# changelog

author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els7]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role {CVE-2026-46113}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN {CVE-2026-46113}
  - Bluetooth: bcsp: receive data only if registered {CVE-2025-40308}
  - xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
  - xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
  - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts {CVE-2026-43429}
  - net: usb: rtl8150: enable basic endpoint checking {CVE-2025-21708}
  - net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
  - net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
  - net: usb: pegasus: validate USB endpoints {CVE-2026-23290}
  - net: usb: pegasus: enable basic endpoint checking {CVE-2026-43156}
  - USB: usbcore: Introduce usb_bulk_msg_killable() {CVE-2026-43429}
  - USB: core: Add routines for endpoint checks in old drivers {CVE-2026-43156}
  - nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
  - tpm: Cap the number of PCR banks {CVE-2025-71077}
  - clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() {CVE-2023-53704}
  - dm: fix a race condition in retrieve_deps {CVE-2023-54324}
  - ice: fix Tx scheduler error handling in XDP callback {CVE-2025-38127}
  - mlx5: fix skb leak while fifo resync and push {CVE-2023-54238}
  - mmc: vub300: fix return value check of mmc_add_host() {CVE-2022-50251}
  - bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
  - RDMA/irdma: Fix data race on CQP completion stats {CVE-2023-54302}
  - bpf: cpumap: Fix memory leak in cpu_map_update_elem {CVE-2023-53441}
  - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38215}
  - trace/fgraph: Fix the warning caused by missing unregister notifier {CVE-2025-39829}
  - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
  - team: prevent adding a device which is already a team device lower {CVE-2024-58071}
  - net: stmmac: move the EST lock to struct stmmac_priv {CVE-2024-38594}
  - drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too {CVE-2024-50108}
  - rxrpc: Fix handling of received connection abort {CVE-2024-58053}
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w {CVE-2025-37911}
  - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service {CVE-2025-21690}
  - net: atlantic: Fix DMA mapping for PTP hwts ring {CVE-2024-26680}
  - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() {CVE-2024-47713}
  - drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) {CVE-2024-49905}
  - dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
  - smb: client: validate the whole DACL before rewriting it in cifsacl {CVE-2026-31709}
  - PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
  - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
  - nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
  - cachefiles: fix dentry leak in cachefiles_open_file() {CVE-2024-49870}
  - mm: revert "mm: shmem: fix data-race in shmem_getattr()" {CVE-2024-53136}
  - memcg: fix soft lockup in the OOM process {CVE-2024-57977}
  - resource: fix region_intersects() vs add_memory_driver_managed() {CVE-2024-49878}
  - r8169: add tally counter fields added with RTL8125 {CVE-2024-49973}
  - svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() {CVE-2024-53215}
  - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths {CVE-2026-43066}
  - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() {CVE-2025-71273}
  - net: netlink: af_netlink: Prevent empty skb by adding a check on len. {CVE-2021-47606}
  - extcon: Modify extcon device to be created after driver data is set {CVE-2022-49308}
  - tick/nohz: unexport __init-annotated tick_nohz_full_setup() {CVE-2022-49675}
  - bridge: switchdev: Fix memory leaks when changing VLAN protocol {CVE-2022-49812}
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() {CVE-2022-49890}
  - net: genl: fix error path memory leak in policy dumping {CVE-2022-50042}
  - kprobes: don't call disarm_kprobe() for disabled kprobes {CVE-2022-50008}
  - lib/fonts: fix undefined behavior in bit shift for get_default_font {CVE-2022-50511}
  - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
  - arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored {CVE-2022-50675}
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
  - efivarfs: force RO when remounting if SetVariable is not supported {CVE-2023-52463}
  - Fix page corruption caused by racy check in __free_pages {CVE-2023-52739}
  - mptcp: deal with large GSO size {CVE-2023-52778}
  - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new {CVE-2023-52887}
  - drm/i915/active: Fix misuse of non-idle barriers as fence trackers {CVE-2023-53087}
  - ext4: fix task hung in ext4_xattr_delete_inode {CVE-2023-53089}
  - ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent {CVE-2023-53070}
  - bnxt_en: Avoid order-5 memory allocation for TPA data {CVE-2023-53134}
  - tcp: tcp_make_synack() can be called from process context {CVE-2023-53121}
  - i40e: Fix kernel crash during reboot when adapter is in recovery mode {CVE-2023-53114}
  - skbuff: Fix a race between coalescing and releasing SKBs {CVE-2023-53186}
  - blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() {CVE-2023-53421}
  - arm64: mm: fix VA-range sanity check {CVE-2023-53989}
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() {CVE-2024-26633}
  - SUNRPC: double free xprt_ctxt while still in use {CVE-2023-54269}
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed {CVE-2024-26976}
  - drm/amdgpu: validate the parameters of bo mapping operations more clearly {CVE-2024-26922}
  - tracing/trigger: Fix to return error if failed to alloc snapshot {CVE-2024-26920}
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms {CVE-2024-35989}
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). {CVE-2024-36933}
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files {CVE-2024-41056}
  - scsi: qla2xxx: During vport delete send async logout explicitly {CVE-2024-42289}
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() {CVE-2022-49731}
  - ixgbevf: Fix resource leak in ixgbevf_init_module() {CVE-2022-49028}
  - mmc: core: Avoid bitfield RMW for claim/retune flags {CVE-2026-43484}
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() {CVE-2026-45835}
  - cpufreq: Init completion before kobject_init_and_add() {CVE-2022-50473}
  - USB: gadget: Fix use-after-free during usb config switch {CVE-2022-50704}
  - IB/mad: Don't call to function that might sleep while in atomic context {CVE-2022-50472}
  - null_blk: fix poll request timeout handling {CVE-2023-53531}
  - drm/i915/gvt: fix vgpu debugfs clean in remove {CVE-2023-53625}
  - mlxsw: spectrum_acl_erp: Fix object nesting warning {CVE-2024-43880}
  - drm/drm_vma_manager: Add drm_vma_node_allow_once() {CVE-2023-53001}
  - drm/amd/display: fix mapping to non-allocated address {CVE-2023-53753}
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb() {CVE-2023-54265}
  - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). {CVE-2023-54004}
  - netlink: terminate outstanding dump on socket close {CVE-2024-53140}
  - KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN {CVE-2024-53135}
  - scsi: qla2xxx: Fix use after free on unload {CVE-2024-56623}
  - net: Fix icmp host relookup triggering ip_rt_bug {CVE-2024-56647}
  - spi: spi-imx: Add check for spi_imx_setupxfer() {CVE-2025-37801}
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
  - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop {CVE-2026-23300}
  - ethtool: check device is present when getting link settings {CVE-2024-46679}
  - nfsd: return -EINVAL when namelen is 0 {CVE-2024-47692}
  - x86/ioapic: Handle allocation failures gracefully {CVE-2024-49927}
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error {CVE-2024-49959}
  - secretmem: disable memfd_secret() if arch cannot set direct map {CVE-2024-50182}
  - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures {CVE-2024-53190}
  - iommu/arm-smmu: Defer probe of clients after smmu device bound {CVE-2024-56568}
  - RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers {CVE-2025-21885}
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs {CVE-2025-37805}
  - page_pool: avoid infinite loop to schedule delayed worker {CVE-2025-37859}
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() {CVE-2025-38441}
  - tracing: Add down_write(trace_event_sem) when adding trace event {CVE-2025-38539}
  - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
  - ipv6: add NULL checks for idev in SRv6 paths {CVE-2026-23442}
  - sunrpc: fix cache_request leak in cache_release {CVE-2026-31400}
  - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP {CVE-2026-31424}
  - netfilter: xt_multiport: validate range encoding in checkentry {CVE-2026-31681}
  - net: sched: act_csum: validate nested VLAN headers {CVE-2026-31684}
  - vxlan: validate ND option lengths in vxlan_na_create {CVE-2026-31738}
  - gfs2: fiemap page fault fix {CVE-2026-43262}
  - e1000/e1000e: Fix leak in DMA error cleanup {CVE-2026-43445}
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els8]
changelog:
  - gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
  - ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
  - KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
  - Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
  - xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
  - sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
  - blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
  - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
  - gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
  - HID: betop: check shape of output reports {CVE-2023-53015}
  - mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
  - HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
  - drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
  - ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
  - RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
  - Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
  - scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
  - sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
  - ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
  - nbd: don't allow reconnect after disconnect {CVE-2025-21731}
  - openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
  - ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
  - net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
  - ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
  - i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
  - net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
  - bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
  - xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
  - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
  - virtgpu: don't reset on shutdown {CVE-2025-38064}
  - xen/netfront: fix crash when removing device {CVE-2022-48969}
  - mptcp: do not fallback when OoO is present {CVE-2024-50185}
  - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
  - netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
  - xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
  - ext4: fix racy may inline data check in dio write {CVE-2023-52786}
  - drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
  - macsec: fix UAF bug for real_dev {CVE-2022-49390}
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
  - mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
  - driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
  - udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
  - ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
  - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
  - eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
  - net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
  - udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
  - RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
  - dlm: fix possible lkb_resource null dereference {CVE-2024-47809}
  - ACPI: battery: Fix possible crash when unregistering a battery hook {CVE-2024-49955}
  - ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params {CVE-2024-58012}
  - tpm: Change to kvalloc() in eventlog/acpi.c {CVE-2024-58005}
  - net_sched: sch_sfq: move the limit validation {CVE-2025-37752}
  - usb: xhci: Fix NULL pointer dereference on certain command aborts {CVE-2024-57981}
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() {CVE-2025-21861}
  - bpf: avoid holding freeze_mutex during mmap operation {CVE-2025-21853}
  - acct: perform last write from workqueue {CVE-2025-21846}
  - netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() {CVE-2025-21959}
  - ipvlan: ensure network headers are in skb linear part {CVE-2025-21891}
  - wifi: iwlwifi: mvm: fix 6 GHz scan construction {CVE-2024-53055}
  - signal: restore the override_rlimit logic {CVE-2024-50271}
  - thermal: core: Reference count the zone in thermal_zone_get_by_id() {CVE-2024-50028}
  - block: fix potential invalid pointer dereference in blk_add_partition {CVE-2024-47705}
  - userfaultfd: fix checks for huge PMDs {CVE-2024-46787}
  - mptcp: pm: only mark 'subflow' endp as available {CVE-2024-45010}
  - mptcp: pm: re-using ID of unused flushed subflows {CVE-2024-45010}
  - eth: bnxt: fix truesize for mb-xdp-pass case {CVE-2025-21961}
  - driver core: fix potential NULL pointer dereference in dev_uevent() {CVE-2025-37800}
  - virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
  - cgroup: fix race between task migration and iteration {CVE-2026-43439}
  - bpf: Fix wrong reg type conversion in release_reference() {CVE-2022-49873}
  - RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error {CVE-2025-21732}
  - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN {CVE-2026-23472}
  - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion {CVE-2026-23468}
  - net: add proper RCU protection to /proc/net/ptype {CVE-2026-23255}
  - tcp: secure_seq: add back ports to TS offset {CVE-2026-23247}
  - RDMA/mlx5: Fix a WARN during dereg_mr for DM type {CVE-2025-21888}
  - list: fix a data-race around ep->rdllist {CVE-2022-49443}
  - can: isotp: sanitize CAN ID checks in isotp_bind() {CVE-2022-49269}
  - rxrpc: Fix recv-recv race of completed call {CVE-2025-38524}
  - sched/rt: Fix race in push_rt_task {CVE-2025-38234}
  - NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
  - virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
  - block: fix resource leak in blk_register_queue() error path {CVE-2025-37980}
  - xsk: Fix race condition in AF_XDP generic RX path {CVE-2025-37920}
  - mm/vmscan: don't try to reclaim hwpoison folio {CVE-2025-37834}
  - nouveau: offload fence uevents work to workqueue {CVE-2024-26719}
  - bpf: Fix kmemleak warning for percpu hashmap {CVE-2025-37807}
  - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() {CVE-2024-26906}
  - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h {CVE-2024-26906}
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket {CVE-2024-42246}
  - quota: Fix potential NULL pointer dereference {CVE-2024-26878}
  - arp: Prevent overflow in arp_req_get(). {CVE-2024-26733}
  - ALSA: Fix deadlocks with kctl removals at disconnection {CVE-2024-38600}
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values {CVE-2024-42114}
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev() {CVE-2024-41063}
  - fsnotify: clear PARENT_WATCHED flags lazily {CVE-2024-47660}
  - mm: use memalloc_nofs_save() in page_cache_ra_order() {CVE-2024-36882}
  - mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled {CVE-2024-26987}
  - net: esp: fix bad handling of pages from page_pool {CVE-2024-26953}
  - virtio/vsock: Fix accept_queue memory leak {CVE-2024-53119}
  - netfilter: nft_payload: sanitize offset and length before calling skb_checksum() {CVE-2024-50251}
  - fs/proc: fix softlockup in __read_vmcore (part 2) {CVE-2025-21694}
  - drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability {CVE-2024-53051}
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. {CVE-2025-23143}
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() {CVE-2025-22090}
  - net: decrease cached dst counters in dst_release {CVE-2025-22057}
  - nfsd: put dl_stid if fail to queue dl_recall {CVE-2025-22025}
  - nfsd: make nfsd4_run_cb a bool return function {CVE-2025-22025}
  - usb: gadget: core: flush gadget workqueue after device removal {CVE-2025-21838}
  - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 {CVE-2025-21831}
  - media: uvcvideo: Fix crash during unbind if gpio unit is in use {CVE-2024-58079}
  - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() {CVE-2023-52877}
  - ext4: filesystems without casefold feature cannot be mounted with siphash {CVE-2024-49968}
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow {CVE-2024-47739}
  - bpf, lsm: Add check for BPF LSM return value {CVE-2024-47703}
  - sched/smt: Fix unbalance sched_smt_present dec/inc {CVE-2024-44958}
  - xen-netfront: Fix NULL sring after live migration {CVE-2022-48969}
  - dlm: prevent NPD when writing a positive value to event_done {CVE-2025-23131}
  - udp: Deal with race between UDP socket address change and rehash {CVE-2024-57974}
  - bpf: sync_linked_regs() must preserve subreg_def {CVE-2024-53125}
  - mptcp: handle consistently DSS corruption {CVE-2024-50185}
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' {CVE-2024-36478}
  - net: tunnels: annotate lockless accesses to dev->needed_headroom {CVE-2023-53109}
  - net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled {CVE-2025-38039}
  - uprobes: Reject the shared zeropage in uprobe_write_opcode() {CVE-2025-21881}
  - mm: slub: avoid wake up kswapd in set_track_prepare {CVE-2025-39843}
  - mm/smaps: fix race between smaps_hugetlb_range and migration {CVE-2025-39754}
  - bpf: Reject narrower access to pointer ctx fields {CVE-2025-38591}
  - net: clear the dst when changing skb protocol {CVE-2025-38192}
  - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() {CVE-2025-23144}
  - RDMA/core: Don't expose hw_counters outside of init net namespace {CVE-2025-22089}
  - can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
  - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. {CVE-2025-22111}
  - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object {CVE-2025-39851}
  - loop: Avoid updating block size under exclusive owner {CVE-2025-38709}
  - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() {CVE-2025-38643}
  - net_sched: sch_sfq: reject invalid perturb period {CVE-2025-38193}
  - net: phy: mscc: Fix memory leak when using one step timestamping {CVE-2025-38148}
  - espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097}
  - rseq: Fix segfault on registration when rseq_cs is non-zero {CVE-2025-38067}
  - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs {CVE-2025-38040}
  - usb: typec: ucsi: displayport: Fix deadlock {CVE-2025-37967}
  - ipvs: fix uninit-value for saddr in do_output_route4 {CVE-2025-37961}
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211}
  - bpf: Scrub packet on bpf_redirect_peer {CVE-2025-37959}
  - tracing: Verify event formats that have "%*p.." {CVE-2025-37938}
  - iommu/amd/pgtbl: Fix possible race while increase page table level {CVE-2025-39961}
  - net/mlx5e: Harden uplink netdev access against device unbind {CVE-2025-39947}
  - dm-stripe: fix a possible integer overflow {CVE-2025-39940}
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer {CVE-2025-39937}
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
  - net/mlx5e: Fix crash on profile change rollback failure {CVE-2026-23000}
  - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation {CVE-2025-38162}
  - tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
  - rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
  - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997}
  - net: can: j1939: recover socket queue on CAN bus error during BAM transmission {CVE-2026-22997}
  - dm-verity: disable recursive forward error correction {CVE-2025-71161}
  - netfilter: nf_tables: avoid chain re-validation if possible {CVE-2025-71160}
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd {CVE-2025-71147}
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit() {CVE-2026-23069}
  - net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
  - ice: Don't process extts if PTP is disabled {CVE-2024-42107}
  - drm/i915/dpt: Make DPT object unshrinkable {CVE-2024-40924}
  - drm/i915/dpt: Treat the DPT BO as a framebuffer {CVE-2024-40924}
  - bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx {CVE-2024-53091}
  - pipe: wakeup wr_wait after setting max_usage {CVE-2023-52672}
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails {CVE-2023-53103}
  - HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check {CVE-2024-57993}
  - drm/amdkfd: debugfs hang_hws skip GPU with MES {CVE-2025-37853}
  - leds: mlxreg: Use devm_mutex_init() for mutex initialization {CVE-2024-42129}
  - drm/amd/display: fix a Null pointer dereference vulnerability {CVE-2025-39705}
  - gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
  - drm/scheduler: signal scheduled fence when kill job {CVE-2025-38436}
  - drm/amdgpu: Add basic validation for RAS header {CVE-2025-38426}
  - mptcp: fix NULL pointer in can_accept_new_subflow {CVE-2025-23145}
  - bpf: bpf_sk_storage: Fix invalid wait context lockdep report {CVE-2023-53857}
  - nvme-core: fix memory leak in dhchap_secret_store {CVE-2023-53852}
  - virtio_net: Fix error unwinding of XDP initialization {CVE-2023-53499}
  - nvme-core: fix memory leak in dhchap_ctrl_secret {CVE-2023-53792}
  - ceph: fix race condition validating r_parent before applying state {CVE-2025-39927}
  - x86/MCE: Always save CS register on AMD Zen IF Poison errors {CVE-2023-53438}
  - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() {CVE-2023-53332}
  - nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net {CVE-2023-54276}
  - blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init {CVE-2023-54271}
  - net/mlx5e: TC, Fix internal port memory leak {CVE-2023-53999}
  - tipc: do not update mtu if msg_max is too small in mtu negotiation {CVE-2023-53517}
  - tipc: add tipc_bearer_min_mtu to calculate min mtu {CVE-2023-53517}
  - tun: Fix memory leak for detached NAPI queue. {CVE-2023-53685}
  - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize {CVE-2023-53667}
  - start_kernel: Add __no_stack_protector function attribute {CVE-2023-53491}
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
  - sched/psi: use kernfs polling functions for PSI trigger polling {CVE-2023-54019}
  - cxl/pmem: Fix nvdimm registration races {CVE-2023-54323}
  - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock {CVE-2025-68223}
  - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() {CVE-2026-23004}
  - wifi: mac80211: don't WARN for connections on invalid channels {CVE-2025-71227}
  - md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
  - net: stmmac: fix the crash issue for zero copy XDP_TX action {CVE-2025-71095}
  - drm/ttm: Don't leak a resource on eviction error {CVE-2023-54254}
  - firmware: arm_sdei: Fix sleep from invalid context BUG {CVE-2023-54160}
  - iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter {CVE-2023-54057}
  - net: usb: asix: validate PHY address before use {CVE-2025-71094}
  - tty: fix deadlock caused by calling printk() under tty_port->lock {CVE-2022-49441}
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE {CVE-2026-23401}
  - blktrace: fix __this_cpu_read/write in preemptible context {CVE-2026-23374}
  - x86/CPU: Fix FPDSS on Zen1 {CVE-2025-54505}
  - ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
  - gfs2: No more self recovery {CVE-2025-38659}
  - tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() {CVE-2022-49891}
  - tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() {CVE-2022-49796}
  - tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() {CVE-2022-49797}
  - netlink: Bounds-check struct nlmsgerr creation {CVE-2022-49766}
  - bpf: Prevent bpf program recursion for raw tracepoint probes {CVE-2022-49764}
  - i2c: designware: use casting of u64 in clock multiplication to avoid overflow {CVE-2022-49749}
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path {CVE-2026-31555}
  - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
  - netfilter: ctnetlink: use netlink policy range checks {CVE-2026-31495}
  - tracing: Fix potential deadlock in cpu hotplug with osnoise {CVE-2026-31480}
  - esp: fix skb leak with espintcp and async crypto {CVE-2026-31518}
  - xfs: factor out xfs_attr3_leaf_init {CVE-2026-43053}
  - xfs: factor out xfs_attr3_node_entry_remove {CVE-2026-43053}
  - ALSA: ctxfi: Check the error for index mapping {CVE-2026-31777}
  - bridge: br_nd_send: validate ND option lengths {CVE-2026-31752}
  - rtnetlink: add missing netlink_ns_capable() check for peer netns {CVE-2026-31692}
  - crypto: af_alg - limit RX SG extraction by receive buffer budget {CVE-2026-31677}
  - APEI/GHES: ensure that won't go past CPER allocated record {CVE-2026-43277}
  - ceph: supply snapshot context in ceph_zero_partial_object() {CVE-2026-43273}
  - team: avoid NETDEV_CHANGEMTU event when unregistering slave {CVE-2026-43234}
  - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() {CVE-2025-71297}
  - EFI/CPER: don't go past the ARM processor CPER record buffer {CVE-2026-43266}
  - net: bridge: switchdev: Skip MDB replays of deferred events on offload {CVE-2024-26837}
  - can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
  - ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
  - netem: fix return value if duplicate enqueue fails {CVE-2024-45016}
  - USB: serial: mos7840: fix crash on resume {CVE-2024-42244}
  - crypto: null - Use spin lock instead of mutex {CVE-2025-37808}
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
  - bpf: Fix overrunning reservations in ringbuf {CVE-2024-41009}
  - bpf: Fix bpf_sk_select_reuseport() memory leak {CVE-2025-21683}
  - drm/i915: Fix request ref counting during error capture & debugfs dump {CVE-2023-52981}
  - netfilter: conntrack: fix wrong ct->timeout value {CVE-2023-53635}
  - drop_monitor: replace spin_lock by raw_spin_lock {CVE-2024-40980}
  - net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too {CVE-2024-50058}
  - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. {CVE-2026-31551}
  - ipv6: Fix signed integer overflow in __ip6_append_data {CVE-2022-49728}
  - selinux: avoid dereference of garbage after mount failure {CVE-2024-35904}
  - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name {CVE-2024-49934}
  - tracing: Do not let histogram values have some modifiers {CVE-2023-53093}
  - ice: Add netif_device_attach/detach into PF reset flow {CVE-2024-46770}
  - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. {CVE-2025-37884}
  - fbmon: prevent division by zero in fb_videomode_from_videomode() {CVE-2024-35922}
  - drm/amdgpu: Fix the null pointer dereference to ras_manager {CVE-2024-43908}
  - tracing: Ensure visibility when inserting an element into tracing_map {CVE-2024-26645}
  - drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func {CVE-2024-47720}
  - phy: mdio: fix memory leak {CVE-2021-47416}
  - ipv4: Fix reference count leak when using error routes with nexthop objects {CVE-2025-71097}
  - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() {CVE-2024-50046}
  - packet: annotate data-races around ignore_outgoing {CVE-2024-26862}
  - md: fix resync softlockup when bitmap size is less than array size {CVE-2024-38598}
  - wireguard: receive: annotate data-race around receiving_counter.counter {CVE-2024-26861}
  - netfs: Only call folio_start_fscache() one time for each folio {CVE-2023-52582}
  - usb: xhci: tegra: fix sleep in atomic call {CVE-2023-53475}
  - ACPI: PAD: fix crash in exit_round_robin() {CVE-2024-49935}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-43499}
  - rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
  - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() {CVE-2024-50256}
  - Bluetooth: ISO: Fix multiple init when debugfs is disabled {CVE-2024-50077}
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio {CVE-2025-21931}
  - RDMA/core: Silence oversized kvmalloc() warning {CVE-2025-37867}
  - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() {CVE-2024-26663}
  - net: let net.core.dev_weight always be non-zero {CVE-2025-21806}
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release() {CVE-2022-48961}
  - eth: alx: take rtnl_lock on resume {CVE-2022-50498}
  - ata: libata-transport: fix error handling in ata_tlink_add() {CVE-2022-49824}
  - ata: libata-transport: fix error handling in ata_tport_add() {CVE-2022-49825}
  - netfilter: br_netfilter: fix panic with metadata_dst skb {CVE-2024-50045}
  - net: fix NULL pointer in skb_segment_list {CVE-2023-52991}
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove {CVE-2024-26698}
  - scsi: qla2xxx: validate nvme_local_port correctly {CVE-2024-42286}
  - rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale {CVE-2023-53291}
  - wifi: mac80211: Discard Beacon frames to non-broadcast address {CVE-2025-71127}
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() {CVE-2024-46755}
  - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640}
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes {CVE-2024-41089}
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING {CVE-2023-52845}
  - bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets {CVE-2023-52523}
  - Bluetooth: Fix not cleanup led when bt_init fails {CVE-2022-48971}
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range {CVE-2024-26851}
  - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() {CVE-2024-53680}
  - ppp_async: limit MRU to 64K {CVE-2024-26675}
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages {CVE-2024-40904}
  - ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work {CVE-2024-26631}
  - xfrm: fix one more kernel-infoleak in algo dumping {CVE-2024-50110}
  - xdp: fix invalid wait context of page_pool_destroy() {CVE-2024-43834}
  - fs/netfs/fscache_cookie: add missing "n_accesses" check {CVE-2024-45000}
  - mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
  - usbnet: gl620a: fix endpoint checking in genelink_bind() {CVE-2025-21877}
  - IB/core: Fix ib_cache_setup_one error flow cleanup {CVE-2024-47693}
  - can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate {CVE-2021-4454}
  - vfs: fix race between evice_inodes() and find_inode()&iput() {CVE-2024-47679}
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts {CVE-2023-53245}
  - iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
  - cachefiles: fix memory leak in cachefiles_add_cache() {CVE-2024-26840}
  - ext4: fix access to uninitialised lock in fc replay path {CVE-2024-50014}
  - net: hns3: fix kernel crash when 1588 is sent on HIP08 devices {CVE-2025-21649}
  - ftrace: Fix regression with module command in stack_trace_filter {CVE-2024-56569}
  - ipv6: sr: fix invalid unregister error path {CVE-2024-38612}
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
  - netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els9]
changelog:
  - xfs: resample the data fork mapping after cycling ILOCK
  - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
  - mpls: Use in6_dev_rcu() and dev_net_rcu() in mpls_forward() and mpls_xmit().
  - net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()
  - ipv4: start using dst_dev_rcu()
  - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
  - tcp_metrics: use dst_dev_net_rcu() {CVE-2025-40075}
  - net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
  - udp6: Fix race condition in udp6_sendmsg & connect
  - ipv6: use RCU in ip6_output() {CVE-2025-40158}
  - ipv6: use RCU in ip6_xmit() {CVE-2025-40135}
  - ipv6: start using dst_dev_rcu()
  - net: dst: introduce dst->dev_rcu
  - neighbour: accept plain RCU readers in ___neigh_lookup_noref() {CVE-2025-40158}
  - net: Add locking to protect skb->dev access in ip_output
  - ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers
  - ipv6: adopt dst_dev() helper
  - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
  - net: dst: add four helpers to annotate data-races around dst->dev
  - tcp: convert to dev_net_rcu()
  - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els5]
changelog:
  - af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
  - netfilter: nft_limit: reject configurations that cause integer overflow {CVE-2024-26668}
  - libbpf: Fix use-after-free in btf_dump_name_dups {CVE-2022-3534}
  - bpf: Fix partial dynptr stack slot reads/writes {CVE-2023-39191}
  - ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
  - ima: define ima_max_digest_data struct without a flexible array variable
  - ima: detect changes to the backing overlay file
  - tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command {CVE-2023-6546}
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
  - netfilter: tproxy: bail out if IP has been disabled on the device {CVE-2024-36270}
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). {CVE-2024-36904}
  - Bluetooth: Fix double free in hci_conn_cleanup {CVE-2023-28464}
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super {CVE-2024-0841}
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() {CVE-2024-26852}
  - tipc: fix UAF in error path {CVE-2024-36886}
  - Bluetooth: af_bluetooth: Fix deadlock {CVE-2024-26886}
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly {CVE-2024-39277}
  - net/mlx5e: Prevent deadlock while disabling aRFS {CVE-2024-27014}
  - net/mlx5e: Introduce flow steering API {CVE-2024-27014}
  - x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
  - x86: Introduce ia32_enabled() {CVE-2024-25742}
  - x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
  - x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
  - RDMA/srpt: Support specifying the srpt_service_guid parameter {CVE-2024-26744}
  - platform/x86: think-lmi: Fix reference leak {CVE-2023-52520}
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command {CVE-2024-27059}
  - fat: fix uninitialized field in nostale filehandles {CVE-2024-26973}
  - usb: xhci: Add error handling in xhci_map_urb_for_dma {CVE-2024-26964}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete {CVE-2024-26897}
  - wifi: mac80211: fix race condition on enabling fast-xmit {CVE-2024-26779}
  - RDMA/qedr: Fix qedr_create_user_qp error flow {CVE-2024-26743}
  - wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer {CVE-2024-26603}
  - wifi: rt2x00: restart beacon queue when hardware reset {CVE-2023-52595}
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg {CVE-2023-52528}
  - RDMA/siw: Fix connection failure handling {CVE-2023-52513}
  - usb: hub: Guard against accesses to uninitialized BOS descriptors {CVE-2023-52477}
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc {CVE-2021-47185}
  - sctp: fail if no bound addresses can be used for a given scope {CVE-2023-1074}
  - memcg: enable accounting for file lock caches {CVE-2022-0480}
  - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
  - RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872}
  - drm/amd/display: Atom Integrated System Info v2_2 for DCN35 {CVE-2024-36897}
  - net/mlx5e: fix a potential double-free in fs_any_create_groups {CVE-2023-52667}
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() {CVE-2024-36902}
  - ipv6: prevent NULL dereference in ip6_output() {CVE-2024-36901}
  - vt: fix memory overlapping when deleting chars in the buffer {CVE-2022-48627}
  - hwmon: (coretemp) Fix out-of-bounds memory access {CVE-2024-26664}
  - i2c: Fix a potential use after free {CVE-2019-25162}
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump {CVE-2024-26615}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els6]
changelog:
  - tun: add missing verification for short frame {CVE-2024-41091}
  - tap: add missing verification for short frame {CVE-2024-41090}
  - drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552}
  - net: fix __dst_negative_advice() race {CVE-2024-36971}
  - net: annotate data-races around sk->sk_dst_pending_confirm {CVE-2024-36971}
  - net: fix out-of-bounds access in ops_init {CVE-2024-36883}
  - net/sched: flower: Fix chain template offload {CVE-2024-26669}
  - netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397}
  - netfilter: nft_set_rbtree: Remove unused variable nft_net {CVE-2024-27397}
  - netfilter: nft_set_rbtree: prefer sync gc to async worker {CVE-2024-27397}
  - netfilter: nft_set_rbtree: rename gc deactivate+erase function {CVE-2024-27397}
  - netfilter: nf_tables: de-constify set commit ops function argument {CVE-2024-27397}
  - netfilter: nft_set_rbtree: .deactivate fails if element has expired {CVE-2024-27397}
  - sched/membarrier: reduce the ability to hammer on sys_membarrier {CVE-2024-26602}
  - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts {CVE-2022-38096}
  - sched/psi: Fix use-after-free in ep_remove_wait_queue() {CVE-2023-52707}
  - wait: add wake_up_pollfree() {CVE-2023-52707}
  - x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
  - x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
  - x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). {CVE-2024-37356}
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued {CVE-2024-38384}
  - netfilter: complete validation of user input {CVE-2024-35962}
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop] {CVE-2023-52635}
  - netfilter: validate user input for expected length {CVE-2024-35896}
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails {CVE-2024-37353}
  - bnxt: prevent skb UAF after handing over to PTP worker {CVE-2022-48637}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 {CVE-2024-38558}
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs {CVE-2024-36929}
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation {CVE-2024-36017}
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound {CVE-2024-33621}
  - drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
  - gro: fix ownership transfer {CVE-2024-35890}
  - mlxbf_gige: stop interface during shutdown {CVE-2024-35885}
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() {CVE-2023-52809}
  - wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225}
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
  - scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161}
  - drm/amdgpu/mes: fix use-after-free issue {CVE-2024-38581}
  - i40e: fix vf may be used uninitialized in this function warning {CVE-2024-36020}
  - vt: fix unicode buffer corruption when deleting characters {CVE-2024-35823}
  - ata: libata-core: Fix double free on error {CVE-2024-41087}
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path {CVE-2024-26925}
  - tcp_metrics: validate source addr length {CVE-2024-42154}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els7]
changelog:
  - tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
  - dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
  - scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
  - ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
  - block/ioctl: prefer different overflow check {CVE-2024-41000}
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." {CVE-2024-40984}
  - net/sched: Fix UAF when resolving a clash {CVE-2024-41040}
  - nvme: avoid double free special payload {CVE-2024-41073}
  - x86/tdx: Allow 32-bit emulation by default {CVE-2024-25744}
  - x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
  - x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
  - x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
  - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
  - x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
  - x86/entry: Compile entry_SYSCALL32_ignore() unconditionally {CVE-2024-25744}
  - x86/entry: Rename ignore_sysret() {CVE-2024-25744}
  - x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
  - x86: Introduce ia32_enabled() {CVE-2024-25742}
  - x86: Fix misspelled Kconfig symbols {CVE-2024-25744}
  - x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
  - objtool: Add entry UNRET validation {CVE-2024-25744}
  - x86/cpu: Switch to arch_cpu_finalize_init() {CVE-2022-40982}
  - init: Provide arch_cpu_finalize_init() {CVE-2022-40982}
  - gfs2: Fix potential glock use-after-free on unmount {CVE-2024-38570}
  - gfs2: Rename sd_{ glock => kill }_wait {CVE-2024-38570}
  - gfs2: Remove ill-placed consistency check {CVE-2024-38570}
  - gfs2: simplify gdlm_put_lock with out_free label {CVE-2024-38570}
  - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list {CVE-2024-40956}
  - drm/amdgpu: add error handle to avoid out-of-bounds {CVE-2024-39471}
  - net/mlx5: Discard command completions in internal error {CVE-2024-38555}
  - net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-52628}
  - perf/core: Fix potential NULL deref {CVE-2023-5717}
  - perf: Disallow mis-matched inherited group reads {CVE-2023-5717}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els8]
changelog:
  - drm/amd/pm: Fix negative array index read {CVE-2024-46821}
  - drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
  - drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
  - drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box {CVE-2024-46811}
  - Squashfs: sanity check symbolic link size {CVE-2024-46744}
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859}
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() {CVE-2024-40995}
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc {CVE-2024-40995}
  - netfilter: bridge: confirm multicast packets before passing them up the stack {CVE-2024-27415}
  - netfilter: let reset rules clean out conntrack entries {CVE-2024-27415}
  - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray {CVE-2024-42243}
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify {CVE-2024-36899}
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem {CVE-2024-35895}
  - bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t {CVE-2024-35895}
  - mm/huge_memory: don't unpoison huge_zero_folio {CVE-2024-40914}
  - cxgb4: fix use after free bugs caused by circular dependency problem {CVE-2023-4133}
  - timers: Restore ABI Compatibility with timer_delete Functions {CVE-2023-4133}
  - timers: Provide timer_shutdown[_sync]() {CVE-2023-4133}
  - timers: Add shutdown mechanism to the internal functions {CVE-2023-4133}
  - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode {CVE-2023-4133}
  - timers: Silently ignore timers with a NULL function {CVE-2023-4133}
  - timers: Rename del_timer() to timer_delete() {CVE-2023-4133}
  - timers: Rename del_timer_sync() to timer_delete_sync() {CVE-2023-4133}
  - timers: Use del_timer_sync() even on UP {CVE-2023-4133}
  - timers: Update kernel-doc for various functions {CVE-2023-4133}
  - timers: Replace BUG_ON()s {CVE-2023-4133}
  - timers: Get rid of del_singleshot_timer_sync() {CVE-2023-4133}
  - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
  - mm: avoid overflows in dirty throttling logic {CVE-2024-42131}
  - ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
  - igc: avoid returning frame twice in XDP_REDIRECT {CVE-2024-26853}
  - igc: Avoid transmit queue timeout for XDP {CVE-2024-26853}
  - nfsd: fix RELEASE_LOCKOWNER {CVE-2024-26629}
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc {CVE-2023-52880}
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment {CVE-2024-42152}
  - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() {CVE-2024-42110}
  - x86: stop playing stack games in profile_pc() {CVE-2024-42096}
  - xdp: Remove WARN() from __xdp_reg_mem_model() {CVE-2024-42082}
  - NFSv4: Fix memory leak in nfs4_set_security_label {CVE-2024-41076}
  - ppp: reject claimed-as-LCP but actually malformed packets {CVE-2024-41044}
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). {CVE-2024-41041}
  - sched/deadline: Fix task_struct reference leak {CVE-2024-41023}
  - tipc: force a dst refcount before doing decryption {CVE-2024-40983}
  - scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
  - xhci: Handle TD clearing for multiple streams case {CVE-2024-40927}
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
  - ipv6: fix possible race in __fib6_drop_pcpu_from() {CVE-2024-40905}
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING {CVE-2024-39476}
  - usb-storage: alauda: Check whether the media is initialized {CVE-2024-38619}
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() {CVE-2024-38619}
  - crypto: bcm - Fix pointer arithmetic {CVE-2024-38579}
  - scsi: qedf: Ensure the copied buf is NUL terminated {CVE-2024-38559}
  - wifi: nl80211: don't free NULL coalescing rule {CVE-2024-36941}
  - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() {CVE-2024-36025}
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() {CVE-2024-35898}
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work {CVE-2024-35852}
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination {CVE-2024-35845}
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791}
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes {CVE-2024-35789}
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work {CVE-2024-27052}
  - nfp: flower: handle acti_netdevs allocation failure {CVE-2024-27046}
  - octeontx2-af: Use separate handlers for interrupts {CVE-2024-27030}
  - netfilter: flowtable: validate pppoe header {CVE-2024-27016}
  - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address {CVE-2024-26946}
  - scsi: qla2xxx: Fix command flush on cable pull {CVE-2024-26931}
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() {CVE-2024-26855}
  - bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel {CVE-2024-26737}
  - Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself {CVE-2023-52735}
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() {CVE-2023-52651}
  - net: tap_open(): set sk_uid from current_fsuid() {CVE-2023-4194}
  - net: tun_chr_open(): set sk_uid from current_fsuid() {CVE-2023-4194}
  - seg6: fix the iif in the IPv6 socket control block {CVE-2021-47515}
  - tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds {CVE-2024-42148}
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes {CVE-2024-46759}
  - net: bridge: mst: fix vlan use-after-free {CVE-2024-36979}
  - stm class: Fix a double free in stm_register_device() {CVE-2024-38627}
  - wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk {CVE-2024-46743}
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup {CVE-2024-46747}
  - drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
  - drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
  - wifi: nl80211: Avoid address calculations via out of bounds array indexing {CVE-2024-38562}
  - wifi: nl80211: convert cfg80211_scan_request allocation to *_size macros {CVE-2024-38562}
  - overflow: Implement size_t saturating arithmetic helpers {CVE-2024-38562}
  - cdrom: rearrange last_media_change check to avoid unintentional overflow {CVE-2024-42136}
  - ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() {CVE-2024-38588}
  - drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
  - sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
  - firmware: cs_dsp: Fix overflow checking of wmfw header {CVE-2024-41039}
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes {CVE-2024-46758}
  - HID: amd_sfh: free driver_data after destroying hid device {CVE-2024-46746}
  - xfs: don't walk off the end of a directory data block {CVE-2024-41013}
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes {CVE-2024-46756}
  - tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes {CVE-2024-46757}
  - drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}
  - drm/amdgpu/mes: fix mes ring buffer overflow {CVE-2024-46700}
  - exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
  - PCI/MSI: Fix UAF in msi_capability_init {CVE-2024-41096}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els9]
changelog:
  - smb: client: fix use-after-free in smb2_query_info_compound() {CVE-2023-52751}
  - smb: client: prevent new fids from being removed by laundromat {CVE-2023-52751}
  - cifs: fix dentry lookups in directory handle cache {CVE-2023-52751}
  - cifs: return a single-use cfid if we did not get a lease {CVE-2023-52751}
  - cifs: Check the lease context if we actually got a lease {CVE-2023-52751}
  - cifs: set rc to -ENOENT if we can not get a dentry for the cached dir {CVE-2023-52751}
  - cifs: use LIST_HEAD() and list_move() to simplify code {CVE-2023-52751}
  - cifs: fix wrong unlock before return from cifs_tree_connect() {CVE-2023-52751}
  - uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}
  - net: do not delay dst_entries_add() in dst_release() {CVE-2024-50036}
  - smb: client: fix UAF in async decryption {CVE-2024-50047}
  - smb3: rename encryption/decryption TFMs
  - mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
  - driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
  - drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
  - ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
  - Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
  - mptcp: pm: Fix uaf in __timer_delete_sync {CVE-2024-46858}
  - of: fdt: fix off-by-one error in unflatten_dt_nodes() {CVE-2022-48672}
  - filelock: fix potential use-after-free in posix_lock_inode {CVE-2024-41049}
  - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock {CVE-2024-41049}
  - drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
  - ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
  - slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
  - ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
  - ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
  - ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
  - tipc: guard against string buffer overrun {CVE-2024-49995}
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
  - firmware_loader: Block path traversal {CVE-2024-47742}
  - ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
  - ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
  - drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
  - ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
  - wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
  - net: do not leave a dangling sk pointer, when socket creation fails {CVE-2024-40954}
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune() {CVE-2024-36978}
  - drm/amdgpu: Validate TA binary size {CVE-2024-44977}


