbaf78a2ac6a5e34a57f5558f08" name="kernel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="2c63bb0ec0d70f79fa18e98c8b9464972060b4e94034be8de83bbb3d2990de13" name="kernel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="7ebafe488ac06b8a9059d5c13afaef0f83877e8e1a72beec62bf5af0ed88d631" name="kernel-abi-stablelists" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="a693bd02556114717bb1ac15c72dfb8355f985abc9b875576c5287c69a1aab66" name="kernel-abi-stablelists" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="40523058b1a5f4e3183d0a71384829a547746f0b9d2d01d7426b44eab2fbc0ee" name="kernel-abi-stablelists" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="83dc77c9f452826059a56df44d3608d47a5228d53981813817d9448e4183bdb3" name="kernel-abi-stablelists" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="a74a238b659fe0d278a282458c24a14322a11ed959036a7abe295ab05c819fbb" name="kernel-abi-stablelists" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="ef108f646ec7b46006f8f363a3eec5a8ab5b3354a559d2b14fbe571211a7e07e" name="kernel-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="44cd159992ce1ba220a66b9fdde7adcae344f248cc726a46a87da6c28b2915b9" name="kernel-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="d941f66c619b1246b6ca462c684a40a376695317789d4a2606c66975727274c4" name="kernel-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="d42cde06e8e643668a876b74752a87ef2ccf51570bbc1eacfcba2deb9fe27130" name="kernel-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="c0d7458094a5522f7557eb7f3be3cb3ab64223ddb7993fd7f95929ab9b8198d3" name="kernel-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="63382ef3185c207601f8378bd7cbb3015c699617bacf64b694d24d55f766cd0d" name="kernel-cross-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="abaa6b63a6d30efcc2636efe20000b5a9eec1ccf9533b7a809afdd60253a0f84" name="kernel-cross-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="c5b1fa1db95f5f84898dc2d3c021751d5b08c8700c2b922761e387b6b59c1088" name="kernel-cross-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="10a8d798bad41161cc75530009ed92246e348503d4dbb19ac888edee3bf407da" name="kernel-cross-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="d444768619357a53dfe9d9e195c12f7f08e4bafe26a8cf7666b2a2453892d2a1" name="kernel-cross-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="157bc79d884955c6a85bcdbbbe187774e05bc4a30db28664764c4796690f4147" name="kernel-debug" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="ecb332b8794dc5dbc53091475e79f85008a2f875c72f463718811b236bf70cba" name="kernel-debug" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="1e485cad0c21143f669bf5c8e71ef9e760a14d7965cd285021a4a023a78b6b90" name="kernel-debug" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="a393640549fc58ab2fc896b35cd0de415f3980f228bd281924a2460f50ff0f73" name="kernel-debug" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="b1219b74de6a60700e28fed192d9f5c3a536a440f41c824e30cd3f53c1caff4c" name="kernel-debug" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="2a55614d517987dd13c97a2bc10254a88fc0483282b57c102d699efba029982d" name="kernel-debug-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="9a35c317b757636b3fb24c2ee5b855506f9bd8a6a400ec053b3afa8e86bec556" name="kernel-debug-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="e252d531f4c553d1c4e2ca7b0119becafd48dc6ef6d59f8afb4e19f42daf4ece" name="kernel-debug-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="a1d68f5e3416793291c7b43abaa66a42eebb5ba263577fda2278319147d48f7a" name="kernel-debug-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="817376a5e0dca20a2662d2e47f5bc07d67e55e945990b2fd91a7386b0ecbf611" name="kernel-debug-core" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="a7f7f772d23f0ddd72730796b01594e53dd1644be0cd0d7da70aadd2fb57a45e" name="kernel-debug-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="acbcfc0c1449634adc61a9242e0ad74cecf677a1bd9f055fa5e50319a05e069a" name="kernel-debug-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="07971ffc9d3454b2eaf81a606df82f266ba96fcb0b5aed120b7688d4fa49a086" name="kernel-debug-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="71c2ac22ca8a24cc119ff2d34199b56fb928954b742f225e96fc2d0cb3529e80" name="kernel-debug-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="0f9c4cf45573135621a0863ee089d287e16abf6249561a9e7fa3a2990c6e48c0" name="kernel-debug-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="2717f94599d2f2c654b30a6d5141ee9e0e2b58dc8ffe757f9a54857f03ec358e" name="kernel-debug-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="ba65f33ad8f3b4813075227da16a4c25d0b7d02bd95c7cbece89b761a8adc72a" name="kernel-debug-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="22e2dfdbbc0f699bfa2ee4f1020c66b70b1421cafe59ee5d7a161701f9a8ddc8" name="kernel-debug-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="f195f876f588c3bf41eb5a27dc3a217441fcaf87ad4f4b7460d556996d41a4bc" name="kernel-debug-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="d2fb975e58331504af324e7c325c5a5e193d11024027bac14c54639b18d9cb18" name="kernel-debug-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="b860bc197a085e9c3264ab11612241ad4c0ae6dc4ed9f4a2c4c85babb1740d4c" name="kernel-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="f449dc59ce0a7f9494f3c370e0aa0450f0dcc3d864cb4c139575b3fd42511b6e" name="kernel-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="d957171507b3c075fcd070249a3d89b7bc006cb13c776ee503af1d456b482efb" name="kernel-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="684d8124c62982003c64d9e293f51f0d37bb95b01cc9ff8de7b56d70f06de1ac" name="kernel-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="bfd1e7c7a50664b7730b8f6180c94a6bdf84f374bdf895eca310b4cfd693345f" name="kernel-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="e804ab1b559c56f957583fed36b05e371efd80d3372f7fee65ca6415f80f37bd" name="kernel-debug-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="69c9b99e539c0249388c7da5a91302386ed1dc72fc7be0f8fb36be57ce00053f" name="kernel-debug-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="4050917bbe3dfe245c2696004876527041066d6215436960354d6bfbef420252" name="kernel-debug-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="35e621c7cd9b559d4293a5061d7eef6ecb269cedf3fcd44af2a2e3647aab8260" name="kernel-debug-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="4aedbdf0cf52842565000d7c4cd298bf89165d6527fd3707592c8ef1a48a6b62" name="kernel-debug-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="ee86950b7af69c0974c5dc8f3eada200b700050214427fbef98eb89b11047743" name="kernel-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="0598453ad380ecf3e5f8fee5d6a761384db07dfe2f8d7500e31ffa507bbafe9c" name="kernel-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="586308e61dda0899cd59559d7e9688a87a192c62b3145b298f5914f2661743d3" name="kernel-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="7d02c298b55e068c5c78c5a707fc5decabdf2ed0c2cbf811cdd9041c73479906" name="kernel-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="d76c95f0333a7275da1e476266a004a6947411368d1f8dbc3baf2499971b1069" name="kernel-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="8b757efe8921a9aeb326bd5499545a4255441fe959c19dd806135245ed37cb74" name="kernel-doc" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="9773c9c0b9685c0b9d4d2804204881409033b23f25aa1fe6707b06574d161fda" name="kernel-doc" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="61b6cd61127f1026a50d252a5bd3deb1260af853bfcec2f39736ffb0079acd1e" name="kernel-doc" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="78bc7421c94955965e158be41136c9fb00e7c265c13dddc9be11cea50717225f" name="kernel-doc" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="15121e660f04a668e06707a40590e5fac92fcdb01dabedceaabd3e4c9af6f6a9" name="kernel-doc" arch="noarch">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="0a140c8e97e58e9581793a722aa76a779b06f323ddc9339d054f654a7208a883" name="kernel-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="29e7489730a25f778927ee3292381c117ffeafbc15457a3f58a60aac576039d8" name="kernel-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="50b5aeb25253de430a2a161d3bec04023760ee12bb5b3294dd6164fdf9956173" name="kernel-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="fbaea073966f465b9a7d4eb6207203a8e108140b6c12a9374ade9468cb471c73" name="kernel-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="b55f42e9b8ab14b5317201b660ce822f16afcb6dec1c5912d0450c559141aa9b" name="kernel-headers" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="ecd2de45f778e6eb42d02f95c3dcd093a81e1a91b7d823139d486758054c3771" name="kernel-ipaclones-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="8f6b47f12208c09d843a974645fc5c7553155165efc4bccdaa5ecb727656037d" name="kernel-ipaclones-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="d4a51ffa397cecf97cb040eea244cf03ea49c7c8533af0c0f26907e1c327cf87" name="kernel-ipaclones-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="a404df89b420c196230de10e3db92a1a87c4247735af6cb07f4670d38a0764cc" name="kernel-ipaclones-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="e674ef303c0b1ff965caef0c1b8f1b7aab09e4ad9dbebcadd98ed7319586ea5c" name="kernel-ipaclones-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="38bd1dd7ba4528eacdd66992a9a1f33f5db496455dfef52b5825246f63886b4e" name="kernel-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="d8dcbaea676e1874677c8fb374e8f56976ee5f678b491eb6375de240efce6bc5" name="kernel-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="68a1e9dce915bb48477f2fbd0796c59fc78edc652b352e102ba2d5e03e0c5024" name="kernel-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="c8d46b9f998ceea8b76b31b460038890dfc3feb0f6c46b0d1d88d3615fdb4a6c" name="kernel-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="9e033cc2888b7cf353b039be9b6abb72c1271132a048faa0d10dee2a6815cc1e" name="kernel-modules" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="bde7355e12d14de90d250c229dba42c7be4fc9779df8f6a5c44102a323699d63" name="kernel-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="5a812cfb8149219842d470b1febdef91a160d31758e25bc07e4b31b5e6934778" name="kernel-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="0a8b3dde665396a15eb375fd796516d8625f0540c08991ba2be5d42a5f5fc335" name="kernel-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="1b8ae17f673353abc9597c709b38b468abf0b570a99cd3ea0fd42237292f5f90" name="kernel-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="a591d390b9fd4f580937a6645ff82fd5c984b18cc0cc78effc3c2ab12d7e1d21" name="kernel-modules-extra" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="6d54a75b814289005e4b59bb6219c0e2482ee1e14fd10b19f4265523d47b2d3d" name="kernel-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="b97dda098b833fb905ffc69c42508d82d3108ab438290f28aac170cc0a708061" name="kernel-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="8ddc0f0b76cc8ae3f8099cbb8f52fc4e3593d6280964b011e74b758bf07b4680" name="kernel-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="faa031849c810757d71e263cc9ffe18f4fdb003dc396ee302f3f36fdff3b2233" name="kernel-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="0e10424ee5009a4446d622569ae514a9ee3b8c14bfa4a4346f77aa45f3c5f3c2" name="kernel-modules-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="f211314db11196aff86b4bf942838f15a913c2b887081225289482a0c9c0b7bf" name="kernel-selftests-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="f9940f61e62468724fbfeabb0ebecbc212a35bbbb440ffaadf675c0d2e11f4c1" name="kernel-selftests-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="7bd8aca3a131117d699e263130aeb9e161cbf4c6fc77c9b208cf8663dac851c7" name="kernel-selftests-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="44a0de58b365236e330b1e4e53aad11d611b1f3640f0c6ace17f7c4f611908cf" name="kernel-selftests-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="38f1d7302bc1de402e9c6b4467cf910ae33a7ee5c84e2c0347f0848afd774b1e" name="kernel-selftests-internal" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="d1f14a09e61983889c8ddcc93527e44380f7c769857fced74cea5dbb73c3e354" name="kernel-tools" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="8de979a852cfd57d6eb37cb044a07cbd35bf07ef7d1b004cf525acf85fa5be59" name="kernel-tools" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="c084f717a6c5a39fe38b1293d683d51e7fd868751e09e72967246d51f6fd11b2" name="kernel-tools" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="e9e79046fab047432182c7658742bf4b5e45035fd4e79cb471d1c8d83b110b24" name="kernel-tools" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="d7f5338b6e2b25ef169be1fcbc6626c9cd6caffcd050b66dc68bfe1d35f453eb" name="kernel-tools" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="32829b056e50b61b035b63b57a45ad929bc39ba7819475eb03259bbee4836347" name="kernel-tools-libs" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="fb009291d04e808cb06cc02693f17a9e36623c728b267a0959f7b5be4d47e775" name="kernel-tools-libs" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="95e5f08d261c3016a4990762caeb00db58da94c75416ab47408d594686081038" name="kernel-tools-libs" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="58c2a23e2a9cfc0efbc67044270f6548757ea7cbd175f673b639adb541af8bb0" name="kernel-tools-libs" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="83a7b0e67a2449706d30b27609ca920c27ca248e7dff7a62d00402bab892caab" name="kernel-tools-libs" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="c1d917e538431f62947c3a4300174c234a289230430e10581afa688d544f62ce" name="kernel-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="cd0db71ef0f5ea23df9815963ab08244fd00b9b5c1e1875cd578c7413ad0f9a8" name="kernel-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="c3731cb6806d6a3ae0cce46c6362e99b60d436dfd192e73e2e1f49db52b35bcc" name="kernel-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="7d852542674f468682de5ff0b1ab09a9a11180b5728af0efae679112c8083351" name="kernel-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="f928ada6f484876850a18816a378eed01b6872836a29cf84d26fa05e75abdb68" name="kernel-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="bb32c55885401485ea6aa583365cfff71e740274e6b6c7ba79093098c4799dbc" name="kmod-idpf-irdma" arch="x86_64">