author: Vadim Panov <vadim.panov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els10]
changelog:
  - smb: client: fix use-after-free of signing key {CVE-2024-53179}
  - smb: client: stop flooding dmesg in smb2_calc_signature() {CVE-2024-53179}
  - smb3: fix oops in calculating shash_setkey {CVE-2024-53179}
  - cifs: return correct error in ->calc_signature() {CVE-2024-53179}
  - cifs: secmech: use shash_desc directly, remove sdesc {CVE-2024-53179}
  - cifs: replace kfree() with kfree_sensitive() for sensitive data {CVE-2024-53179}
  - xsk: fix OOB map writes when deleting elements {CVE-2024-56614}
  - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}
  - scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631}
  - EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708}
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl {CVE-2024-56662}
  - net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601}
  - initramfs: avoid filename buffer overrun {CVE-2024-53142}
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
  - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
  - Bluetooth: msft: fix slab-use-after-free in msft_do_close() {CVE-2024-36012}
  - Bluetooth: Fix support for Read Local Supported Codecs V2 {CVE-2024-36012}
  - Bluetooth: hci_codec: Fix leaking content of local_codecs {CVE-2024-36012}
  - blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
  - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602}
  - net: inet6: do not leave a dangling sk pointer in inet6_create() {CVE-2024-56600}
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
  - net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 {CVE-2023-52818}
  - bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
  - ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
  - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' {CVE-2024-56608}
  - netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
  - HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit {CVE-2023-52519}
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer(). {CVE-2024-56642}
  - cifs: Fix buffer overflow when parsing NFS reparse points {CVE-2024-49996}
  - Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
  - PM / devfreq: Fix buffer overflow in trans_stat_show {CVE-2023-52614}
  - PM / devfreq: Rework freq_table to be local to devfreq struct {CVE-2023-52614}
  - cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() {CVE-2024-41057}
  - cachefiles: fix slab-use-after-free in fscache_withdraw_volume() {CVE-2024-41058}
  - netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() {CVE-2024-41058}
  - memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
  - Bluetooth: ISO: Fix UAF on iso_sock_timeout {CVE-2024-50124}
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125}
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout {CVE-2024-50125}
  - Bluetooth: Consolidate code around sk_alloc into a helper function {CVE-2024-50125}
  - smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() {CVE-2024-35861}
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() {CVE-2024-26754}
  - smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868}
  - smb: client: fix potential UAF in cifs_debug_files_proc_show() {CVE-2024-35868}
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
  - wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
  - x86/alternatives: Disable KASAN in apply_alternatives() {CVE-2023-52504}
  - bpf: Fix out-of-bounds write in trie_get_next_key() {CVE-2024-50262}
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
  - media: edia: dvbdev: fix a use-after-free {CVE-2024-27043}
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2024-27043}
  - media: dvbdev: fix build warning due to comments {CVE-2024-27043}
  - media: dvbdev: adopts refcnt to avoid UAF {CVE-2024-27043}


author: Vadim Panov <vadim.panov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els11]
changelog:
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format {CVE-2024-53104}
  - ALSA: 6fire: Release resources at card release {CVE-2024-53239}
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches {CVE-2024-26885}
  - bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' {CVE-2024-27045}
  - af_packet: avoid erroring out after sock_init_data() in packet_create() {CVE-2024-56606}
  - cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
  - arm64: hibernate: Fix level3 translation fault in swsusp_save() {CVE-2024-26989}
  - perf: hisi: Fix use-after-free when register pmu fails {CVE-2023-52859}
  - nbd: fix uaf in nbd_open {CVE-2023-52837}
  - ring-buffer: Do not attempt to read past "commit" {CVE-2023-52501}
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) {CVE-2023-52637}
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
  - asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
  - pinctrl: core: delete incorrect free in pinctrl_enable() {CVE-2024-36940}
  - irqchip/gic-v3-its: Prevent double free on error {CVE-2024-35847}
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit {CVE-2024-27395}
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
  - nfs: fix UAF in direct writes {CVE-2024-26958}
  - of: Fix double free in of_parse_phandle_with_args_map {CVE-2023-52679}
  - ext4: fix double-free of blocks due to wrong extents moved_len {CVE-2024-26704}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update {CVE-2024-35855}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els12]
changelog:
  - spec: update shim Conflicts, Provides keys
  - HID: core: zero-initialize the report buffer {CVE-2024-50302}
  - net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
  - bus: mhi: host: Add alignment check for event ring read pointer {CVE-2023-52494}
  - net: sched: fix ets qdisc OOB Indexing {CVE-2025-21692}
  - parport: Proper fix for array out-of-bounds access {CVE-2024-50074}
  - udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
  - security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
  - usb: typec: altmode should keep reference to parent {CVE-2024-50150}
  - dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
  - dm cache: optimize dirty bit checking with find_next_bit when resizing {CVE-2024-50278}
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50279}
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug {CVE-2024-46853}
  - smb: client: fix OOBs when building SMB2_IOCTL request {CVE-2024-50151}
  - net: sched: fix use-after-free in taprio_change() {CVE-2024-50127}
  - USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
  - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() {CVE-2024-53059}
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed {CVE-2024-53059}
  - tracing: Consider the NULL character when validating the event length {CVE-2024-50131}
  - crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
  - NFSD: fix hang in nfsd4_shutdown_callback {CVE-2025-21795}
  - NFSD: add courteous server support for thread with only delegation {CVE-2025-21795}
  - efi: rt-wrapper: Add missing include {CVE-2023-21102}
  - arm64: efi: Execute runtime services from a dedicated stack {CVE-2023-21102}
  - mptcp: refactor passive socket initialization {CVE-2024-26782}
  - mptcp: implement delayed seq generation for passive fastopen {CVE-2024-26782}
  - smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864}
  - smb: client: fix potential UAF in cifs_dump_full_key() {CVE-2024-35866}
  - cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2024-35866}
  - smb: client: fix potential UAF in smb2_is_network_name_deleted() {CVE-2024-35862}
  - smb: client: fix potential UAF in is_valid_oplock_break() {CVE-2024-35863}
  - smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
  - bpf: Protect against int overflow for stack access size {CVE-2024-35905}
  - bpf: Fix verification of indirect var-off stack access {CVE-2024-35905}
  - devlink: fix possible use-after-free and memory leaks in devlink_init() {CVE-2024-26734}
  - leds: trigger: Unregister sysfs attributes before calling deactivate() {CVE-2024-43830}
  - ionic: fix use after netif_napi_del() {CVE-2024-39502}
  - ionic: clean interrupt before enabling queue to avoid credit race {CVE-2024-39502}
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink {CVE-2024-44970}
  - vt_ioctl: fix array_index_nospec in vt_setactivate {CVE-2022-48804}
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() {CVE-2022-49011}
  - raid1: fix use-after-free for original bio in raid1_write_request() {CVE-2024-35979}
  - md/raid1: free the r1bio before waiting for blocked rdev {CVE-2024-35979}
  - drm/amdgpu: fix usage slab after free {CVE-2024-56551}
  - drm/amd: Use `amdgpu_ucode_*` helpers for GPU info bin {CVE-2024-56551}
  - drm/amd: Add a new helper for loading/validating microcode {CVE-2024-56551}
  - drm/amd: check num of link levels when update pcie param {CVE-2023-52812}
  - drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments {CVE-2023-52812}
  - drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported {CVE-2023-52812}
  - drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters() {CVE-2023-52812}
  - drm/amd: Use amdgpu_device_pcie_dynamic_switching_supported() for SMU7 {CVE-2023-52812}
  - drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with SMU13 {CVE-2023-52812}
  - drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs {CVE-2023-52812}
  - drm/amd: Move helper for dynamic speed switch check out of smu13 {CVE-2023-52812}
  - drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13 {CVE-2023-52812}
  - drm/amd/pm: share the code around SMU13 pcie parameters update {CVE-2023-52812}
  - drm: zynqmp_kms: Unplug DRM device before removal {CVE-2024-56538}
  - padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
  - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt {CVE-2023-52854}
  - drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() {CVE-2024-57798}
  - drm/dp_mst: Skip CSN if topology probing is not done yet {CVE-2024-57798}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els13]
changelog:
  - ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
  - wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
  - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' {CVE-2024-27042}
  - dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763}
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
  - cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
  - veth: Fix use after free in XDP_REDIRECT {CVE-2023-53107}
  - firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() {CVE-2024-53068}
  - arm64/sve: Discard stale CPU state when handling SVE traps {CVE-2024-50275}
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd {CVE-2025-21969}
  - wifi: mt76: mt7921e: fix use-after-free in free_irq() {CVE-2024-26892}
  - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read {CVE-2024-58069}
  - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() {CVE-2025-21927}
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
  - net_sched: sch_fifo: implement lockless __fifo_dump() {CVE-2025-21702}
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() {CVE-2025-21993}
  - vlan: enforce underlying device type {CVE-2025-21920}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
  - watch_queue: Actually free the watch {CVE-2022-49256}
  - can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
  - netfilter: nf_set_pipapo: fix initial map fill {CVE-2024-57947}
  - hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations {CVE-2021-47098}
  - aio: fix use-after-free due to missing POLLFREE handling {CVE-2021-47505}
  - aio: keep poll requests on waitqueue until completed {CVE-2021-47505}
  - smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
  - cifs: remove useless DeleteMidQEntry() {CVE-2023-52757}
  - media: uvcvideo: Remove dangling pointers {CVE-2024-58002}
  - media: uvcvideo: Only save async fh if success {CVE-2024-58002}
  - media: uvcvideo: Refactor iterators {CVE-2024-58002}
  - drm: nv04: Fix out of bounds access {CVE-2024-27008}
  - drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array {CVE-2025-21785}
  - net: rose: fix timer races against user threads {CVE-2025-21718}
  - media: uvcvideo: Fix double free in error path {CVE-2024-57980}
  - vrf: use RCU protection in l3mdev_l3_out() {CVE-2025-21791}
  - geneve: Fix use-after-free in geneve_find_dev(). {CVE-2025-21858}
  - afs: Increase buffer size in afs_update_volume_status() {CVE-2024-26736}
  - net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
  - bpf: Check validity of link->type in bpf_link_show_fdinfo() {CVE-2024-53099}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els14]
changelog:
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow {CVE-2024-38577}
  - tcp: fix mptcp DSS corruption due to large pmtu xmit {CVE-2024-50083}
  - vsock: Keep the binding until socket destruction {CVE-2025-21756}
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove {CVE-2025-22020}
  - drm/i915: Fix potential bit_17 double-free {CVE-2023-52930}
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition {CVE-2025-22056}
  - mm: shmem: fix data-race in shmem_getattr() {CVE-2024-46828}
  - nvmet-auth: assign dh_key to NULL after kfree_sensitive {CVE-2024-50215}
  - net: explicitly clear the sk pointer, when pf->create fails {CVE-2024-50186}
  - net: wwan: fix global oob in wwan_rtnl_policy {CVE-2024-50128}
  - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free {CVE-2024-49983}
  - vhost_vdpa: assign irq bypass producer token correctly {CVE-2024-47748}
  - wifi: rtw88: always wait for both firmware loading attempts {CVE-2024-47718}
  - sched: sch_cake: fix bulk flow accounting logic for host fairness {CVE-2024-46828}
  - fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF {CVE-2024-46786}
  - net: bridge: mcast: wait for previous gc cycles when removing port {CVE-2024-44934}
  - vhost/vsock: always initialize seqpacket_allow {CVE-2024-43873}
  - ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
  - nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
  - SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
  - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync {CVE-2024-53208}
  - wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one {CVE-2024-56663}
  - Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
  - tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
  - net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els15]
changelog:
  - udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
  - bpf: Prevent tail call between progs attached to different hooks {CVE-2024-50063}
  - nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043}
  - nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682}
  - nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
  - nfsd: split sc_status out of sc_type {CVE-2024-46682}
  - net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
  - net: fix geneve_opt length integer overflow {CVE-2025-22055}
  - net: usb: lan78xx: Fix double free issue with interrupt buffer allocation {CVE-2024-53213}
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
  - xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els16]
changelog:
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
  - net: atm: fix use after free in lec_send() {CVE-2025-22004}
  - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up {CVE-2025-21887}
  - rcutorture: Fix ksoftirqd boosting timing and iteration {CVE-2022-50177}
  - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() {CVE-2022-49940}
  - selinux: Add boundary check in put_entry() {CVE-2022-50200}
  - Squashfs: fix handling and sanity checking of xattr_ids count {CVE-2023-52933}
  - net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
  - ext4: ignore xattrs past end {CVE-2025-37738}
  - ext4: fix off-by-one error in do_split {CVE-2025-23150}
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list {CVE-2025-21919}
  - md: fix mddev uaf while iterating all_mddevs list {CVE-2025-22126}
  - ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
  - md: factor out a helper from mddev_put()
  - Fix "Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd"
  - ext4: prevent stale extent cache entries caused by concurrent get es_cache