  <version epoch="0" ver="0.0.129.20_0.0.647" rel="32.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-32" date="1764331200">- Fix build for EL 10.1 kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-31" date="1763640000">- Fix metapackage requirements</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-30" date="1763035200">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 0.0.129.20_0.0.647-29" date="1760616000">- Fixed internal secureboot signing logic
- Allows signing of kmod built against 6.12.x kernels in a Rocky 8 or 9 buildroot</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-28" date="1759320000">- Fix timeout stall due to few pkts inflight
- Fix a race in txq wakeup
- Fix re handling
- Add no_stash mode</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-27" date="1758110400">- Fix FPM address truncation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-26" date="1757937600">- Add workaround for CEQ-0 interrupt issue
- Use CQ ID for CEQE context on GEN 3 hardware
- Increase poll frequency for CQP completions
- Initialize cqp_info field to avoid resource leaks</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-25" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-24" date="1752667200">- Revert QPN workaround patch as requested by Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-23" date="1749816000">- Remove unused python byte generator since it's in a different location in 10</changelog>
</package>
<package pkgid="780cd1c8a13dafe7aee561f48c7e0f59fc68aa5f71eed24c7070536a5fe14a64" name="kmod-idpf-irdma-base" arch="x86_64">
  <version epoch="0" ver="0.0.129.20_0.0.647" rel="32.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-32" date="1764331200">- Fix build for EL 10.1 kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-31" date="1763640000">- Fix metapackage requirements</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-30" date="1763035200">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 0.0.129.20_0.0.647-29" date="1760616000">- Fixed internal secureboot signing logic
- Allows signing of kmod built against 6.12.x kernels in a Rocky 8 or 9 buildroot</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-28" date="1759320000">- Fix timeout stall due to few pkts inflight
- Fix a race in txq wakeup
- Fix re handling
- Add no_stash mode</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-27" date="1758110400">- Fix FPM address truncation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-26" date="1757937600">- Add workaround for CEQ-0 interrupt issue
- Use CQ ID for CEQE context on GEN 3 hardware
- Increase poll frequency for CQP completions
- Initialize cqp_info field to avoid resource leaks</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-25" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-24" date="1752667200">- Revert QPN workaround patch as requested by Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-23" date="1749816000">- Remove unused python byte generator since it's in a different location in 10</changelog>
</package>
<package pkgid="996b9263c469b74b5f0d2f0f51aec9cf4a2cdbcf3535852fda74ab58ee2f2fed" name="kmod-idpf-irdma-debug" arch="x86_64">
  <version epoch="0" ver="0.0.129.20_0.0.647" rel="32.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-32" date="1764331200">- Fix build for EL 10.1 kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-31" date="1763640000">- Fix metapackage requirements</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-30" date="1763035200">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 0.0.129.20_0.0.647-29" date="1760616000">- Fixed internal secureboot signing logic
- Allows signing of kmod built against 6.12.x kernels in a Rocky 8 or 9 buildroot</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-28" date="1759320000">- Fix timeout stall due to few pkts inflight
- Fix a race in txq wakeup
- Fix re handling
- Add no_stash mode</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-27" date="1758110400">- Fix FPM address truncation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-26" date="1757937600">- Add workaround for CEQ-0 interrupt issue
- Use CQ ID for CEQE context on GEN 3 hardware
- Increase poll frequency for CQP completions
- Initialize cqp_info field to avoid resource leaks</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-25" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-24" date="1752667200">- Revert QPN workaround patch as requested by Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.0.129.20_0.0.647-23" date="1749816000">- Remove unused python byte generator since it's in a different location in 10</changelog>
</package>
<package pkgid="4f4c3a4a491b708467029b870527492bd70e6b630f27533068503f924117c250" name="kmod-mlnx-knem" arch="x86_64">
  <version epoch="0" ver="1.1.4.90mlnx3" rel="11.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-11" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-10" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-9" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-8" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-7" date="1749816000">- Ensure that sign-file workaround only applies to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-6" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-5" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-4" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-3" date="1741694401">- Restructure installation paths to ensure weak-updates works as expected</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-2" date="1741694400">- Fix postun scripts</changelog>
</package>
<package pkgid="c6b526f42178552fd188cf2afe0b29e099007989f9090cfbf6b1bccd0b4ca73a" name="kmod-mlnx-knem-base" arch="x86_64">
  <version epoch="0" ver="1.1.4.90mlnx3" rel="11.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-11" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-10" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-9" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-8" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-7" date="1749816000">- Ensure that sign-file workaround only applies to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-6" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-5" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-4" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-3" date="1741694401">- Restructure installation paths to ensure weak-updates works as expected</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-2" date="1741694400">- Fix postun scripts</changelog>
</package>
<package pkgid="a87cf0c7873937bd90f7a38e82811d00ab5daa4bdaace4f63935714c78d48ca2" name="kmod-mlnx-knem-common" arch="x86_64">
  <version epoch="0" ver="1.1.4.90mlnx3" rel="11.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-11" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-10" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-9" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-8" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-7" date="1749816000">- Ensure that sign-file workaround only applies to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-6" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-5" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-4" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-3" date="1741694401">- Restructure installation paths to ensure weak-updates works as expected</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-2" date="1741694400">- Fix postun scripts</changelog>
</package>
<package pkgid="614e90b38a4b53a15d16854b2091b0151e9692a9224f36303d4be12f08f0251d" name="kmod-mlnx-knem-debug" arch="x86_64">
  <version epoch="0" ver="1.1.4.90mlnx3" rel="11.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-11" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-10" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-9" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-8" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-7" date="1749816000">- Ensure that sign-file workaround only applies to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-6" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-5" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-4" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-3" date="1741694401">- Restructure installation paths to ensure weak-updates works as expected</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-2" date="1741694400">- Fix postun scripts</changelog>
</package>
<package pkgid="5567b855f23d45bfd740c59287b606789334f90b2856202a5d2b812978b47d1f" name="kmod-mlnx-knem-devel" arch="x86_64">
  <version epoch="0" ver="1.1.4.90mlnx3" rel="11.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-11" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-10" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-9" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-8" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-7" date="1749816000">- Ensure that sign-file workaround only applies to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 1.1.4.90mlnx3-6" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-5" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-4" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-3" date="1741694401">- Restructure installation paths to ensure weak-updates works as expected</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.1.4.90mlnx3-2" date="1741694400">- Fix postun scripts</changelog>
</package>
<package pkgid="6774a536e46ee9255c22a7847c8470eb1814960d5a9539b6030d136a81207f26" name="kmod-mlnx-mft" arch="x86_64">
  <version epoch="0" ver="4.31.0" rel="10.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 4.31.0-10" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-9" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-8" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 4.31.0-7" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-6" date="1749816000">- Ensure sign-file workaround is only applied to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 4.31.0-5" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-4" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-3" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-2" date="1741694400">- Fix postun scripts</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-1" date="1741608000">- Initial rebuild for Rocky</changelog>
</package>
<package pkgid="dc1a13d87e9989d1f9e2049714a6cf4084af9284d992e02a73c43f7b962ff4f5" name="kmod-mlnx-mft-base" arch="x86_64">