author: Vadim Panov <vadim.panov@yahoo.com> [5.14.0-284.1101.el9_2.tuxcare.7.els17]
changelog:
  - net_sched: hfsc: Fix a UAF vulnerability in class handling {CVE-2025-37797}
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error {CVE-2025-38089}
  - net: ch9200: fix uninitialised access during mii_nway_restart {CVE-2025-38086}
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121}
  - locking/csd_lock: Change csdlock_debug from early_param to __setup {CVE-2022-50091}
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes {CVE-2025-21991}
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead {CVE-2022-49977}
  - NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072}
  - NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-49316}
  - mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els18]
changelog:
  - tls: always refresh the queue when reading sock {CVE-2025-38471}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
  - i2c/designware: Fix an initialization issue {CVE-2025-38380}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
  - mm/khugepaged: fix GUP-fast interaction by sending IPI
  - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() {CVE-2025-21867}
  - crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
  - ext4: avoid journaling sb update on error if journal is destroying {CVE-2025-22113}
  - ext4: define ext4_journal_destroy wrapper
  - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
  - Bluetooth: Remove BT_HS {CVE-2024-38620}
  - block, bfq: fix bfqq uaf in bfq_limit_depth() {CVE-2024-53166}
  - dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763}
  - bpf: Fix helper writes to read-only maps (alt version) {CVE-2024-49861}
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
  - netfilter: xtables: avoid NFPROTO_UNSPEC where needed {CVE-2024-50038}
  - xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
  - net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
  - net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
  - padata: fix UAF in padata_reorder {CVE-2025-21727}
  - RDMA/mlx5: Fix page_size variable overflow {CVE-2025-22091}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els19]
changelog:
  - mm/hugetlb: unshare page tables during VMA split, not before {CVE-2025-38084}
  - hugetlb: unshare some PMDs when splitting VMAs {CVE-2025-38084}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
  - tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
  - vsock: Fix transport_* TOCTOU {CVE-2025-38461}
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
  - net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-37914}
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
  - udp: Fix memory accounting leak. {CVE-2025-22058}
  - net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
  - sch_htb: make htb_deactivate() idempotent {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
  - sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
  - sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
  - sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
  - sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
  - net: fix udp gso skb_segment after pull from frag_list {CVE-2025-38124}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els20]
changelog:
  - drm/amd/amdgpu: introduce gc_*_mes_2.bin v2
  - proc: fix a dentry lock race between release_task and lookup
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
  - scsi: aacraid: Remove useless code
  - scsi: aacraid: Remove unused aac_check_health()
  - scsi: aacraid: struct {user,}sgmap{,64,raw}: Replace 1-element arrays with flexible arrays
  - scsi: aacraid: Rearrange order of struct aac_srb_unit
  - scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array with flexible array
  - scsi: aacraid: union aac_init: Replace 1-element array with flexible array
  - scsi: aacraid: aachba: Replace snprintf() with the safer scnprintf() variant
  - Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity"
  - scsi: aacraid: Avoid -Warray-bounds warning
  - scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity
  - scsi: aacraid: Replace all non-returning strlcpy with strscpy
  - scsi: aacraid: Declare SCSI host template const
  - scsi: aacraid: Drop redundant pci_enable_pcie_error_reporting()
  - scsi: aacraid: Allocate cmd_priv with scsicmd
  - scsi: aacraid: Remove redundant "the"
  - scsi: aacraid: Fix undefined behavior due to shift overflowing the constant
  - scsi: aacraid: Clean up some inconsistent indenting
  - scsi: aacraid: Move the SCSI pointer to private command data
  - scsi: aacraid: Fix spelling of "its"
  - scsi: aacraid: Call scsi_done() directly
  - scsi: aacraid: Introduce aac_scsi_done()
  - scsi: aacraid: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
  - scsi: aacraid: Remove an unused include
  - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler {CVE-2024-25743}
  - net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() {CVE-2025-38550}
  - scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
  - PM: hibernate: defer device probing when resuming from hibernation {CVE-2022-50202}
  - net: fix UaF in netns ops registration error path {CVE-2023-52999}
  - net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed {CVE-2023-52999}
  - usb: typec: fix potential array underflow in ucsi_ccg_sync_control() {CVE-2024-53203}
  - soundwire: cadence: fix invalid PDI offset {CVE-2024-38635}
  - drm/i915/vma: Fix UAF on destroy against retire race {CVE-2024-26939}
  - netns: Make get_net_ns() handle zero refcount net {CVE-2024-40958}
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487}
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
  - wifi: ath11k: fix gtk offload status event locking {CVE-2023-52777}
  - wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
  - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() {CVE-2022-48632}
  - net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739}
  - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv {CVE-2021-47459}
  - net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg {CVE-2021-47596}
  - Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
  - crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
  - crypto: qat - fix double free during reset
  - media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
  - fs/smb/client: Reset password pointer to NULL {CVE-2023-5345}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els21]
changelog:
  - mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
  - mm: fix zswap writeback race condition {CVE-2023-53178}
  - dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
  - drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
  - gpio: davinci: Validate the obtained number of IRQs {CVE-2024-42092}
  - ASoC: topology: Fix references to freed memory {CVE-2024-41069}
  - Bluetooth: hci_sock: Fix not validating setsockopt user input {CVE-2024-35963}
  - Bluetooth: ISO: Fix not validating setsockopt user input {CVE-2024-35964}
  - Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
  - Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
  - dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939}
  - wifi: mwifiex: avoid possible NULL skb pointer dereference {CVE-2023-53384}
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380}
  - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
  - thermal: core: prevent potential string overflow {CVE-2023-52868}
  - drm/amdkfd: Fix shift out-of-bounds issue {CVE-2023-52816}
  - drm/vkms: Fix null-ptr-deref in vkms_release() {CVE-2022-50369}
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
  - net/mlx5: Fix tainted pointer delete is case of flow rules creation fail {CVE-2024-40940}
  - ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
  - platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
  - platform/x86: wmi: remove unnecessary initializations
  - perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
  - do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
  - usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
  - vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
  - igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
  - kobject_uevent: Fix OOB access within zap_modalias_env() {CVE-2024-42292}
  - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() {CVE-2023-53401}
  - net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
  - drm/radeon: possible buffer overflow {CVE-2023-52867}
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
  - wifi: mac80211_hwsim: Fix possible NULL dereference {CVE-2023-53209}
  - vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
  - wifi: iwlwifi: fw: fix memory leak in debugfs {CVE-2023-53422}
  - drm/amdgpu: fix memory leak in mes self test {CVE-2023-53370}
  - skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
  - md/raid10: fix leak of 'r10bio->remaining' for recovery {CVE-2023-53299}
  - nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
  - ppdev: Add an error check in register_device {CVE-2024-36015}
  - wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
  - net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
  - net: add atomic_long_t to net_device_stats fields {CVE-2024-26882}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els22]
changelog:
  - locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
  - netfilter: ipset: Fix suspicious rcu_dereference_protected() {CVE-2024-40993}
  - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type {CVE-2024-39503}
  - netfilter: ipset: Missing gc cancellations fixed {CVE-2024-39503}
  - netfilter: ipset: Add list flush to cancel_gc {CVE-2024-39503}
  - netfilter: ipset: fix performance regression in swap operation {CVE-2024-26910}
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test {CVE-2024-26910}
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
  - scsi: mpt3sas: Fix a memory leak {CVE-2023-53512}
  - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() {CVE-2023-53464}
  - wifi: ath11k: fix deinitialization of firmware resources {CVE-2023-53532}
  - mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() {CVE-2022-50464}
  - ionic: catch failure from devlink_alloc {CVE-2023-53470}
  - enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
  - gpiolib: cdev: fix uninitialised kfifo {CVE-2024-36898}
  - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync {CVE-2022-50447}
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP {CVE-2024-36974}
  - ext4: Fix function prototype mismatch for ext4_feat_ktype {CVE-2023-53224}
  - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation {CVE-2023-53477}
  - netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry {CVE-2025-38472}
  - Bluetooth: qca: add missing firmware sanity checks {CVE-2024-36880}
  - Bluetooth: qca: fix info leak when fetching fw build id {CVE-2024-36032}
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
  - drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
  - drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876}
  - drm/vc4: don't check if plane->state->fb == state->fb {CVE-2024-35932}
  - drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create {CVE-2023-53263}
  - cifs: fix oops during encryption {CVE-2022-50341}
  - smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
  - smb: client: fix race with concurrent opens in rename(2) {CVE-2025-39825}
  - ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL {CVE-2023-52697}
  - blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none {CVE-2023-53292}
  - mlx5: fix possible ptp queue fifo use-after-free {CVE-2023-53398}
  - sctp: check send stream number after wait_for_sndbuf {CVE-2023-53296}
  - sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
  - scsi: mpi3mr: Use number of bits to manage bitmap sizes {CVE-2023-53376}
  - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue {CVE-2023-53280}
  - mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data {CVE-2023-53232}
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
  - fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value {CVE-2022-50327}
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() {CVE-2023-53220}
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() {CVE-2022-50272}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els23]
changelog:
  - nfs: fix possible null-ptr-deref when parsing param {CVE-2022-50455}
  - KVM: arm64: Disassociate vcpus from redistributor region on teardown {CVE-2024-40989}
  - HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
  - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg {CVE-2024-56633}
  - ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
  - ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() {CVE-2023-53483}
  - crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
  - KVM: nSVM: Check instead of asserting on nested TSC scaling support {CVE-2023-53663}
  - ice: Don't tx before switchdev is fully configured {CVE-2023-53657}
  - rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed {CVE-2023-53655}
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() {CVE-2023-53623}
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50485}
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode {CVE-2022-50485}
  - ext4: add helper to check quota inums {CVE-2022-50485}
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode {CVE-2022-50485}
  - swiotlb: Fix double-allocation of slots due to broken alignment handling {CVE-2024-35814}
  - swiotlb: fix a braino in the alignment check fix {CVE-2024-35814}
  - swiotlb: fix slot alignment checks {CVE-2024-35814}
  - swiotlb: fix the deadlock in swiotlb_do_find_slots
  - drm/radeon: free iio for atombios when driver shutdown {CVE-2023-53453}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els24]
changelog:
  - perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
  - block: fix uaf for flush rq while iterating tags {CVE-2024-53170}
  - zram: fix potential UAF of zram table {CVE-2025-21671}
  - sched: sch_cake: add bounds checks to host bulk flow fairness counts {CVE-2025-21647}
  - bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors {CVE-2024-56675}
  - net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
  - isofs: Prevent the use of too small fid {CVE-2025-37780}
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
  - sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
  - ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}
  - RDMA/rxe: Fix incomplete state save in rxe_requester {CVE-2023-53539}
  - crypto: xts - Handle EBUSY correctly {CVE-2023-53494}
  - Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
  - af_unix: Fix data-races around user->unix_inflight. {CVE-2023-53204}
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367}
  - wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
  - wifi: rtlwifi: remove unused dualmac control leftovers
  - wifi: rtlwifi: remove unused timer and related code
  - partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
  - ipmr: do not call mr_mfc_uses_dev() for unres entries {CVE-2025-21719}
  - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
  - net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
  - net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
  - null_blk: Always check queue mode setting from configfs {CVE-2023-53576}
  - ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
  - rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() {CVE-2023-53558}
  - pstore/ram: Check start of empty przs during init {CVE-2023-53331}
  - wifi: ath11k: fix memory leak in WMI firmware stats {CVE-2023-53602}
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
  - net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() {CVE-2022-50486}
  - RDMA/core: Make sure "ib_port" is valid when access sysfs node {CVE-2022-50475}
  - RDMA/rxe: Fix mr->map double free {CVE-2022-50543}
  - scsi: qla2xxx: Fix end of loop test
  - scsi: qla2xxx: Fix mem access after free
  - scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
  - scsi: target: Fix multiple LUN_RESET handling {CVE-2023-53586}
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses {CVE-2023-53675}
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() {CVE-2023-53675}
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841}
  - nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
  - bnxt: avoid overflow in bnxt_get_nvram_directory() {CVE-2023-53661}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els25]
changelog:
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
  - padata: Fix pd UAF once and for all {CVE-2025-38584}
  - wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
  - padata: Fix list iterator in padata_do_serial()
  - padata: do not leak refcount in reorder_work {CVE-2025-38031}
  - padata: avoid UAF for reorder_work {CVE-2025-21726}
  - padata: add pd get/put refcnt helper
  - net/smc: fix UAF on smcsk after smc_listen_out() {CVE-2025-38734}
  - scsi: mpi3mr: Bad drive in topology results kernel crash {CVE-2023-53037}
  - scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
  - igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
  - drm/i915/sseu: fix max_subslices array-index-out-of-bounds access {CVE-2023-53112}
  - i40e: fix idx validation in config queues msg {CVE-2025-39971}
  - dm-bufio: don't schedule in atomic context {CVE-2025-37928}
  - fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927}
  - tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable {CVE-2025-37885}
  - KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
  - KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache {CVE-2022-49882}
  - jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
  - power: supply: gpio-charger: Fix set charge current limits {CVE-2024-57792}
  - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object {CVE-2024-46798}
  - ipv6: prevent possible UAF in ip6_xmit() {CVE-2024-44985}
  - ipv6: fix possible UAF in ip6_finish_output2() {CVE-2024-44986}
  - netfilter: flowtable: validate vlan header {CVE-2024-44983}
  - usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() {CVE-2024-50268}
  - usb: vhci-hcd: Do not drop references before new references are gained {CVE-2024-43883}
  - drm/amd/display: Fix slab-use-after-free on hdcp_work {CVE-2025-21968}
  - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
  - drm/amd/display: Check index msg_id before read or write {CVE-2024-42121}
  - drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages {CVE-2024-41011}
  - drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
  - drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
  - drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
  - drm/i915: mark requests for GuC virtual engines to avoid use-after-free {CVE-2023-53552}
  - ptp: fix integer overflow in max_vclocks_store {CVE-2024-40994}
  - nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
  - loop: Fix use-after-free issues {CVE-2023-53111}
  - ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
  - mptcp: use the workqueue to destroy unaccepted sockets {CVE-2023-53072}
  - perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output {CVE-2023-53065}
  - erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
  - HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  - netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
  - coresight: Clear the connection field properly {CVE-2022-50214}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-53145}
  - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
  - x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
  - arm64: sme: Use STR P to clear FFR context field in streaming SVE mode {CVE-2023-53713}
  - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read {CVE-2023-53710}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els26]
changelog:
  - mm: hugetlb: fix UAF in hugetlb_handle_userfault {CVE-2022-50630}
  - drm/amdkfd: fix potential kgd_mem UAFs {CVE-2023-53816}
  - net/mlx5e: Fix deadlock in tc route query code {CVE-2023-53591}
  - PCI: Fix pci_device_is_present() for VFs by checking PF {CVE-2022-50636}
  - wifi: ath11k: fix monitor mode bringup crash {CVE-2022-50627}
  - wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
  - scsi: target: iscsi: Fix timeout on deleted connection {CVE-2025-38075}
  - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va {CVE-2023-53819}
  - dmaengine: ptdma: check for null desc before calling pt_cmd_callback {CVE-2023-53755}
  - wifi: mt7601u: fix an integer underflow {CVE-2023-53679}
  - Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087}
  - tls: wait for pending async decryptions if tls_strp_msg_hold fails {CVE-2025-40176}
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns {CVE-2025-38499}
  - net: openvswitch: reject negative ifindex {CVE-2023-53843}
  - drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
  - iommu/amd: Improve page fault error reporting {CVE-2023-53789}
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy {CVE-2023-53519}
  - Bluetooth: Fix potential use-after-free when clear keys {CVE-2023-53386}
  - Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
  - ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
  - ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673}
  - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
  - rxrpc: Make it so that a waiting process can be aborted {CVE-2023-53218}
  - ip6_vti: fix slab-use-after-free in decode_session6 {CVE-2023-53821}
  - vxlan: Fix nexthop hash size {CVE-2023-53192}
  - wifi: mac80211: check S1G action frame size {CVE-2023-53257}
  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
  - dm flakey: fix a crash with invalid table line {CVE-2023-53786}
  - md/raid10: fix null-ptr-deref in raid10_sync_request {CVE-2023-53832}
  - md: don't dereference mddev after export_rdev() {CVE-2023-53665}
  - md: fix 'delete_mutex' deadlock
  - md: fix duplicate filename for rdev {CVE-2023-53665}
  - kernfs: Fix UAF in polling when open file is released {CVE-2025-39881}
  - mptcp: pm: avoid possible UaF when selecting endp {CVE-2024-44974}
  - mptcp: fix UaF in listener shutdown {CVE-2023-53088}
  - Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
  - Bluetooth: hci_sync: fix set_local_name race condition
  - Bluetooth: MGMT: Fix possible deadlocks {CVE-2024-53207}
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
  - e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898}
  - wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864}
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI {CVE-2025-39965}
  - xfrm: Duplicate SPI Handling {CVE-2025-39797}
  - nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
  - NFS: Fix a race when updating an existing write {CVE-2025-39697}
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
  - drm/amd/display: Check dce_hwseq before dereferencing it {CVE-2025-38361}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els33]
changelog:
  - net: skbuff: propagate shared-frag marker through skb_gro_receive + skb_shift {CVE-2026-46300}
  - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}


author: Dmitry Shibut <dshibut@cloudlinux.com> 7.6.6-1
changelog:
  - CLOS-2240: Fix CageFS update errors arising when some packages are being added to the CageFS skeleton


author: Vladimir Lebedev <vlebedev@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 7.6.10-1
changelog:
  - CLOS-2511: Fix the CageFS issue causing Apache to stop working
  - CLOS-2485: Fix MySQL Password Disclosure in install-cagefs-plugin.py on Plesk


author:
  Vladimir Lebedev <vlebedev@cloudlinux.com>, Redouane Elkaboussi <relkaboussi@cloudlinux.com> 7.6.13-1

changelog:
  - CLOS-2576: Modify the lvectl algorithm to mitigate the impact of LVEs being reset to default limits
  - CLOS-2175: Correct the pw struct manipulation in proxyexec


author:
  Dmitry Shibut <dshibut@cloudlinux.com>, Olkseandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.23-1

changelog:
  - CLOS-3119: Add fix_fpm_services_in_container script for Ubuntu
  - CLOS-2672: Improve handling of users in proxyexec commands configuration


author: Mikalai Voina <mvoina@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.27-1
changelog:
  - CLOS-3316: Fix crontab -l in cPanel Terminal on CloudLinux 9
  - CLOS-3343: Add MariaDB client binaries to CageFS
  - CLOS-3358: Avoid unnecessary copy of /etc/mail


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.28-1
changelog:
  - CLOS-3547: Fix logged-in users lookup
  - CLOS-3605: Automatically reconfigure httpd on CloudLinux 10


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 7.6.29-1

changelog:
  - CLOS-3656: Implementation for website isolation feature
  - CLOS-3667: Add hooks for website isolation feature
  - CLOS-3694: Prepare CLI for website isolation feature
  - CLOS-3654: Add document roots monitoring for website isolation feature
  - CLOS-3737: Configure PHP sessions per website isolation
  - CLOS-3719: Setup /tmp per website isolation
  - CLOS-3745: Add a trusted mechanism for website-isolation identification
  - CLOS-3751: Implement binary to enter website isolations
  - CLOS-3720: Implement isolation of crontab per website isolation
  - CLOS-3774: Isolate home directory with overlay mounts for website isolation


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 7.6.29-1

changelog:
  - CLOS-3656: Implementation for website isolation feature
  - CLOS-3667: Add hooks for website isolation feature
  - CLOS-3694: Prepare CLI for website isolation feature
  - CLOS-3654: Add document roots monitoring for website isolation feature
  - CLOS-3737: Configure PHP sessions per website isolation
  - CLOS-3719: Setup /tmp per website isolation
  - CLOS-3745: Add a trusted mechanism for website-isolation identification
  - CLOS-3751: Implement binary to enter website isolations
  - CLOS-3720: Implement isolation of crontab per website isolation
  - CLOS-3774: Isolate home directory with overlay mounts for website isolation
  - CLOS-3643: Ensure proxy wrapper files persist after update cycles


author:
  Nika Keshelava <nkeshelava@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.6.30-1

changelog:
  - CLOS-3866, CLOS-3867, CLOS-3877, CLOS-3909, CLOS-3924, CLOS-3931, CLOS-3932: Add support of per-domain php selector for website isolation feature
  - CLOS-3846: Add cagefs-no-dev-log flag to skip /dev/log in CageFS user skeleton
  - CLOS-3905: Add php selector per website usage statistics collection
  - CLOS-3868: Trigger xray and ssa ini regeneration on website isolation enabling
  - CLOS-3859: Fix cagefs-docroots-monitor debounce skip events in short time period
  - CLOS-3858: Detect audit log rotation by comparing path inode vs file handle inode
  - CLOS-3856: Start tailer before loading docroots to prevent missed events
  - CLOS-3896, CLOS-3903: Avoid sys.exit calls in get_user_prefix which can terminate whole application


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.31-1
changelog:
  - CLOS-3974: Remove stale /usr/local/cpanel/htdocs mount point after cPanel v134 upgrade
  - CLOS-3965: Harden PHP selector and PHP configuration directory operations


author: Georgy Lepsaya <glepsaya@cloudlinux.com> 7.6.32-1
changelog:
  - CLOS-3788: Switch from /sbin/service to systemctl on EL7+ to avoid dependency on initscripts-service


author:
  Roman Prilipskii <rprilipskii@cloudlinux.com>, Georgy Lepsaya <glepsaya@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatkyi <oshyshatskyi@cloudlinux.com>, Andrei Zheregelia <azheregelia@cloudlinux.com> 7.6.33-1

changelog:
  - CLOS-4008: Optimize user group processing in cagefsctl.copyetc
  - CLOS-3899: Run check_params.py inside LVE
  - CLOS-4035: Fork check_params.py only for commands with restricted params
  - CLOS-4037: Add nolve flag to proxyexec to bypass LVE entry
  - CLOS-3998: Integrate per-domain LVE limits with website isolation
  - CLOS-3990: Bring back --site-isolation-list command
  - CLOS-3973: Register LVD helper binaries in CageFS proxyexec
  - Update usage messages in cagefsctl for clarity and consistency


author: Roman Prilipskii <rprilipskii@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 7.6.34-1
changelog:
  - CLOS-2408: Add /etc/cpanel/ea4/php.conf.cache and /usr/local/cpanel/cPstrict.pm to CageFS config for cPanel
  - CLPRO-3006: Fix subdomain isolation on DirectAdmin (domain_owner fallback in cagefsctl_user)


author:
  Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.37-1

changelog:
  - CLOS-4404: Speed up cagefs skeleton updates (cache ldd output, prune find traversal)
  - CLOS-4351: Bind /usr/selector inside per-domain isolated namespace to fix dead-symlink 503 on native PHP
  - CLOS-4343: Heal per-site website-isolation directory permissions after a non-isolated request
  - CLOS-4348: Drop legacy InterWorx and ISPManager support; conflict with lvemanager < 7.11.39-1
  - CLOS-4274: Internal bugfixes across CageFS components


changelog: - CLOS-4490, CLOS-4406, CLOS-4387: Internal bugfixes across CageFS components
author:
  Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.6.38-1


author: Georgy Lepsaya <glepsaya@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.6.39-1
changelog:
  - CLOS-3536: Switch to alt-python-internal build-time dependency
  - CLOS-4545: Fix .cagefs ownership being reassigned to the wrong user on shared home directories
  - CLOS-4516, CLOS-4596, CLOS-4558, CLOS-4451, CLOS-4632, CLOS-4517: Internal bugfixes across CageFS components


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.6.40-1

changelog:
  - CLOS-4642: Add support of isolates with LiteSpeed webserver
  - CLOS-4647: Re-register dynamic proxy commands after CageFS upgrade
  - CLOS-4634, CLOS-4560: Internal bugfixes across CageFS components


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.6.42-1
changelog:
  - CLOS-5714: Fix *REDIRECT_CGI and SUSPENDEDPAGE aliases on cPanel for isolates
  - CLOS-5813: Fix isolatectl is not registered in skeleton
  - CLOS-5387: Internal bugfixes across CageFS components


author:
  Oleksii Soldatienko <osoldatienko@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.6.43-1

changelog:
  - CLOS-5724: Keep a per-domain `native` PHP selection on the cPanel system-native PHP under Website Isolation across CageFS rebuild/reset and repair stale native symlinks; expose the shared native_website_targets() helper in clcagefslib so lvemanager and cagefsctl pin identical targets
  - CLOS-5826: Tolerate idle cage namespaces so cagefsctl namespace creation no longer fails when an idle cage is present
  - CLOS-5955: Internal bugfixes across multiple components


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.6.44-1

changelog:
  - CLOS-5750: on cagefs upgrade, regenerate site-isolation so LSWS DedicatePhpHandler includes are backfilled
  - CLOS-6641: Fix system log flooding with "Rejected send message" records on servers with nscd installed
  - CLOS-5938: Internal bugfixes across multiple components


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.11.8-1
changelog:
  - CLOS-2692: Updated to 10.11.8
  - CLOS-2692: Fixed "Can't enter LVE" logging message
  - CLOS-2557: tmpfiles config added


author: Timur Averianov <taverianov@cloudlinux.com> - 10.11.14-1
changelog:
  - CLOS-3531: Updated to 10.11.14
  - CLOS-3538: Stopped patching "mysql.server.sh", the upstream version will be used further on


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.2.44-5
changelog:
  - CLOS-1955: Adjusted conflicts and obsoletes tags to mysqlclient18-compat
  - CLOS-1955: Added conflicts tags to another version of cl-MariaDB* packages


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.4.34-1
changelog:
  - CLOS-2692: Updated to 10.4.34
  - CLOS-2692: Fixed "Can't enter LVE" logging message
  - CLOS-2557: tmpfiles config added


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.5.25-1
changelog:
  - CLOS-2692: Updated to 10.5.25
  - CLOS-2692: Fixed "Can't enter LVE" logging message
  - CLOS-2557: tmpfiles config added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.6.15-1

changelog:
  - CLOS-1923: Updated to 10.6.15
  - CLOS-1744: Added MySQL Provides tag in cl-MariaDB-meta-client package


author: Timur Averianov <taverianov@cloudlinux.com> - 10.6.23-1
changelog:
  - CLOS-3534: Updated to 10.6.23
  - CLOS-3538: Stopped patching "mysql.server.sh", the upstream version will be used further on


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 10.6.27-1
changelog:
  - CLOS-4619: Updated to 10.6.27
  - CLOS-4619: Drop byte_order_generic headers no longer installed by upstream


author: Timur Averianov <taverianov@cloudlinux.com> - 11.4.8-1
changelog:
  - CLOS-3526: Updated to 11.4.8
  - CLOS-3538: Stopped patching "mysql.server.sh", the upstream version will be used further on


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 11.4.12-1
changelog:
  - CLOS-4623: Updated to 11.4.12
  - CLOS-4623: Drop README-wsrep removed from upstream Docs
  - CLOS-4623: Drop byte_order_generic headers no longer installed by upstream


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 11.8.8-1
changelog:
  - CLOS-4624: Updated to 11.8.8
  - CLOS-4624: Drop README-wsrep removed from upstream Docs
  - CLOS-4624: Drop byte_order_generic headers no longer installed by upstream


author: Daria Kavchuk <dkavchuk@cloudlinux.com> 5.5.61-2
changelog:
  - MYSQLG-291: Added systemd service files and scripts
  - Removed part of posttrans scriptlet, which cleaned service files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 5.5.68-1
changelog:
  - Updated up to 5.5.68
  - MYSQLG-477: governer patch: dropped const attribute for governor_charset_bin


author: Timur Averianov <taverianov@cloudlinux.com> - 8.0.43-1
changelog:
  - CLOS-3491: Update cl-MySQL80 to 8.0.43
  - CLOS-3538: Stop patching "mysql.server.sh", the upstream version will be used further on


author: Miroslav Rajcic <miroslav.rajcic@oracle.com> - 8.4.0-1
changelog:
  - mysql_stmt_bind_param C API removed, so increase the libmysqlclient major version to 24.
  - Removed mysqlpump, mysql_upgrade, zlib_decompress and lz4_decompress binaries


author: Timur Averianov <taverianov@cloudlinux.com> - 8.4.6-1
changelog:
  - CLOS-3529: Update cl-MySQL 8.4 to 8.4.6
  - CLOS-3538: Stop patching "mysql.server.sh", the upstream version will be used further on


author: Ruslan Koliada <rkoliada@cloudlinux.com> 1.1.17-1
changelog:
  - CLPRO-2763: Fix C-Monitoring failed to load resources - Template variable service failed Unknown error during query transaction.


author: Ruslan Koliada <rkoliada@cloudlinux.com> 1.1.18-1
changelog:
  - CLPRO-2821: Fix "cl_node_exported" service periodically fails with SIGSEGV while executing its meminfo collector


author: Alisher Matkurbanov <amatkurbanov@cloudlinux.com>, Pavel <pmogilnikov@cloudlinux.com> 1.0.7-1
changelog:
  - LU-2060: Fix addon and sub-domain names collection in WMT on CPanel
  - LU-1996: Add logging and sentry to python scripts


author:
  Hasan <haliev@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Aleksey Zverev <azverev@cloudlinux.com> 2.0.0-1

changelog:
  - LU-2310: implement wmt for CloudLinux OS Solo
  - LU-2281: Implement WMT notifications: reports & alerts
  - LU-2365: Modify WMT Solo settings (email notifications, ignore list)
  - LU-2429: Split email configuration into default and overridable
  - LU-2431: Fix WMT solo bugs


author:
  Pavel <pmogilnikov@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 2.1.0-1

changelog:
  - LU-2401 : rewrite broken crons
  - LU-2298: Check spelling and correctness CL licenses in all files of Userspace projects
  - LU-2568 Don`t send summary reports if WMT is disabled
  - LU-2442 Disable WMT when Solo license expires
  - LU-2595: Change system_id format in wmt-api-solo --send-clickhouse


author: Ruslan Koliada <rkoliada@cloudlinux.com> 3.2.1-1
changelog:
  - CLPRO-3051: Improved scanner configuration, service initialization, notifications, and daemon restart handling


author: Ruslan Koliada <rkoliada@cloudlinux.com> 3.2.6-1
changelog:
  - CLPRO-3227: Improvements to cron lock file handling and reported URL origin formatting
  - CLPRO-3250: Improvements to log file handling


author: Jon Maloy <jmaloy@redhat.com> - 21.1-14
changelog:
  - ci-Fix-IPv6-netmask-format-for-sysconfig-1215.patch [bz#2046540]
  - Resolves: bz#2046540
    (cloud-init writes route6-$DEVICE config with a HEX netmask. ip route does not like : Error: inet6 prefix is expected rather than "fd00:fd00:fd00::/ffff:ffff:ffff:ffff::".)