  <version epoch="0" ver="4.31.0" rel="10.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 4.31.0-10" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-9" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-8" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 4.31.0-7" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-6" date="1749816000">- Ensure sign-file workaround is only applied to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 4.31.0-5" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-4" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-3" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-2" date="1741694400">- Fix postun scripts</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-1" date="1741608000">- Initial rebuild for Rocky</changelog>
</package>
<package pkgid="14949eb7c87abd1f28cf4ddaa0a1278de4f6bef56b7af1fd590f9eaca5cafcb1" name="kmod-mlnx-mft-debug" arch="x86_64">
  <version epoch="0" ver="4.31.0" rel="10.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 4.31.0-10" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-9" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-8" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 4.31.0-7" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-6" date="1749816000">- Ensure sign-file workaround is only applied to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 4.31.0-5" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-4" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-3" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-2" date="1741694400">- Fix postun scripts</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 4.31.0-1" date="1741608000">- Initial rebuild for Rocky</changelog>
</package>
<package pkgid="101ab0b91fde36626a98ac81b95c3ed31d93f6e9785c390857cee709b6c89ae5" name="kmod-mlnx-ofa" arch="x86_64">
  <version epoch="0" ver="25.01" rel="20.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-20" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-19" date="1763985600">- Fix Requires for kmod-nvidia-dc-peermem since it's not available for RT kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-18" date="1763640000">- Fix metapackage requirements</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-17" date="1762776000">- Add support for all the different kernel variants</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-16" date="1754568000">- Ensure initramfs is rebuilt when installing kmod-mlnx-ofa</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-15" date="1750420800">- Bump for rebuild against new CLK kernel</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-14" date="1749816001">- Ensure correct sign-file macro is used in Rocky 10</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-13" date="1749816000">- Ensure sign-file workaround only applies to Rocky &lt; 10</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-12" date="1749124800">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-11" date="1744632000">- Bump to rebuild against new kernel</changelog>
</package>
<package pkgid="6ff2fdadcbed05716d9ccf64e7e037c27608c9700020db4c24973436ec7b520b" name="kmod-mlnx-ofa-base" arch="x86_64">
  <version epoch="0" ver="25.01" rel="20.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-20" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-19" date="1763985600">- Fix Requires for kmod-nvidia-dc-peermem since it's not available for RT kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-18" date="1763640000">- Fix metapackage requirements</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-17" date="1762776000">- Add support for all the different kernel variants</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-16" date="1754568000">- Ensure initramfs is rebuilt when installing kmod-mlnx-ofa</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-15" date="1750420800">- Bump for rebuild against new CLK kernel</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-14" date="1749816001">- Ensure correct sign-file macro is used in Rocky 10</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-13" date="1749816000">- Ensure sign-file workaround only applies to Rocky &lt; 10</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-12" date="1749124800">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-11" date="1744632000">- Bump to rebuild against new kernel</changelog>
</package>
<package pkgid="236e7dfa874a54992cec4b4c1ba49f19b4fcc8a81236e67648186a0576d3f8a4" name="kmod-mlnx-ofa-common" arch="x86_64">
  <version epoch="0" ver="25.01" rel="20.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-20" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-19" date="1763985600">- Fix Requires for kmod-nvidia-dc-peermem since it's not available for RT kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-18" date="1763640000">- Fix metapackage requirements</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-17" date="1762776000">- Add support for all the different kernel variants</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-16" date="1754568000">- Ensure initramfs is rebuilt when installing kmod-mlnx-ofa</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-15" date="1750420800">- Bump for rebuild against new CLK kernel</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-14" date="1749816001">- Ensure correct sign-file macro is used in Rocky 10</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-13" date="1749816000">- Ensure sign-file workaround only applies to Rocky &lt; 10</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-12" date="1749124800">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-11" date="1744632000">- Bump to rebuild against new kernel</changelog>
</package>
<package pkgid="3b4e941e4c9be9ec9b00b0d446b4481ff01543c5b83d7eebefeed71dbafd2e75" name="kmod-mlnx-ofa-debug" arch="x86_64">
  <version epoch="0" ver="25.01" rel="20.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-20" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-19" date="1763985600">- Fix Requires for kmod-nvidia-dc-peermem since it's not available for RT kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-18" date="1763640000">- Fix metapackage requirements</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-17" date="1762776000">- Add support for all the different kernel variants</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-16" date="1754568000">- Ensure initramfs is rebuilt when installing kmod-mlnx-ofa</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-15" date="1750420800">- Bump for rebuild against new CLK kernel</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-14" date="1749816001">- Ensure correct sign-file macro is used in Rocky 10</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-13" date="1749816000">- Ensure sign-file workaround only applies to Rocky &lt; 10</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-12" date="1749124800">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-11" date="1744632000">- Bump to rebuild against new kernel</changelog>
</package>
<package pkgid="03f28340597c874d6e8e68a7af0abd30a86d95a96d44ed18cf22edd191beffd8" name="kmod-mlnx-ofa-devel" arch="x86_64">
  <version epoch="0" ver="25.01" rel="20.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-20" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-19" date="1763985600">- Fix Requires for kmod-nvidia-dc-peermem since it's not available for RT kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-18" date="1763640000">- Fix metapackage requirements</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-17" date="1762776000">- Add support for all the different kernel variants</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-16" date="1754568000">- Ensure initramfs is rebuilt when installing kmod-mlnx-ofa</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-15" date="1750420800">- Bump for rebuild against new CLK kernel</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-14" date="1749816001">- Ensure correct sign-file macro is used in Rocky 10</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-13" date="1749816000">- Ensure sign-file workaround only applies to Rocky &lt; 10</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-12" date="1749124800">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-11" date="1744632000">- Bump to rebuild against new kernel</changelog>
</package>
<package pkgid="8cf6a4655fdda18b6a5e074221d8aeaf0f91aaf4d6fdb090678f00c2ab964377" name="kmod-mlnx-ofa-source" arch="x86_64">
  <version epoch="0" ver="25.01" rel="20.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-20" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-19" date="1763985600">- Fix Requires for kmod-nvidia-dc-peermem since it's not available for RT kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-18" date="1763640000">- Fix metapackage requirements</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-17" date="1762776000">- Add support for all the different kernel variants</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-16" date="1754568000">- Ensure initramfs is rebuilt when installing kmod-mlnx-ofa</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-15" date="1750420800">- Bump for rebuild against new CLK kernel</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-14" date="1749816001">- Ensure correct sign-file macro is used in Rocky 10</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-13" date="1749816000">- Ensure sign-file workaround only applies to Rocky &lt; 10</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 25.01-12" date="1749124800">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-11" date="1744632000">- Bump to rebuild against new kernel</changelog>
</package>
<package pkgid="f2a7fb6ca3753b79d6a8a9cb082479a9c1db0e6b9608650d81e8014d08c7ad8c" name="kmod-mlnx-xpmem" arch="x86_64">
  <version epoch="0" ver="2.7.4" rel="10.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-10" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-9" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-8" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-7" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-6" date="1749816000">- Ensure sign-file workaround is only applied to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-5" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-4" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-3" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-2" date="1741694400">- Initial rebuild for Rocky</changelog>
</package>
<package pkgid="3a9d9bf36c91fa29738706201f727b7a8a12e8d58e1605b16e33e9fc7aa310ab" name="kmod-mlnx-xpmem-base" arch="x86_64">
  <version epoch="0" ver="2.7.4" rel="10.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-10" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-9" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-8" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-7" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-6" date="1749816000">- Ensure sign-file workaround is only applied to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-5" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-4" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-3" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-2" date="1741694400">- Initial rebuild for Rocky</changelog>
</package>
<package pkgid="52fe41cb0fcb00b388ab52dc9558770c580eb4b952e860d8c62bc6196fee038e" name="kmod-mlnx-xpmem-common" arch="x86_64">
  <version epoch="0" ver="2.7.4" rel="10.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-10" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-9" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-8" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-7" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-6" date="1749816000">- Ensure sign-file workaround is only applied to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-5" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-4" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-3" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-2" date="1741694400">- Initial rebuild for Rocky</changelog>
</package>
<package pkgid="9d5d2fcbeb3a2a98e1062a4cbcffa2fc31d195e6a01e3e31878728cb0b410fe7" name="kmod-mlnx-xpmem-debug" arch="x86_64">
  <version epoch="0" ver="2.7.4" rel="10.el8_10_ciq"/>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-10" date="1764590400">- Obsolete old kmod-mlnx-*-el810 drivers in favor of unified package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-9" date="1763121600">- Add support for all the different kernel variants
- Add metapackage to ensure the correct kmod variant is installed for any