author: Camilla Conte <cconte@redhat.com> - 21.1-15
changelog:
  - ci-Detect-a-Python-version-change-and-clear-the-cache-8.patch [bz#1935826]
  - ci-Fix-MIME-policy-failure-on-python-version-upgrade-93.patch [bz#1935826]


author: Jon Maloy <jmaloy@redhat.com> - 22.1-2
changelog:
  - ci-Add-native-NetworkManager-support-1224.patch [bz#2059872]
  - ci-Use-Network-Manager-and-Netplan-as-default-renderers.patch [bz#2059872]
  - ci-Align-rhel-custom-files-with-upstream-1431.patch [bz#2082071]
  - ci-Remove-rhel-specific-files.patch [bz#2082071]
  - Resolves: bz#2059872
    ([RHEL-8]Rebase cloud-init from Fedora so it can configure networking using NM keyfiles)
  - Resolves: bz#2082071
    (Align cloud.cfg file and systemd with cloud-init upstream .tmpl files)


author: Jon Maloy <jmaloy@redhat.com> - 22.1-3
changelog:
  - ci-Support-EC2-tags-in-instance-metadata-1309.patch [bz#2082686]
  - Resolves: bz#2082686
    ([cloud][init] Add support for reading tags from instance metadata)


author: Miroslav Rezanina <mrezanin@redhat.com> - 22.1-4
changelog:
  - ci-cloud-init.spec-adjust-path-for-66-azure-ephemeral.r.patch [bz#2096269]
  - ci-setup.py-adjust-udev-rules-default-path-1513.patch [bz#2096269]
  - Resolves: bz#2096269
    (Adjust udev/rules default path[RHEL-8])


author: Jon Maloy <jmaloy@redhat.com> - 22.1-5
changelog:
  - ci-Revert-Add-native-NetworkManager-support-1224.patch [bz#2107464 bz#2110066 bz#2117526 bz#2104393 bz#2098624]
  - ci-Revert-Use-Network-Manager-and-Netplan-as-default-re.patch [bz#2107464 bz#2110066 bz#2117526 bz#2104393 bz#2098624]
  - Resolves: bz#2107464
    ([RHEL-8.7] Cannot run sysconfig when changing the priority of network renderers)
  - Resolves: bz#2110066
    (DNS integration with OpenStack/cloud-init/NetworkManager is not working)
  - Resolves: bz#2117526
    ([RHEL8.7] Revert patch of configuring networking by NM keyfiles)
  - Resolves: bz#2104393
    ([RHEL-8.7]Failed to config static IP and IPv6 according to VMware Customization Config File)
  - Resolves: bz#2098624
    ([RHEL-8.7] IPv6 not workable when cloud-init configure network using NM keyfiles)


author: Jon Maloy <jmaloy@redhat.com> - 22.1-6
changelog:
  - ci-cloud.cfg.tmpl-make-sure-centos-settings-are-identic.patch [bz#2115576]
  - Resolves: bz#2115576
    (cloud-init configures user "centos" or "rhel" instead of "cloud-user" with cloud-init-22.1)


author: Camilla Conte <cconte@redhat.com> - 22.1-7
changelog:
  - ci-Ensure-network-ready-before-cloud-init-service-runs-.patch [bz#2151861]
  - Resolves: bz#2151861
    ([RHEL-8] Ensure network ready before cloud-init service runs on RHEL)


author: Camilla Conte <cconte@redhat.com> - 22.1-8
changelog:
  - ci-cc_set_hostname-ignore-var-lib-cloud-data-set-hostna.patch [bz#2162258]
  - Resolves: bz#2162258
    (systemd[1]: Failed to start Initial cloud-init job after reboot system via sysrq 'b' [RHEL-8])


author: Roman Krompets <rkrompets@cloudlinux.com> 0.2-6
changelog:
  - AWP-717: Design Fixes for Latest AccelerateWP UI/UX
  - AWP-705: Load list of websites and advices in parallel
  - AWP-706: Reviewed AccelerateWP end-user app for unused code and removed it.
  - AWP-696: Fixed pagination and sorting in case when triggered table update.


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 0.2-7
changelog:
  - CLPRO-811: Added conversion analytics
  - CLPRO-937: Fixed error when AccelerateWP doesn't show progress (percent) when processing advice
  - AWP-726: Fixed link to documentation page in AccelerateWP for Solo Edition


author: Roman Krompets <rkrompets@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> 0.3-1
changelog:
  - Migrated 'cloudlinux-awp-spa' project to Python311 (CLPRO-1198)
  - Used svg icon instead of mat-icon for settings (CLPRO-1133)
  - Catch advice tracking data from POST in cPanel, fixing GET parameters catching (CLPRO-1197)


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 0.4-1
changelog:
  - Switched sending of Sentry events from the old to the new Sentry in AWP UI (CLPRO-1212)
  - Generate new tracking session when direct access to the hosting panel (CLPRO-1223)
  - Adapted UI AccelerateWP Premium and CDN for Solo/Admin (CLPRO-1200)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.7-1
changelog:
  - Fixed error "Cannot read properties of undefined (reading accelerate_wp)" while opening AccelerateWP (CLPRO-1785)
  - Fixed incorrect "Active" status in AccelerateWP after closing features popup without upgrading (CLPRO-1808)
  - Unified AccelerateWP across CloudLinux Editions (CLPRO-1559)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.7-2
changelog:
  - Added integration support for AccelerateWP UI part (CLPRO-402)
  - Prevented displaying of incorrect feature activation notes if some advice generated (CLPRO-1838)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.7-5
changelog:
  - cPanel: Fixed incorrect handling theme directories while installation (CLPRO-2144)
  - Renamed CloudLinux Shared to CloudLinux Legacy (CLPRO-2173)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-1
changelog:
  - Changed the AccelerateWP UI to fit requirements with Object Cache free (CLPRO-2280)
  - Fixed the link to the user guide in the accelerateWP UI (CLPRO-2223)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-3
changelog:
  - Fix UI issue when the title for CDN module in the manage modal was not translated (CLPRO-2359)
  - Optimized sending requests while applying advice (CLPRO-2226)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-4
changelog:
  - Removed the "Please leave your feedback about AccelerateWP and Smart Advice" component (CLPRO-2263)
  - Renamed "Object Cache" feature to the "Redis Object Cache" in the AccelerateWP UI (CLPRO-2444)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-5
changelog:
  - Fix plugin icons displaying on Direct Admin (CLPRO-2524)
  - Add "app_key" for cPanel's plugin templates that uses LiveAPI to allow customize headers (CLPRO-1368)


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-10
changelog:
  - CLPRO-3061: Improved cPanel analytics handling, error context reporting, and notification rendering


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-11
changelog:
  - CLPRO-3130: Improved AWP modal content rendering, pipe input handling, and build dependency installation


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-12
changelog:
  - CLPRO-3120: Improved AccelerateWP UI localisation, runtime language switching, and notification bridge
  - CLPRO-3191: Improved AccelerateWP error-diagnostics reporting and DirectAdmin plugin installation


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-13
changelog:
  - CLPRO-3192: Improved AccelerateWP billing-popup URL handling, analytics event data, UI text rendering, and build/install tooling
  - CLPRO-3193: Improved AccelerateWP external-link handling, analytics, and cPanel installer robustness


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-14
changelog:
  - CLPRO-3418: Improved AccelerateWP analytics, billing flows, error reporting, and panel integration checks


author: Ray Strode <rstrode@redhat.com> - 80.8-1
changelog:
  - Fix black spot in one of the backgrounds
    Resolves: #1684106
  - Add missing 2560x1600 8-abstract-light background
    Resolves: #1692309
  - letter box instead of crop backgrounds when there's no
    good aspect ratio
    Related: #1720610


author: Ray Strode <rstrode@redhat.com> - 81.0-1
changelog:
  - Add wallpapers for wider screen monitors
    Related: #1720610
  - Move logo to corner in wallpapers that have it in center
    Resolves: #1706793


author: Ray Strode <rstrode@redhat.com> 84.3-1
changelog:
  - Another round of background updates. This:
       - downscales wallpapers to match their labeled size
       - fixes a few portrait/landscape swaps
       - moves centered logos away from center in portrait
         wallpapers
    Related: #1854287


author: Ray Strode <rstrode@redhat.com> 84.4-1
changelog:
  - Another round of background updates.  This:
       - Fixes missized image
       - Removes rendering artifacts from some of the backgrounds
       - Removes extraneous wallpapers for aspect ratios we don't care about
    Related: #1854287


author: Igor Zubkov <izubkov@cloudlinux.com> - 7-4.cloudlinux
changelog:
  - Rename to cloudlinux-indexhtml
  - Add Obsoletes: redhat-indexhtml
  - Add Provides: redhat-indexhtml = %{version}-%{release}
  - Add Obsoletes: centos-indexhtml
  - Add Provides: centos-indexhtml = %{version}-%{release}


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1-1.20
changelog:
  - AL-2064: Add psaadm user to linksafe group on Plesk Onyx
  - AL-2069: Fix alt-* packages files permissions correction


author: Stepan Oksanichenko <soksanichenko@cloudlinux.com> - 1-1.22
changelog:
  - CAG-714: cloudlinux-linksafe package should turn off symlink traversal protection by default. Part II


author:
  Stas Django <ssergiienko@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> - 1-1.23

changelog:
  - CAG-833: /scripts/postupcp issue (cloudlinux-linksafe?)
  - LU-482 Added root permission check to cl-linksafe-reconfigure


author: Anton Volkov <avolkov@cloudlinux.com>, Sergey Kozhekin <skozhekin@cloudlinux.com> - 1-1.24
changelog:
  - LU-1641: investigate issues with CL8 installation into empty chroot (ISO install)
  - SonarQube cloudlinux-linksafe ger_ev


author: Anton Volkov <avolkov@cloudlinux.com> - 1-1.25
changelog:
  - LVEMAN-1648: add "--skip-php-reload" to cagefsctl --setup-cl-selector called by /usr/bin/cl-linksafe-reconfigure


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 1-3.2
changelog:
  - LVEMAN-1748: Move linksafe group creation to %pre
  - LU-2436: Remove cllib dependency from cloudlinux-linksafe


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-6
changelog:
  - CLPRO-840: Hide "Load CSS asynchrounsly" AccelerateWP button
  - CLPRO-651: Add domain name as user in Sentry event
  - Notiсe to change open_basedir (CLPRO-1145)


author: Martin Krcho <mkrcho@cloudlinux.com> - 1.1-8
changelog:
  - Fix handling of image optimization and critical CSS related settings (CLPRO-1441)
  - Add WP CLI command to purge cache (CLPRO-1426)


author: Martin Krcho <mkrcho@cloudlinux.com> - 1.1-14
changelog:
  - Update CLSOP to version 3.15.9 (CLPRO-1702)
  - Send IP address to Sentry along with domain. (CLPRO-1743)


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-22
changelog:
  - Added support for CloudLinux MAx WebServer (AP2NGX-222, AP2NGX-220)
  - Improved page warming performance (AP2NGX-247)


author: Roman Krompets <rkrompets@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-24
changelog:
  - Fixed the issue with version discrepancies between the plugin and composer.json (CLPRO-2687)
  - Update plugin to version 3.18.3 (CLPRO-951)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> - 1.1-29
changelog:
  - Improved AccelerateWP tmp location handling (CLPRO-2786)
  - Prevent convert images with size more then 16383 × 16383 to WEBP format (CLPRO-2830)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-34
changelog:
  - UI improvements in the AccelerateWP with Critical CSS free (CLPRO-2832)
  - Added support for polylang plugins and cookie notices for MaxCache (MAXWS-936)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-37
changelog:
  - Added custom JwtHelper to prevent JWT-related failures (CLPRO-2989)
  - Improve mobile render-blocking resource optimization (MAXWS-1001)
  - Add font metric overrides to reduce CLS from web fonts (MAXWS-1002)
  - Improve database optimization (MAXWS-1003)
  - Add explicit Cache-Control max-age headers for static resources (MAXWS-1004)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-38
changelog:
  - Improve cache file accessibility (CLPRO-3001)
  - Added API endpoint for license rechecking (MAXWS-1026)


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-40
changelog:
  - Internal stability and reliability improvements
  - Build and packaging updates
  - General maintenance and minor fixes