  installed kernel variant</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-8" date="1754568000">- Ensure initramfs is rebuilt when installing kmod</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-7" date="1750420800">- Bump for CLK kernel rebuild</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-6" date="1749816000">- Ensure sign-file workaround is only applied to Rocky &lt; 10
- Remove unused python generators</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 2.7.4-5" date="1749470400">- Add sign-file workaround to enable secureboot signing for newer kernels</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-4" date="1741953600">- Fix SecureBoot macro</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-3" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2.7.4-2" date="1741694400">- Initial rebuild for Rocky</changelog>
</package>
<package pkgid="50df3eb26b168d23389602b9183165ae0586bcac422f2c68cdfff80f77f9b202" name="kmod-nvidia-dc-open550" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="2.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-2" date="1746100801">- Clean up conflicts</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1744804800">- Ensure weak-modules is run after new kernel has had a chance to setup kmod-mlnx-ofa weak-modules</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1743768000">- Obsolete `kmod-nvidia-open-dkms`</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-10" date="1742385600">- Fix nvidia-peermem weak-modules bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-9" date="1741953600">- Break nvidia-peermem into a separate subpackage due to MOFED dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-8" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-7" date="1741176000">- Properly obsolete earlier kernel modules</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-6" date="1739448000">- Fix udev rules and refactor duplicate sections so they're no longer required</changelog>
</package>
<package pkgid="1c5ad06a27a92b9fa585920a9906848dea78851dafe1dbc23febacddf4e9e57b" name="kmod-nvidia-dc-open570" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768392000">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-3" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-2" date="1760356800">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-4" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure all nvidia kmods are excluded from initramfs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 570.148.08-3" date="1750420800">- Bump for rebuild: CIQ-kernel 6.12.30</changelog>
</package>
<package pkgid="7abe1a2e32b20f6bdf600ab4fff617a146ba375c3de6b10b412a7754c7950f34" name="kmod-nvidia-dc-open570-base" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768392000">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-3" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-2" date="1760356800">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-4" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure all nvidia kmods are excluded from initramfs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 570.148.08-3" date="1750420800">- Bump for rebuild: CIQ-kernel 6.12.30</changelog>
</package>
<package pkgid="f67d87bc1bec30d7aad9f7514a16d3c3be6036647beb7922457dca0f8104fcf5" name="kmod-nvidia-dc-open570-debug" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768392000">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-3" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-2" date="1760356800">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-4" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure all nvidia kmods are excluded from initramfs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 570.148.08-3" date="1750420800">- Bump for rebuild: CIQ-kernel 6.12.30</changelog>
</package>
<package pkgid="6c32fa7c788099703e35ff42abe3302459aa2e52a24f0ed249619b80bf1b9740" name="kmod-nvidia-dc-open580" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-2" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-2" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-3" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
</package>
<package pkgid="047017a4e25c316185ee96e6537981ed6113014c5206313e938169a7abef4141" name="kmod-nvidia-dc-open580-base" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-2" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-2" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-3" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
</package>
<package pkgid="352f5b317137eb59421d1e8d44f5acacfb504d67096cb3e20b4763ef1f2459c2" name="kmod-nvidia-dc-open580-debug" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-2" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-2" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-3" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
</package>
<package pkgid="d93b164df77c15435abdd976f8a03180072747f5aaf4d4c5396e03e058446ad1" name="kmod-nvidia-dc-open590" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="3d3713ba0d12970eaffa621e1fefa7f0512578c3863871db2cf78804a650f79c" name="kmod-nvidia-dc-open590-base" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="944adacc2ad0637ddee7d071b44aab45bf7630789cbb65694b573ed7fc01140a" name="kmod-nvidia-dc-open590-debug" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="2fbcdb7807ccdc2a8dbd05ab4d75135cc925726155efa070f86fea3b77474bb8" name="kmod-nvidia-dc-open595" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 595.58.03-1" date="1774440000">- Initial 595 release</changelog>
</package>
<package pkgid="b9cd2a0d7e4197383da99979ef169ebabf7e21ad7ab6ca4ac9a3ab750b54d984" name="kmod-nvidia-dc-open595-base" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 595.58.03-1" date="1774440000">- Initial 595 release</changelog>
</package>
<package pkgid="1fc662f5d421627edfeebd785bf7471b3359ae41016c42a5c0627e2e696a03dd" name="kmod-nvidia-dc-open595-debug" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 595.58.03-1" date="1774440000">- Initial 595 release</changelog>
</package>
<package pkgid="e9d747410ea4c2fc3f464977153ca4785b3eed7aa323cb6f40f3975040c67617" name="kmod-nvidia-dc-open-latest" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="9bef829212eec96aab8b391f0d2cecaa489511e6726a3e9358395691dc49843e" name="kmod-nvidia-dc-open-latest-base" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="cf9b81320eed1004ca7e78efc3d80fc47f2ef5276137edb1abdff955519b5978" name="kmod-nvidia-dc-open-latest-debug" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="20fde267d0520c66f19a64376b6545ea7c64003bb9fe14544a78da5b26b1f9cf" name="kmod-nvidia-dc-open-peermem550" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="2.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-2" date="1746100801">- Clean up conflicts</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1744804800">- Ensure weak-modules is run after new kernel has had a chance to setup kmod-mlnx-ofa weak-modules</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1743768000">- Obsolete `kmod-nvidia-open-dkms`</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-10" date="1742385600">- Fix nvidia-peermem weak-modules bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-9" date="1741953600">- Break nvidia-peermem into a separate subpackage due to MOFED dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-8" date="1741780800">- Add SecureBoot config</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-7" date="1741176000">- Properly obsolete earlier kernel modules</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-6" date="1739448000">- Fix udev rules and refactor duplicate sections so they're no longer required</changelog>
</package>
<package pkgid="ae0ba8550d125bf0629a507f9c7252f92056b989765f93f72214b740786af343" name="kmod-nvidia-dc-open-peermem570" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768392000">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-3" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-2" date="1760356800">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-4" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure all nvidia kmods are excluded from initramfs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 570.148.08-3" date="1750420800">- Bump for rebuild: CIQ-kernel 6.12.30</changelog>
</package>
<package pkgid="f54a038d9e51dcb66edf84fcaf0ab73fd22493c91ce4f592c5696e538476099e" name="kmod-nvidia-dc-open-peermem570-base" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768392000">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-3" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-2" date="1760356800">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-4" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure all nvidia kmods are excluded from initramfs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 570.148.08-3" date="1750420800">- Bump for rebuild: CIQ-kernel 6.12.30</changelog>
</package>
<package pkgid="476522160b76e57edb587503a5677ae56b201416b93e4572273fca54997f0f70" name="kmod-nvidia-dc-open-peermem570-debug" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768392000">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-3" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-2" date="1760356800">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-4" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure all nvidia kmods are excluded from initramfs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 570.148.08-3" date="1750420800">- Bump for rebuild: CIQ-kernel 6.12.30</changelog>
</package>
<package pkgid="a9a93e77b42af8bc329db1e9f43e255b3610e97ef780b33a66fbefddd1983ca9" name="kmod-nvidia-dc-open-peermem580" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-2" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-2" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-3" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
</package>
<package pkgid="f774356803e1b958a4da054329f2c4701d24b5841859f5050ed347a113f15915" name="kmod-nvidia-dc-open-peermem580-base" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-2" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-2" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-3" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
</package>
<package pkgid="4fa40673866f8a0f76cfdcc25922f17d70d25f5642e2bae30ac60b7b28060a46" name="kmod-nvidia-dc-open-peermem580-debug" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-2" date="1763035200">- Add support for all the kernel variants except rt* (since NVIDIA doesn't
  support realtime kernels)</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-2" date="1759147200">- Bump for rebuild after Rocky kernels changed kABI for certain DRM symbols</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-3" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
</package>
<package pkgid="aadf895eedbf8b2ee2b176a4fbf9efd7e3f209436e16885df51f9f90ad6e6145" name="kmod-nvidia-dc-open-peermem590" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="1e075bf9113923f2aae5b7d769ffae14e4d471e95fea59e00db6da51f503a7ea" name="kmod-nvidia-dc-open-peermem590-base" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="acf8c6adafad04a8ff81dc6d360f86cb42a5f7f6771c089fc60eb56c80a85f72" name="kmod-nvidia-dc-open-peermem590-debug" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="46a18c7c604726d9760170be2152d80fda0a2acd0b57c99d0a7cb25cdf81c510" name="kmod-nvidia-dc-open-peermem595" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 595.58.03-1" date="1774440000">- Initial 595 release</changelog>
</package>
<package pkgid="24ba9c293994749266fd18bfa129cc9579e32d27d06a00ebebcf1875cd6b2441" name="kmod-nvidia-dc-open-peermem595-base" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 595.58.03-1" date="1774440000">- Initial 595 release</changelog>
</package>
<package pkgid="58d3747bef6885514bc9bf48c7546cb69777d6709895b272115352376d37b35e" name="kmod-nvidia-dc-open-peermem595-debug" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 595.58.03-1" date="1774440000">- Initial 595 release</changelog>
</package>
<package pkgid="b92f425fcdd856342e1ee3c8bb400479f7ec44fac8731811c4b085a6fd94da08" name="kmod-nvidia-dc-open-peermem-latest" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="1127e12cf0c59ecb8ca6247c77be2448707bb5f2ef8c2bbee6ebdcff03218643" name="kmod-nvidia-dc-open-peermem-latest-base" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="8076836e9c6c6a2014319973207233061e49c25e0b5482f4e412c28778681a66" name="kmod-nvidia-dc-open-peermem-latest-debug" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial 590 release</changelog>
</package>
<package pkgid="6cf28abf811ad6b2ff85e2b1ffcdd19f1b3ca6b33dac5f647bb8baa43ce8bffa" name="libibumad" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="dc94a0522b2f3a7ee4803151b3a72a6f4b824a5e1ff0c83f6f075b8a7fd805a4" name="libibumad" arch="i686">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="db14b529be868afb198406adfcb5adb2a8c07c6efeb38586a9d8b0b5792fd7e7" name="libibverbs" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="fbb49a0d79b60b9551071a79eb7ac3f7ce49aa335526c065fab0ca27df46db2b" name="libibverbs" arch="i686">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="3b7163a8d0b903f307e980416897ee1c3b3a8eff6a63160991f0ce0f906c0e0a" name="libibverbs-utils" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="d2dac9be3e32086c4a76975345316940b2527365223a4e1e114fc815de1326b8" name="libnvidia-dc550-cfg" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="af7fb751ac5529dac0eac0ee37a1f6741c73369a78a727dcf24a0a5cfe9869b0" name="libnvidia-dc550-fbc" arch="i686">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="8c2aaad86e971e0e2ba69040cc95be2c45c1b6d3a8f5b1967434bdcf57688da0" name="libnvidia-dc550-fbc" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="3d59508ea67e8bdbb756f78c318df7107219bfbe0989b1c1627e5533f19e8074" name="libnvidia-dc550-ml" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="e68e3cd1c9ac5c4de3a027a03c834b9b5e4c8442301a140af9b02a497be2a57f" name="libnvidia-dc550-ml" arch="i686">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="9eda10472dda6de14b655df3d51690fee3d8e6604e1fe3a6103d1b9e8af48e03" name="libnvidia-dc570-cfg" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="1e5cccf83cd2e4f51f768b9a439f2b9e54e523fdb3fc089cdad3af9a642c6da8" name="libnvidia-dc570-fbc" arch="i686">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="1ab95c3802e1b892f3471c95ee8cc6a00bb180d044c424a0242fe1daf95b8d1d" name="libnvidia-dc570-fbc" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="ddac1d72952f78070c63a606953a61a94ea5df0afb29dcd819e1674cce0fcb69" name="libnvidia-dc570-ml" arch="i686">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="ddbe21bc1468be76d7b530d884fde285e9ec18177f60e3aea61c8e3021aef2b9" name="libnvidia-dc570-ml" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="6e62a31d5efd57e058217b5ec9396bfb3960066558aac1944c4fdcaf53a83c68" name="libnvidia-dc580-cfg" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="e5929af0500d1fa8e0626d9f7e848e6f1750db0e711b500fa8498c9e88d46aae" name="libnvidia-dc580-fbc" arch="i686">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="1d725bd80566cdfde3b4084535c42efa7a7567ae8ca96d7157420dd5fb163838" name="libnvidia-dc580-fbc" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="8d97dc26532aebcefbc5d3839cb494437f019369bb497520073ff20f26c2d7ec" name="libnvidia-dc580-ml" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="2051e7cb650679c709b2b386f630d1d4ae30c9786e20036f0e0f3aa52cc3a36c" name="libnvidia-dc580-ml" arch="i686">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="ba222b639f62c9554623bfc2fb3d85524174d1ccad3215866ab3bc96b8c4a54e" name="libnvidia-dc590-cfg" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="ba8135e3506f82e1471bb37b883a55461c8ded040c298f195c056ac1407e3545" name="libnvidia-dc590-fbc" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="4980a0188891e33d9f4f82447b4dbfe53f2e82342f23c1fe18e658f66ba6ed4e" name="libnvidia-dc590-fbc" arch="i686">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="43e32a25af96ca8cc77fc979b61f250e451a214ef03eda4bee3aa21056adbc57" name="libnvidia-dc590-ml" arch="i686">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="24ceb080949fabcb39403b79c6d634a79bab323b11472179cbedb2a8b17788db" name="libnvidia-dc590-ml" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="42a714ba74bdb619261579673119129cf2c7429d8698144267dc1fb5deb5ebeb" name="libnvidia-dc595-cfg" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="f7e42f248c033abcb891877855323fcbc9fbf6a48c2f1bf56ce56512d9672124" name="libnvidia-dc595-fbc" arch="i686">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="f297f3e2e1a64046f1569676935e2e4961004e1131d12d549a8fb31b7f7bfdc8" name="libnvidia-dc595-fbc" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="623a0e8fe4989da8551035bf520aa6497ef5ca96cdd79ef83590fe08d916463c" name="libnvidia-dc595-ml" arch="i686">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="02ae2bae3f8d99f294edd094e048270f695c84492141ccdd5136995f62952f1f" name="libnvidia-dc595-ml" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="4b2d74cb0832e76ddec50f55c4e53b5bc02b171d42f33aea03cf68527f8bf8cc" name="libnvidia-dc-latest-cfg" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="0faa58f4539025e7f19f8f368a6139b70f2aa2bc4710c8f3b7df0e20ee10da9d" name="libnvidia-dc-latest-fbc" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="2bbec0f2f957d54f0b482cf5c674dad0114c04a65040924e5ca16b04b759da9d" name="libnvidia-dc-latest-fbc" arch="i686">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="30e46b77bfe69667ded08f51838b9de1134eaeafeaf9eba87e301a8dad0f96b2" name="libnvidia-dc-latest-ml" arch="i686">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="0a11e9518550b89bbe22dc5c992b72c7e898f4774c27f2f77181ad077dcd00a6" name="libnvidia-dc-latest-ml" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="94535ad61fcb924bd399a2bd3b787c2c9f8abc218c27d545b94d340315c3860d" name="libnvidia-dc-nscq570" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="fa79db56af276e9c45145759555f629de93e1cf6a27e98b8f303f67131dceb64" name="libnvidia-dc-nscq580" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="c29bde5d2f279df5b6591bdedfbc99010dafd89a3f2ce7d947c5060bb8c1a19c" name="libnvidia-dc-nscq590" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="3093e49e01b94c9879ca4cd66a31a6eb7eafe87757d76d362c468766d83c36e0" name="libnvidia-dc-nscq595" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="46f9884fac907734ef10fa129ac0c073b05b2ccd099a232dd6706d19825ffc5e" name="libnvidia-dc-nscq-latest" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="76e7c33cedfdf6e37984969c7ff4a35d37630a932e78e435042e3d65ff120aa9" name="librdmacm" arch="i686">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="a4d1457e29c3e7b48b7982f4a2df9c0428193bfad4f6a2f602ec7d0e3362b888" name="librdmacm" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="c34b2206fe5cc644b5196d07e0334115bdb7d729bf2766e03fe590b64dddca58" name="librdmacm-utils" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="aa9fc48da7c4ee53f92ed2c3c950241532b410193ec398c23e68266adba44ec5" name="mlnx-tools" arch="noarch">
  <version epoch="0" ver="25.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 25.01-1" date="1741694400">- Initial rebuild for Rocky</changelog>
  <changelog author="Tzafrir Cohen &lt;nvidia@cohens.org.il&gt; - 5.2.0-1" date="1620820800">- MLNX_OFED branch</changelog>
  <changelog author="Vladimir Sokolovsky &lt;vlad@mellanox.com&gt; - 4.6.0-1" date="1509537600">- Initial packaging</changelog>
</package>
<package pkgid="76e221c9966af02e38107bf0ce858de787c10f1078d9992aede13b6c425f958f" name="nvidia-dc-driver550" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="e808c7226cf9dfa9058f2426907bff5a81f6fc51f3b079df0cba4f7e0a53c172" name="nvidia-dc-driver550-cuda" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="ab93d1a3de155f9a37300f3acb65bcbeb9aca8a3a4f02f9b9dec56f06ea87573" name="nvidia-dc-driver550-cuda-libs" arch="i686">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="0d70f5f1aacf1ffbfa23a0e990d76ec161a7594f9152653d72677ac91bad3f2d" name="nvidia-dc-driver550-cuda-libs" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="0c6fa01c6133573b2ba60509b555c32f891851a266b7aa191ab3e4ef7e76a810" name="nvidia-dc-driver550-gpu" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="3843e860975bd63a48c2a8cf2144367218efe67976320c323ad355ac184a615a" name="nvidia-dc-driver550-gpu-libs" arch="i686">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="48ca71a642af148cc38679620d2e89ab908662bf9514d9fef8e284ebf167132c" name="nvidia-dc-driver550-gpu-libs" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="42883aa9e24eb561496061c08471d10eea5ba822b6e3d664ae4e36d2eb1fa79f" name="nvidia-dc-driver570" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="5c7e1a286e3b082e43cb4f57e3612f95f60dab1abeea9c9c9ca68e8a3004d9d8" name="nvidia-dc-driver570-cuda" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="cd8157a09cb92287473fd8696f233e99d266276bf9260b9ce474e4d835dd51d3" name="nvidia-dc-driver570-cuda-libs" arch="i686">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="f3d6ec045b68860aab2db4ab232c8fe91ed92306bd6ccd89aa7e6cf44ce4de8b" name="nvidia-dc-driver570-cuda-libs" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="1d645ad03898b8f4dedfc56ae1be150bda713f8380e67f68ecb64c9b2e2a0e29" name="nvidia-dc-driver570-gpu" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="d27d36eb5bcc40d4be39de929c6bebe24f172b2c1c2960023491dda5fa6b627d" name="nvidia-dc-driver570-gpu-libs" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="d0b374159d679c4f99b345f3e00e92c013650f41a4ad487119fd236f4a1e11d7" name="nvidia-dc-driver570-gpu-libs" arch="i686">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="757ace33c3e63c607eebb2ab4fd70b11c0de87d58566bc492d1d6587549576a2" name="nvidia-dc-driver580" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="e434db5168c394fa00511fe3d6b0d387e376100219d27a54311e681b9e3aede9" name="nvidia-dc-driver580-cuda" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="0333ae3dae4e0f8e20d84f5c031231005c90343fa0b51f77f9339f025c4af1b0" name="nvidia-dc-driver580-cuda-libs" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="982f8068ed698ce2826fd727ea23dc854801f80dc91fda27c3d6feb1842ed0e4" name="nvidia-dc-driver580-cuda-libs" arch="i686">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="e919d6b7ce25c9f2a6f440dc74d98e075fdad3ea836aacd098c3a16a2761d7be" name="nvidia-dc-driver580-gpu" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="c70c21504ae0167324bddfac64da62ecb4730f427ff576daae02b917eb885b42" name="nvidia-dc-driver580-gpu-libs" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="03e47119a224c1f6dd292953a0dd764079b51dddbceffed4270974a4a13c50db" name="nvidia-dc-driver580-gpu-libs" arch="i686">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="471077cc20c18c3cf01e2a4cfb7220edb90c5ca79c70960215a31dfe014514eb" name="nvidia-dc-driver590" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="64c6897463dbeb28cf4ddffe8011722341b1e7a458268876cff2ee2debcbbca7" name="nvidia-dc-driver590-cuda" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="98579d8a069fd5515192d67dae5b172aad9cc1eb9a43547d17d738ff4664d0df" name="nvidia-dc-driver590-cuda-libs" arch="i686">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="c36c11584611d2acbd12041ab30c37c5b0ec4c9ddb79801fe420ed577add2423" name="nvidia-dc-driver590-cuda-libs" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="55a6c5401bc076507ec1525b1f118abb76289d6677f378cd828e00a163562d19" name="nvidia-dc-driver590-gpu" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="f19ef55f8144d4607035ce250757c825974756ac8113c962816da9cf3cd5215d" name="nvidia-dc-driver590-gpu-libs" arch="i686">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="e142cc4aa8e162e88e5a9a3dedbdb9f185f84685df2294ee52256d75a341832b" name="nvidia-dc-driver590-gpu-libs" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="63b0d468069d514870c4086d6d6648cd8d95e98ec5510a6783101cf6b6e297cd" name="nvidia-dc-driver595" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="92ae868ec90027fff61eb53c40e1f87b4e60d941b864aaeb4a45605bd96cb0df" name="nvidia-dc-driver595-cuda" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="937b22ee1c27e25811c2c24173ab0fe2b00ee036272fa69ff235fc5cc7c132a9" name="nvidia-dc-driver595-cuda-libs" arch="i686">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="3f1659e2d62028004dc053a367caa4aaf77e56b7e03968073f89e7a8c1514d4c" name="nvidia-dc-driver595-cuda-libs" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="570a2fd49e15b229a805dcc051c9c4ab67c344c56b3ecaba1ef2e6f78e4e8d85" name="nvidia-dc-driver595-gpu" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="d1f632d46f1d0c9d5b6e429f5cab07f57b53952c79dabb5763a3c5fc3ef3050c" name="nvidia-dc-driver595-gpu-libs" arch="i686">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="843bcf1872630c993d8837207dab47dcff68426d8a6f27820f8f3d8746d57fee" name="nvidia-dc-driver595-gpu-libs" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="fb6c5537c8a315cdd25e5823a0bf6984cb0785d93963bdc87d59322b9164efbd" name="nvidia-dc-driver-latest" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="9f463f769ce0893a1cc14a40a4a1216b213bb9c680e4a2a85b5307a3a2402836" name="nvidia-dc-driver-latest-cuda" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="110fa71f4de58135a89f2878fe97a229166ad0e240b6a9ed729d8a4b3dd7d082" name="nvidia-dc-driver-latest-cuda-libs" arch="i686">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="991e36688855e625ec22a12564df02fb4c07569bad6802c92c8b37570c0e5171" name="nvidia-dc-driver-latest-cuda-libs" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="2148ac85058703284131eeef5c578dd62bd2a99fcf202d012818550f96464b5a" name="nvidia-dc-driver-latest-gpu" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="aa1388cb8a8b669e3fca948f4a6148b6a872568de56eedf120b908a38e1354e9" name="nvidia-dc-driver-latest-gpu-libs" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="2da8a943fac165f571b7ef958cc0bcae437aefe91b838b1cc8bbd80850fafbcc" name="nvidia-dc-fabric-manager550" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="55ead0916798b98fe8372095e8986282e6bb7abc4be897108d8488e91b827e4e" name="nvidia-dc-fabric-manager550-devel" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="4b350e28bb77beda5aac5c1f105c7c302213d3a4ded8246c7564bf26f7bdb8af" name="nvidia-dc-fabric-manager570" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="36580fc74885b3d5a5ede5e7e8ce22ec4762ee5c7e92d875d78086aac70157a4" name="nvidia-dc-fabric-manager570-devel" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="e519d77b39e520a61143c16c10c7b219be1347f687d6be6d7c642b352487b727" name="nvidia-dc-fabric-manager580" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="b8e4ea13f7655bab43037d39b64fe73e42e282f9e06bcb629033d00b7f61cc7c" name="nvidia-dc-fabric-manager580-devel" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="fb94e0692e88d80a7d92b2c5717195449c8729d7e499bf6bc140caa64481042e" name="nvidia-dc-fabric-manager590" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="9ce5d1e687b0fb03f6739c71db48fa90a0024a2195f839902f860490c95e0704" name="nvidia-dc-fabric-manager590-devel" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="4921ad32fe8ebdf048188b6b897728f21ac5d26ef83ec68bce05ddf7f4bde817" name="nvidia-dc-fabric-manager595" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="267fd7343f2a3b0de172e35c0f002d856cf8aeba9f257c60bd4ebebdd7845b73" name="nvidia-dc-fabric-manager595-devel" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="5cb804b8cafdde41c390cd7639fecb4577284b9bf74a1f238d4d8cde276d4742" name="nvidia-dc-fabric-manager-latest" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="1bf5e909c6548d39048245026e03d37df0585a278637b0521064f4d59c26bf0b" name="nvidia-dc-fabric-manager-latest-devel" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="2869a70454ef563a771e6cd420128b8b7e0f70f6c19c8df25206f27737a7e393" name="nvidia-dc-firmware550" arch="noarch">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="cd88a73e508e63c1cb8070547ea03f7f2c590bc6dd5da7f743707c296e09edbd" name="nvidia-dc-firmware570" arch="noarch">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="546b8b13518bdf3b7d9095fcd8657fe8cd2401c5180670b04aa7c43484470ac2" name="nvidia-dc-firmware580" arch="noarch">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="3cd3fdcfc1aea66d10133065af0e9f9ff01b80093846fa57bf25d5d3f9a9be7b" name="nvidia-dc-firmware590" arch="noarch">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="2f877695a9c6b65209dcf3da3d70a582b0cbb9ab4611273f6c863b1b82749271" name="nvidia-dc-firmware595" arch="noarch">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="b8c3dd135dec2f6513869f5a531f0c2d52ae215566d943433c158ee023a05919" name="nvidia-dc-firmware-latest" arch="noarch">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="68a4d247ecd3f47d6f4a13e072a39a1931d2f894266b885ef85f0f41aaccbf0e" name="nvidia-dc-imex550" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="013bb2817cabc8ac6eb57e4ab7a08c3ce800ec81578bf1ea379da48fb5bf0e66" name="nvidia-dc-imex570" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="d33e66f173c941f3940f04ec5b588c323f7bc4057f6ac7de644908c3621b5a3d" name="nvidia-dc-imex580" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="1da5772ad63bb82491ba8b07a80c3f09a0fff776c653fb5aa80e147a4cb6278c" name="nvidia-dc-imex590" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="083ea3df3118d17f56296669c669ebdb370e43d3974becb425c77299eba0e3d7" name="nvidia-dc-imex595" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="2464ddcd6fd03ac128b23ab9a062cace8378c7e0c7df9b85ec09788ba7d53a53" name="nvidia-dc-imex-latest" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="71b3e2a38e82b529676aa7f66e6d11cc401431ca133054af5778c8534f8d4930" name="nvidia-dc-libnvsdm570" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="a0e641fe4dfc4dc83329eb6c7c388407c93cf4f29759e2252a17d95f405995be" name="nvidia-dc-libnvsdm580" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="14e95a8cfc86ee1443d4c98a0d2a5b0ab0d859cb63d58c98d969f1eda47a93f9" name="nvidia-dc-libnvsdm590" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="07cddef2e30e12ec66834aa25143ecac232bcc1b6b583ba140b3fd95a6bd00c7" name="nvidia-dc-libnvsdm595" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="f5f7840a8b161244a71efb835f03ac8a3be7c52ba896a929e310f55ecc0f3a11" name="nvidia-dc-libnvsdm-latest" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="2b43837abfdfd3d47ff4aa197ba5901ebfc90829ed987d85befadf6902a9add9" name="nvidia-dc-nvlsm" arch="x86_64">
  <version epoch="0" ver="2025.06.10" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2025.06.10-1" date="1763985600">- Update to 2025.06.10</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2025.03.1-1" date="1750852800">- Update to 2025.03.1</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2025.01.5-2" date="1749816000">- Fix rpath build issues on Rocky 10</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 2025.01.5-1" date="1743681600">- Initial release</changelog>
</package>
<package pkgid="0dbbb2d0f370ecc4973695ddbd59aeba5896c7b5b8f0dfae9ac691035e3bdc8d" name="nvidia-dc-persistenced550" arch="x86_64">
  <version epoch="0" ver="550.163.01" rel="1.el8_10.cld_next"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.163.01-1" date="1746100800">- Update to 550.163.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-19" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-18" date="1743768000">- Add fabric-manager to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-17" date="1742558400">- Remove unnecessary requirement that doesn't even exist on i686</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-16" date="1742472000">- Switch from "*nvidia*" to "*nvidia-dc*" to indicate this is a datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-15" date="1742299200">- Fix boolean dependencies</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-14" date="1741176000">- Obsolete old driver with cuda only since that's what it was installing
- Refactor `nvidia-persistenced` packaging since upstream doesn't always do a
  release for each datacenter driver</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-13" date="1739534400">- Refactor files and add egl-gbm dependency</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-12" date="1739448001">- Fix another dependency issue</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 550.144.03-11" date="1739448000">- Fix Requires for EL8</changelog>
</package>
<package pkgid="2f9991f7c021aaea0803271d8ef3f996d9dadb161a5badfa043b93f6488f0516" name="nvidia-dc-persistenced570" arch="x86_64">
  <version epoch="0" ver="570.211.01" rel="1.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 570.211.01-1" date="1768478400">- Update to 570.211.01</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.195.03-1" date="1759320000">- Update to 570.195.03</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-3" date="1757332800">- 570 is no longer the "latest" stable driver, so remove that designation</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-2" date="1754568000">- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.172.08-1" date="1753099200">- Update to 570.172.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.158.01-1" date="1750766400">- Update to 570.158.01
- Add NVIDIA NSCQ to package</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-2" date="1750161600">- Remove dependency on xorg-x11-server-Xorg in Rocky 10+</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.148.08-1" date="1749729600">- Update to 570.148.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.133.20-1" date="1746100800">- Update to 570.133.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 570.124.06-6" date="1744027200">- Add NVIDIA Imex to package
- Fix scriptlets for fabric-manager</changelog>
</package>
<package pkgid="038008bf7b8179298db59cf745df171e03cb172144a8e06ff07017aad052de96" name="nvidia-dc-persistenced580" arch="x86_64">
  <version epoch="0" ver="580.126.20" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.20-1" date="1772020800">- Update to 580.126.20</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.126.16-1" date="1770811200">- Update to 580.126.16</changelog>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 580.126.09-2" date="1769688000">- Add nvidia-uvm.conf and mark as not latest</changelog>
  <changelog author="Pratham Patel &lt;ppatel@ciq.com&gt; - 580.126.09-1" date="1768564800">- Update to 580.126.09</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.105.08-1" date="1763985600">- Update to 580.105.08</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.95.05-1" date="1759838400">- Update to 580.95.05</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.82.07-1" date="1757073600">- Update to 580.82.07
- Mark as latest release</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-2" date="1756468800">- Until this has been more thoroughly tested, don't mark this as latest</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 580.65.06-1" date="1754308800">- Initial release of 580
- Ensure that IMEX ports aren't handed out as ephemeral ports</changelog>
</package>
<package pkgid="5d6c96918e4af488554cc456fa65b20e6651ec061a8b5007fca155e96d9bf642" name="nvidia-dc-persistenced590" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="c4a48d000737ac94f2a920da42383826d7e0c8fd02bce5d491899c110ed685ea" name="nvidia-dc-persistenced595" arch="x86_64">
  <version epoch="0" ver="595.58.03" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 594.58.03-1" date="1774440000">- Initial release of 595</changelog>
</package>
<package pkgid="a6ecf06e58f10593d6938d70b4dc89abfcdd337e0d464d99dd2eccfb0272e7e6" name="nvidia-dc-persistenced-latest" arch="x86_64">
  <version epoch="0" ver="590.48.01" rel="2.el8_10_ciq"/>
  <changelog author="David Gomez &lt;dgomez@ciq.com&gt; - 590.48.01-2" date="1769688000">- Mark as latest and add nvidia-uvm.conf</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 590.48.01-1" date="1767614400">- Initial release of 590</changelog>
</package>
<package pkgid="bec57413b4e11392f484292be6545ffa8b3e1ba430ba9fd6bf11c548054dd511" name="perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="7a4f381523f60ca0e2fc27f87adfe2d3da15ae9186739d222314a649806fe8e1" name="perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="fb57ce8615363c985e02fcad4b6c9c223e61215ff6590b388c04b8f9435259e8" name="perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="eb7409d460aab17070f36a3ada3117ef999c138a8cfee75933c32793cbdda9c8" name="perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="66b1aa9b0ede330a75feb25894d35e13992b2f67e232334b6e1bbc7069666086" name="perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="feed1ca0495ce7c3a0b7eafe989964cbb53a237ae97162c0e0e5584f3d8beb9d" name="python3-dnf-plugin-protected-kmods" arch="noarch">
  <version epoch="0" ver="1.0.1" rel="1.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.0.1-1" date="1770120000">- Fix issue where kernel updates were blocked if the new kernel had the same release, but different version
  (e.g., 5.10.0-1 vs 5.10.1-1).  Not a problem for EL kernels, but could be for custom kernels.</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 1.0.0-1" date="1761652800">- Add support for different kernel variants
- Ensure matching kernels aren't excluded for installed kmods, even if the kmod is not available in the
  enabled repositories</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 0.9.5-1" date="1751976000">- Initial release for EPEL</changelog>
</package>
<package pkgid="01f0d123f48d846c5b43c194f9fa215b8735d74e4d815017d10c61e92228cb4c" name="python3-perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.120.1+3.2.el8_10_ciq"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 4.18.0-553.120.1+3.2.el8_10_ciq" date="1777809600">- [SPEC] aarch64: use uncompressed Image for vmlinuz; do not re-gzip after signing. Fixes secureboot signature verification (Invalid DOS header magic). (Joseph Tate) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.120.1+3.1.el8_10_ciq" date="1777636800">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: algif_aead - Fix minimum RX size check for decryption (Jonathan Maple) [ciqres] {CVE-2026-31431}
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [ciqres] {CVE-2026-31431 CVE-2026-23060.}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [ciqres] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [ciqres] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [ciqres] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [ciqres] {CVE-2026-31431}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1+2.1.el8_10_ciq" date="1777291201">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.120.1ro_build 553+1.1.el8_10_ciq" date="1777291200">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.120.1" date="1776859200">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.117.1.el8_10]" date="1774612800">- nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.116.1.el8_10]" date="1774440000">- nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930]
- NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242]
- pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242]
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242]
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242]
- NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242]
- NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242]
- pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242]
- NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242]
- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242]
- SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242]
- NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242]
- SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242]
- SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242]
- SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242]
- SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242]
- NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242]
- NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419]
- nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419]
- pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419]
- NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419]
- NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419]
- NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419]
- NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419]
- NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419]
- NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419]
- NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419]
- NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419]
- NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419]
- nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419]
- nfs: always check dreq-&gt;error after a commit (Mike Snitzer) [RHEL-156419]
- nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238}
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231}
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942]</changelog>
</package>
<package pkgid="2cbc48d16eb40154b731e1368b61d9f48298c9a9b421540c638169b4dcab1256" name="python3-perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+3.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.118.1.el8_10]" date="1775044800">- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191}
- ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191}</changelog>
</package>
<package pkgid="904484161c533f56aa4b65d6358df19d17cf7a07ddc4bf5737db9fe586fcd0d5" name="python3-perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+4.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.119.1.el8_10]" date="1775563200">- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532]
- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532]
- s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532]
- redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417]
- s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307]
- dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538]
- dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236]
- dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236]
- dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236]
- dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236]
- dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236]
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236]
- dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236]
- dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131}
- dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236]</changelog>
</package>
<package pkgid="dee6079a4eceab3907a291fb8838e00105b2bd3c0725e1ee5fce7b19825aaeb8" name="python3-perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+5.1.el8_10_ciq"/>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.120.1.el8_10]" date="1775649600">- gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075]
- KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657]
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657]</changelog>
</package>
<package pkgid="86424ff6ad548b339d4a6ba87eff68ddab8ded02cf2d6d2f4ffbf10b75b7f3a6" name="python3-perf" arch="x86_64">
  <version epoch="0" ver="4.18.0" rel="553.123.1+6.1.el8_10_ciq"/>
  <changelog author="Brett Mastbergen &lt;bmastbergen@ciq.com&gt; - 4.18.0-553.123.1+6.1.el8_10_ciq" date="1779796800">- smb: client: reject userspace cifs.spnego descriptions (Shreeya Patel) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+5.1.el8_10_ciq" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Roxana Nicolescu) [ciqres] {CVE-2026-46333}
- sched: fix exit_mm vs membarrier (v4) (Roxana Nicolescu) [ciqres] {CVE-2026-46333}</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+4.1.el8_10_ciq" date="1778760000">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Shreeya Patel) [ciqres] {CVE-2026-46300}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}
- Revert "xfrm: esp: avoid in-place decrypt on shared skb frags" (Jonathan Maple) [ciqres]</changelog>
  <changelog author="Jonathan Maple &lt;jmaple@ciq.com&gt; - 4.18.0-553.123.1+3.1.el8_10_ciq" date="1778241600">- xfrm: esp: avoid in-place decrypt on shared skb frags (Jonathan Maple) [ciqres] {CVE-2026-43284}</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1+2.1.el8_10_ciq" date="1778068801">- idpf: remove obsolete stashing code (Joshua Hay) [ciqres]
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay) [ciqres]
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay) [ciqres]
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay) [ciqres]
- idpf: improve when to set RE bit logic (Roxana Nicolescu) [ciqres]
- idpf: add support for Tx refillqs in flow scheduling mode (Roxana Nicolescu) [ciqres]
- idpf: set completion tag for "empty" bufs associated with a packet (Roxana Nicolescu) [ciqres]
- idpf: refactor Tx completion routines (Joshua Hay) [ciqres]
- netdevice: add netdev_tx_reset_subqueue() shorthand (Roxana Nicolescu) [ciqres]
- idpf: convert to libeth Tx buffer completion (Alexander Lobakin) [ciqres]
- libeth: add Tx buffer completion helpers (Roxana Nicolescu) [ciqres]
- PCI: Batch BAR sizing operations (Brett Mastbergen) [ciqres]
- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (Shreeya Patel) [ciqres]
- tipc: fix NULL deref in cleanup_bearer() (Jonathan Maple) [ciqres] {CVE-2024-56661}
- RDMA/mana_ib: use the correct page table index based on hardware page size (Shreeya Patel) [ciqres]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Shreeya Patel) [ciqres]
- RDMA/mana_ib: Fix bug in creation of dma regions (Shreeya Patel) [ciqres]
- net: mana: Add support for page sizes other than 4KB on ARM64 (Shreeya Patel) [ciqres]
- net: mana: Enable MANA driver on ARM64 with 4K page size (Shreeya Patel) [ciqres]
- x86/cpu: Provide default cache line size if not enumerated (Jonathan Maple) [ciqres]
- x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes() (Jonathan Maple) [ciqres]
- x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu() (Jonathan Maple) [ciqres]
- x86/boot: Move x86_cache_alignment initialization to correct spot (Ronnie Sahlberg) [ciqres]
- x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (Ronnie Sahlberg) [ciqres]
- net: fix udp gso skb_segment after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2025-38124}
- bpf: Fix a segment issue when downgrading gso_size (Jonathan Maple) [ciqres] {CVE-2024-42281}
- gso: fix udp gso fraglist segmentation after pull from frag_list (Jonathan Maple) [ciqres] {CVE-2024-49978}
- netdevsim: Fix memory leak of nsim_dev-&gt;fa_cookie (Brett Mastbergen) [ciqres] {CVE-2022-49803}
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Brett Mastbergen) [ciqres] {CVE-2025-21927}
- tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (David Gomez) [ciqres] {CVE-2024-56642}
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets (Jonathan Maple) [ciqres]
- In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey() to zeroize keys on exit. (Jeremy Allison) [ciqres]
- KEYS: use kfree_sensitive with key (Jeremy Allison) [ciqres]
- crypto: ecdh - explicitly zeroize private_key (Jeremy Allison) [ciqres]
-     crypto: jitter - add oversampling of noise source (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- SUSE: patch: crypto-dh-implement-FIPS-PCT.patch (Jeremy Allison) [ciqres]
- crypto: aead,cipher - zeroize key buffer after use (Jeremy Allison) [ciqres]
- crypto: jitter - replace LFSR with SHA3-256 (Jeremy Allison) [ciqres]</changelog>
  <changelog author="CIQ Engineering &lt;engineering@ciq.com&gt; - 4.18.0-553.123.1ro_build 553+1.1.el8_10_ciq" date="1778068800">- [CIQ] NVR Conventions (Jonathan Maple)
- Enable 4k pages for aarch64 (Jonathan Maple)
- Disable kABI checks for aarch64 (Jonathan Maple)
- Adding CIQ secureboot certs, variable overrides and macro (Michael Young)
- [CIQ][FIPS] Begin Integration of FIPS changes from kernel-4.18.0-553.16.1.el8_10.ciqfips.* from FIPS certified submitted code and all unique code maintained in compliant (Jonathan Maple)
- [CIQ][FIPS][x86_64] Update value of CONFIG_CRYPTO_SHA3 to `y` (Jason Rodriguez)
- [CIQ] Update the signer information used to create the kernel module signing key when building the kernel (Jonathan Maple)</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 4.18.0-553.123.1" date="1777982400">- Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)</changelog>
  <changelog author="Denys Vlasenko &lt;dvlasenk@redhat.com&gt; [4.18.0-553.123.1.el8_10]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.122.1.el8_10]" date="1777032000">- nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252}
- kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [4.18.0-553.121.1.el8_10]" date="1776254400">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402}</changelog>
</package>
<package pkgid="c668d6e60b137871ce9ac851ce1459988dd057f34be59ffa4773314187e0c71c" name="python3-pyverbs" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="e04e0819e12fa37f1b82033e3bf2a37059dcd65d521de8e2c914c8190fb6022d" name="python3-rlc-cloud-repos" arch="noarch">
  <version epoch="0" ver="0.1.0" rel="1.1.el8_10_rlc"/>
  <changelog author="Joel Hanger &lt;jhanger@ciq.com&gt; - 0.1.0-1" date="1743422400">- Initial version</changelog>
</package>
<package pkgid="fa98cfc61bb512251ae3f6ebe20cc56cea6b978ed6feda5d39b374801e3a8409" name="python3-rlc-cloud-repos" arch="noarch">
  <version epoch="0" ver="0.2.1" rel="1.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 0.2.1-1" date="1750334400">- Re-release to write the cloudcontentdir var instead of contentdir</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 0.2.0-1" date="1749643200">- Switch AWS repositories for bucket mirrors
- Support AWS bucket mirrors</changelog>
  <changelog author="Joel Hanger &lt;jhanger@ciq.com&gt; - 0.1.0-1" date="1743422400">- Initial version</changelog>
</package>
<package pkgid="1c53ed4f12c4a4b52295d06dca7e035dd9c7cdb2fd037ba81cdbd17f123fca09" name="python3-rlc-cloud-repos" arch="noarch">
  <version epoch="0" ver="0.3.1" rel="1.el8_10_rlc"/>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 0.3.1-1" date="1760702400">- Remove obsolete Oracle Cloud mirror from config</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 0.3.0-1" date="1760616000">- First public release
- Add a plugin system for extending per-cloud variable settings for add-on repositories</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 0.2.1-1" date="1750334400">- Re-release to write the cloudcontentdir var instead of contentdir</changelog>
  <changelog author="Joseph Tate &lt;jtate@ciq.com&gt; - 0.2.0-1" date="1749643200">- Switch AWS repositories for bucket mirrors
- Support AWS bucket mirrors</changelog>
  <changelog author="Joel Hanger &lt;jhanger@ciq.com&gt; - 0.1.0-1" date="1743422400">- Initial version</changelog>
</package>
<package pkgid="93f8813ddf883f0810ce2beff3a603c7e55cf19ef1810b8ff8ac87b250da9936" name="rdma-core" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="63f3e8db2e250df6dc076a2fe99b534171551e60bdf3e981c6e7375d4a293271" name="rdma-core-devel" arch="i686">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="2486b415c01338fbfa2335a2e7287fa24ee0bb2505ca00774fb7b1371aa044d9" name="rdma-core-devel" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
<package pkgid="727470cbe8669f845feae69ded21e7a5a191ccc54707e5a963ac59a4cc49e070" name="rlc-cloud-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.0.el8_10_ciq"/>
  <changelog author="Andrew Jorgensen &lt;ajorgens@ciq.com&gt; - 8.10-1.0" date="1778846400">- Initial 8.10 release based on rocky-release 8.10-1.14
- Replaces ciq-rocky-repos, ciq-rocky-gpg-keys, and ciq-rocky-cloud-repos</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.14" date="1778673600">- Fix GPG key file location in new fast track security repo</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.13" date="1778241601">- Fix typo in repo softlink</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.12" date="1778241600">- Add secureboot certs and repo for new (disabled by default) fast track security repo</changelog>
  <changelog author="Jonathan Dieter &lt;jonathan@dieter.ie&gt; - 8.10-1.11" date="1775131200">- Update secure boot certificates</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.10" date="1744372800">- Update secure boot certificates</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.9" date="1717761600">- Backport distcore macro from 9 and 10</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.8" date="1716811200">- Backport distcore macro from 9 and 10</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.7" date="1712145600">- Update SB certs</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.6" date="1707480000">- Symlink rockyofficial and rockytesting keys</changelog>
</package>
<package pkgid="6b710bd1aa7bf509bd13ec2e8b840076c61c9ac38545722a40a2c3ae161438c9" name="rlc-gpg-keys" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.0.el8_10_ciq"/>
  <changelog author="Andrew Jorgensen &lt;ajorgens@ciq.com&gt; - 8.10-1.0" date="1778846400">- Initial 8.10 release based on rocky-release 8.10-1.14
- Replaces ciq-rocky-repos, ciq-rocky-gpg-keys, and ciq-rocky-cloud-repos</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.14" date="1778673600">- Fix GPG key file location in new fast track security repo</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.13" date="1778241601">- Fix typo in repo softlink</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.12" date="1778241600">- Add secureboot certs and repo for new (disabled by default) fast track security repo</changelog>
  <changelog author="Jonathan Dieter &lt;jonathan@dieter.ie&gt; - 8.10-1.11" date="1775131200">- Update secure boot certificates</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.10" date="1744372800">- Update secure boot certificates</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.9" date="1717761600">- Backport distcore macro from 9 and 10</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.8" date="1716811200">- Backport distcore macro from 9 and 10</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.7" date="1712145600">- Update SB certs</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.6" date="1707480000">- Symlink rockyofficial and rockytesting keys</changelog>
</package>
<package pkgid="bb13bc6d14b535a04d22a37659b405971a70082053544cd1881c3d777fdebdac" name="rlc-release" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.0.el8_10_ciq"/>
  <changelog author="Andrew Jorgensen &lt;ajorgens@ciq.com&gt; - 8.10-1.0" date="1778846400">- Initial 8.10 release based on rocky-release 8.10-1.14
- Replaces ciq-rocky-repos, ciq-rocky-gpg-keys, and ciq-rocky-cloud-repos</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.14" date="1778673600">- Fix GPG key file location in new fast track security repo</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.13" date="1778241601">- Fix typo in repo softlink</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.12" date="1778241600">- Add secureboot certs and repo for new (disabled by default) fast track security repo</changelog>
  <changelog author="Jonathan Dieter &lt;jonathan@dieter.ie&gt; - 8.10-1.11" date="1775131200">- Update secure boot certificates</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.10" date="1744372800">- Update secure boot certificates</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.9" date="1717761600">- Backport distcore macro from 9 and 10</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.8" date="1716811200">- Backport distcore macro from 9 and 10</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.7" date="1712145600">- Update SB certs</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.6" date="1707480000">- Symlink rockyofficial and rockytesting keys</changelog>
</package>
<package pkgid="ddb51e1f09b4f2a7f92e019f3d779b9c70314b7a5db22dc760ddb726227ff14d" name="rlc-repos" arch="noarch">
  <version epoch="0" ver="8.10" rel="1.0.el8_10_ciq"/>
  <changelog author="Andrew Jorgensen &lt;ajorgens@ciq.com&gt; - 8.10-1.0" date="1778846400">- Initial 8.10 release based on rocky-release 8.10-1.14
- Replaces ciq-rocky-repos, ciq-rocky-gpg-keys, and ciq-rocky-cloud-repos</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.14" date="1778673600">- Fix GPG key file location in new fast track security repo</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.13" date="1778241601">- Fix typo in repo softlink</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 8.10-1.12" date="1778241600">- Add secureboot certs and repo for new (disabled by default) fast track security repo</changelog>
  <changelog author="Jonathan Dieter &lt;jonathan@dieter.ie&gt; - 8.10-1.11" date="1775131200">- Update secure boot certificates</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.10" date="1744372800">- Update secure boot certificates</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.9" date="1717761600">- Backport distcore macro from 9 and 10</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.8" date="1716811200">- Backport distcore macro from 9 and 10</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.7" date="1712145600">- Update SB certs</changelog>
  <changelog author="Louis Abel &lt;label@rockylinux.org&gt; - 8.10-1.6" date="1707480000">- Symlink rockyofficial and rockytesting keys</changelog>
</package>
<package pkgid="dca7b3ea9a7cb0d2cd251999fc754db0bfe326d664df2682ed0eb65678758a07" name="shim-ia32" arch="x86_64">
  <version epoch="0" ver="15.8" rel="13.el8_ciq"/>
  <changelog author="Michael L. Young &lt;myoung@ciq.com&gt; - 15.8-13" date="1745668800">- Fix ia32 signing</changelog>
  <changelog author="Michael L. Young &lt;myoung@ciq.com&gt; - 15.8-12" date="1745582400">- Updating to match upstream macros and spec file</changelog>
  <changelog author="Michael L. Young &lt;myoung@ciq.com&gt; - 15.8-11" date="1745496000">- Add CIQ aarch64 certwrapper cert and shim</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 15.8-10" date="1740052800">- Corrected signatures on mmx64 and fbx64 binaries</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 15.8-9" date="1709553600">- Finalizing CIQ shim build for Rocky 8, updated to 15.8 base</changelog>
</package>
<package pkgid="5e2049668fe6d1a6c13d95093416b5d0240ef7de0c0cb81f9e83124cc1da5282" name="shim-unsigned-x64" arch="x86_64">
  <version epoch="0" ver="15.8" rel="0.el8"/>
  <changelog author="Jason Rodriguez &lt;jrodriguez@ciq.com&gt; - 15.8-0" date="1706011200">- Upgrading to Shim 15.8 For CIQ</changelog>
  <changelog author="Jason Rodriguez &lt;jrodriguez@ciq.com&gt; - 15.7-4" date="1700481600">- Removing NX-enabling patch due to NX not being compatible with grub2 and kernel at this time</changelog>
  <changelog author="Jason Rodriguez &lt;jrodriguez@ciq.com&gt; - 15.7-3" date="1697976000">- Enable fix for buggy binutils</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 15.7-2" date="1692705600">- Added real CA from CIQ IT, fixed SBAT</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.co&gt; - 15.7-1" date="1679659200">- Added NX-enabling patch from upstream</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.co&gt; - 15.7-0" date="1679400000">- Upgrading to Shim 15.7 for CIQ</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.co&gt; - 15.6-1" date="1669896000">- Debranded and CA swapped for CIQ from upstream Rocky Linux</changelog>
  <changelog author="Sherif Nagy &lt;sherif@rockylinux.org&gt; - 15.6-1" date="1660651202">- shim 15.6</changelog>
  <changelog author="Sherif Nagy &lt;sherif@rockylinux.org&gt; - 15.6-1" date="1660651201">- Remove main branch</changelog>
  <changelog author="Sherif Nagy &lt;sherif@rockylinux.org&gt; - 15.6-1" date="1660651200">- Adding more patches based on review board feedback https://github.com/rhboot/shim-review/issues/194#issuecomment-894187000 and cherry-pick patches for shim-reivew git 15.4..4583db41ea58195956d4cdf97c43a195939f906b</changelog>
</package>
<package pkgid="80068d39bf0af357f8c3b83473ff97d064bf55b3344b7afd9beba18a1c2bbc8f" name="shim-x64" arch="x86_64">
  <version epoch="0" ver="15.8" rel="13.el8_ciq"/>
  <changelog author="Michael L. Young &lt;myoung@ciq.com&gt; - 15.8-13" date="1745668800">- Fix ia32 signing</changelog>
  <changelog author="Michael L. Young &lt;myoung@ciq.com&gt; - 15.8-12" date="1745582400">- Updating to match upstream macros and spec file</changelog>
  <changelog author="Michael L. Young &lt;myoung@ciq.com&gt; - 15.8-11" date="1745496000">- Add CIQ aarch64 certwrapper cert and shim</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 15.8-10" date="1740052800">- Corrected signatures on mmx64 and fbx64 binaries</changelog>
  <changelog author="Skip Grube &lt;sgrube@ciq.com&gt; - 15.8-9" date="1709553600">- Finalizing CIQ shim build for Rocky 8, updated to 15.8 base</changelog>
</package>
<package pkgid="cdf77cbfc7bcbdaa348fc6cc04857738b345520d8c1f981f312956b6332bfe85" name="srp_daemon" arch="x86_64">
  <version epoch="0" ver="48.0" rel="10.el8_10_ciq"/>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-10" date="1773748800">- Add Google patch to fix shm permissions</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-9" date="1766404800">- Add patches from Google to fix various bugs</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-8" date="1762171200">- Add Google patch to fix rping bug</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; 48.0-7" date="1757332800">- Update with several patches from Google</changelog>
  <changelog author="Jeff Uphoff &lt;juphoff@ciq.com&gt; - 48.0-6" date="1751630400">- Update to Intel v2.5 patches from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-5" date="1742817600">- Add upstream rping patch</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-4" date="1737979200">- Add SRQ lock fix from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-3" date="1735905600">- Add irdma userspace fixes from Google</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@ciq.com&gt; - 48.0-2" date="1731672000">- Add out-of-tree updated Intel irdma driver patch</changelog>
  <changelog author="Kamal Heib &lt;kheib@redhat.com&gt; - 48.0-1" date="1695297600">- Rebase to upstream release v48.0
- Resolves: RHEL-930, RHEL-4240, RHEL-6281, RHEL-6078</changelog>
</package>
</otherdata>