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.1-43.1
changelog:
  - Compatibility fix for WordPress 7.1 (CLOS-6931)
  - Internal stability and reliability improvements (CLOS-6887)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Hasan <haliev@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Danylo Kuropiatnyk <dkuropiatnyk@cloudlinux.com>, soksanichenko <soksanichenko@cloudlinux.com> 1.0.0-1

changelog:
  - LU-2443, LU-2447, LU-2321, LU-2352, LU-2334, LU-2268, LU-2296, LU-2229, LU-2172, LU-2133: preparations of CloudLinux Solo OS meta package


author:
  Pavel Negrobov <pnegrobov@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, Sergey Kozhekin <skozhekin@cloudlinux.com> 1.0.4-1

changelog:
  - LVEMAN-1851: Adapt cloudlinux-selector utility for "No CageFS" mode
  - CAG-1224: Make CageFS work on CL Solo
  - MODLS-932: Remove mod_lsapi conflicts from the cloudlinux-solo-meta


author: Andrei Zheregelia <azheregelia@cloudlinux.com>, Georgy Lepsaya <glepsaya@cloudlinux.com> 1.0.11-1
changelog:
  - CLOS-4282: Internal bugfixes
  - CLOS-3392: Use alt-python-internal instead of alt-python311 on all platforms


author: Sergey Kokhan <skokhan@cloudlinux.com> - 3.9-1
changelog:
  - MODLS-528: Fixed error on restore "Too big FD number to restore"
  - MODLS-516: Open out of jail vma files before entering jail
  - Updated to CRIU version 3.9


author: Sergey Kokhan <skokhan@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 3.9-2
changelog:
  - MODLS-564: Remove errors that were logged by criu in apache error_log
  - MODLS-575: Fixed bug when restored lsphp masters spawn children with PIDs lower than last_pid


author: Serhii Kokhan <skokhan@cloudlinux.com> - 3.13-7
changelog:
  - CLOS-1655: Release bump to align CL7 criu-lve with mod_lsapi dependency
    tightening (libcriu.so SONAME guard)


author: Serhii Kokhan <skokhan@cloudlinux.com> - 3.13-10
changelog:
  - MAXWS-1086: Rename C library/headers/pkgconfig to the criu-lve namespace to coexist with criu-libs


author: Sandro Mani <manisandro@gmail.com> - 2.15.6-2
changelog:
  - Fix licensecheck incorrectly detecting mime strings such as text/x-c++ as a binary file (#1249227)


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.18.24-8
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
  - https://fedoraproject.org/wiki/Changes/Remove_GCC_from_BuildRoot


author: Sérgio Basto <sergio@serjux.com> - 1.18.25-5
changelog:
  - Revert "Bundle a version of tar to make it compatible in EL7"
  - Keep BR: perl(Digest)
  - Remove --clamp-mtime option on tar of el7.
  - Add Requires perl(Digest::MD5) and perl(Digest::SHA*) on dpkg-perl (#1628409)


author: Sérgio Basto <sergio@serjux.com> - 1.18.25-8
changelog:
  - Requires perl(MIME::Lite) on dpkg-dev (rhbz #1678637)
  - Adds check section and performs unit tests but ignores failures


author: Peter Jones <pjones@redhat.com> - 3-2
changelog:
  - Always provide macros for efi_arch and efi_alt_arch (and their _upper
    variants), and make efi_has_arch and efi_has_alt_arch 0 when they will be
    wrong.  This ensures everything can always expand when we're on a non-efi
    architecture.


author: Dominik Mierzejewski <rpm@greysector.net> - 1.23-1
changelog:
  - update to 1.23 (#1597055)
  - point to working URLs
  - pretend t.tar test succeeds for now (#1601392)
  - make testsuite more verbose for the future


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 1.00.38-1
changelog:
  - Update to 1.00.38
  - split freetds-libs package (for multiarch support)
  - change default tds vesrion to auto
  - move odbc plugin from devel to libs package (#1449881)


author: Richard Hughes <richard@hughsie.com> 1.5.4-1
changelog:
  - Rebase package to include support for latest OEM hardware and to
    support deploying UEFI SecureBoot dbx updates.
  - Resolves: #1870811


author: Richard Hughes <richard@hughsie.com> 1.5.5-2
changelog:
  - Do not invalidate all remote timestamps during package install to fix rpm -V.
  - Backport some important high priority fixes from upstream.
  - Resolves: #1926382


author: Richard Hughes <richard@hughsie.com> 1.5.9-3
changelog:
  - Rebase to include the SBAT metadata section to allow fixing BootHole
  - Resolves: rhbz#1933012
  - Resolves: rhbz#1932953
  - Resolves: rhbz#1932909
  - Resolves: rhbz#1932882
  - Resolves: rhbz#1932579
  - Resolves: rhbz#1932553
  - Resolves: rhbz#1932423


author: Richard Hughes <richard@hughsie.com> 1.7.1-1
changelog:
  - New upstream release
  - Backport upstream changes
  - Include support for Dell TBT4 Docking stations
  - Resolves: rhbz#1969472
  - Resolves: rhbz#1976408


author: Richard Hughes <richard@hughsie.com> 1.7.1-2
changelog:
  - Disable the Logitech bulkcontroller plugin to avoid adding a dep to protobuf-c
    which lives in AppStream, not BaseOS.
  - Resolves: rhbz#2029333


author: Richard Hughes <richard@hughsie.com> 1.7.4-1
changelog:
  - Include support for Lenovo TBT4 Docking stations
  - Do not cause systemd-modules-load failures
  - Resolves: rhbz#2038258
  - Resolves: rhbz#2037294


author: Richard Hughes <richard@hughsie.com> 1.1.3-1
changelog:
  - New upstream release
  - Adds support for an upcoming Dell USB-C dock
  - Don't use an obsolete font when building the UEFI images
  - Resolves: #1607842


author: Richard Hughes <richard@hughsie.com> 1.1.4-1
changelog:
  - New upstream release
  - Use HTTPS_PROXY if set
  - Make the dell-dock plugin more robust in several ways
  - Adjust EVB board handling
  - Resolves: #1647557


author: Peter Jones <pjones@redhat.com> - 10-1
changelog:
  - Update to the final released version 10.
  - Make everything under /boot/efi be mode 0700, since that's what FAT will
    show anyway.


author: Peter Jones <pjones@redhat.com> - 10-4
changelog:
  - Roll in some bugfixes that'll be in fwupdate-11 upstream.
    This helps fix a couple of vendors machines.


author: Lukas Javorsky <ljavorsk@redhat.com> - 25.3.34-3
changelog:
  - Use downstream garbd-wrapper and garbd.service to ensure compatibility
  - Add upstream versions of garbd-wrapper (called garbd-systemd) and garbd.service
    in case user want's to use them


author: Lukas Javorsky <ljavorsk@redhat.com> - 25.3.34-4
changelog:
  - Explicitly require the 'procps-ng' package
  - Otherwise it will not require it in the lightweight systems (e.g. containers)
  - and Galera won't work properly


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-99
changelog:
  - CLOS-2049: Governor dropin removed
  - CLOS-2170: Add additional safeguards for detecting MySQL AUTO version with DirectAdmin
  - CLOS-2173: Added mysqlclient21 installation for clMariaDB
  - CLOS-2117: mysql-version-list option added
  - MariaDB 10.11 support temporarily removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-102
changelog:
  - CLOS-2215: bad_users_list ownership fixed
  - CLOS-1759: dbgovernor_map mysql charset changed to utf8mb
  - CLOS-1730: Timeouts added to avoid repetive log messages


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-105
changelog:
  - CLOS-2322: Fixed DB limits not applying to users after a MySQL Governor service restart
  - CLOS-2418: MySQL 8.0 community edition repo url changed


author: Dmitry Shibut <dshibut@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-107
changelog:
  - CLOS-2319: EOLed cl-MariaDB 10.3 removal result to server down
  - CLOS-2471: Fixed wizzard installation


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-109
changelog:
  - CLOS-2572: LVE busy in MySQL processes issue fixed
  - CLOS-2506: Fixed MySQL community downloads URL


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-110
changelog:
  - CLOS-2322: Fixed issue with not applying limits after Governor service restart
  - CLOS-2535: Governor threads logging added


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-111

changelog:
  - CLOS-2645: Corrected MariaDB version detection logic for DA config
  - CLOS-2593, CLOS-2613: Added extended logging
  - CLOS-2385: Added watchdog monitoring utility to governor package
  - CLOS-2386: Implemented external Sentry logging mechanism


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-111

changelog:
  - CLOS-2645: Corrected MariaDB version detection logic for DA config
  - CLOS-2593, CLOS-2613: Added extended logging
  - CLOS-2385: Added watchdog monitoring utility to governor package
  - CLOS-2386: Implemented external Sentry logging mechanism
  - CLOS-2594, CLOS-2641: Implemented logging from MySQL and uniform logging


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-114

changelog:
  - CLOS-2719: Re-enabled watchdog monitoring utility with adjusted logic and interval
  - CLOS-2711: Added extended logging rotation
  - CLOS-2780: Fixed governor restarts
  - CLOS-2596: Do not install missing MariaDB-compat package in case of CL9
  - CLOS-2735: Changed semaphore retry logic to timed wait


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-115
changelog:
  - CLOS-2947: Fix watchdog cron job to stop it from emitting emails
  - CLOS-2885: Prevent sentry_demon from logging zero counters to logs
  - CLOS-2817: Fix Sentry reporting
  - CLOS-2581: Add mysql backup script


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-116
changelog:
  - CLOS-2840: Reduce probability of Governor limits being not applied; prevented Governor hang-up after MySQL/MariaDB or Governor service abrupt termination (replaced semaphore-protected bad_list with lockless one)
  - CLOS-2942: Fix resource usage estimation, reduces probability of Governor limits applied incorrectly
  - CLOS-2873: Fix "/etc/container/dbuser-map" application
  - CLOS-2899: Fix "dbctl --lve-mode=" in case of initial LVE mode "off"


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-117
changelog:
  - Revert changes from 1.2-116 to create a temporary fallback point for 1.2-118
  - Backport fix for unclean handling of SIGTERM in sentry_daemon.py (CLOS-2954)


author:
[cell repeats an earlier one in this file: 106 characters]

changelog:
  - CLOS-2719: Re-enabled watchdog monitoring utility with adjusted logic and interval
  - CLOS-2711: Added extended logging rotation
  - CLOS-2780: Fixed governor restarts
  - CLOS-2596: Do not install missing MariaDB-compat package in case of CL9
  - CLOS-2735: Reduced probability of Governor limits being not applied (changed semaphore retry logic to timed wait in bad_list protection)


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-115

changelog:
  - CLOS-2947: Fix watchdog cron job to stop it from emitting emails
  - CLOS-2885: Prevent sentry_demon from logging zero counters to logs
  - CLOS-2817: Fix Sentry reporting
  - CLOS-2581: Add mysql backup script


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-119
changelog:
  - CLOS-2954: Remove prompt when handling SIGTERM in sentry_daemon.py, it was sometimes leading to "BrokenPipe" error
  - CLOS-2968, CLOS-2794: Improve error reporting


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-122
changelog:
  - CLOS-2999: Fix MySQL version logging
  - CLOS-3051: Improve MySQL connections management to avoid crashes
  - CLOS-3051: Improve error reporting
  - CLOS-3015: Add MariaDB 11.4 support


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-124
changelog:
  - CLOS-3196: Fix service dependencies - stopping/starting subordinate 'governor_sentry_daemon.service' by cPanel upgrade scripts was bringing 'db_governor.service' down


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-125
changelog:
  - CLOS-2663, CLOS-3257: Improve error reporting
  - CLOS-3257: Fix crash during statistics collection for LVE-Stats


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-127
changelog:
  - CLOS-3342: Fix outdated limitations in the scenario of several new DB users showed up in sequence fast, and then no new users seen for long
  - CLOS-3361: Fix MariaDB installation on machines with unknown "mysql" DNF module
  - CLOS-3354: Improve error reporting


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-131
changelog:
  - CLOS-2945: Improve error reporting
  - CLOS-3340: Fix restriction causes reported to LVE-stats
  - CLOS-3340: Fix "dbctl restrict <user>" in period-based mode - it was decreasing restriction level
  - CLOS-3340: Fix "dbctl --lve-mode=..." - max. connection count limitation was not removed after restriction reset
  - CLOS-3340: Speed up "dbctl restrict <user>" and "dbctl unrestrict <user>" on machines with many users
  - CLOS-3340: Reduce resource consumption in period-based mode combined with max. connection count limitation
  - CLOS-3340: Reduce resource consumption by duplicate "dbctl unrestrict <user>"
  - CLOS-3340: Fix "penalty period" configuration in period-based mode - setting it to zero didn't turn it off, but still produced a 1 sec penalty period
  - CLOS-3340: Fix "dbgovernor-restrict.log" - remove redundant and misleading items
  - CLOS-3340: Fix "dbctl restrict <user>" - it could restrict administrative DB account
  - CLOS-3418: Fix outdated limitations


author: Haluk Yilmaz <hyilmaz@cloudlinux.com> 1.2-132
changelog:
  - CLOS-3217: Fix "dbtop" and "dbctl" - reports could be inconsistent under high load
  - CLOS-3217: Speed up "dbtop" and "dbctl"


author: Haluk Yilmaz <hyilmaz@cloudlinux.com> 1.2-133
changelog:
  - CLOS-3027: Strengthen string copy operations
  - CLOS-3027: Support long DB user names, up to 80 characters
  - CLOS-3027: Change shared memory structure to consume less memory


author: Timur Averianov <taverianov@cloudlinux.com> 1.2-134
changelog:
  - CLOS-3514: Reduce overhead in the scenario when a new DB user shows up in the middle of already high load
  - CLOS-3317: Fix invalid Linux user names reported to LVE-stats in cases of advanced authentication, like LDAP


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 1.2-136
changelog:
  - CLOS-3521: Fix mysql installation on Ubuntu
  - CLOS-3570: Do not install mysqlclient18 & mysqlclient21 on CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Mikalai Voina <mvoina@cloudlinux.com> 1.2-142

changelog:
  - CLOS-4122: Optimized memory management and safety
  - CLOS-4097: Optimized per-user MariaDB connection limits handling


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Nika Keshelava <nkeshelava@cloudlinux.com> 1.2-143

changelog:
  - CLOS-3496: Fixed MySQL Governor speed limit does not align with user package when upgraded/downgraded/reset


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-144
changelog:
  - CLOS-4042: Fix MySQL/MariaDB installation on CL10 when libaio (or numactl) is published with the x86_64_v2 baseline arch tag


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-145
changelog:
  - CLOS-4339: Maintenance update.
  - CLOS-4414: Fix DB usage graphs not displaying in cPanel user interface.


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.2-148
changelog:
  - CLOS-5707: Fix cPanel resource usage hanging caused by config file adjustments
  - CLOS-5170: Maintenance update.


author: Robbie Harwood <rharwood@redhat.com> - 2.02-143
changelog:
  - x86-efi: Fix an incorrect array size in kernel allocation
  - Also merge with 8.7
  - Resolves: #2031288


author: Leo Sandoval <lsandova@redhat.com> - 2.02-161
changelog:
  - Add Several CVE fixes
  - Resolves CVE-2024-45775 CVE-2025-0624
  - Resolves: #RHEL-75735
  - Resolves: #RHEL-79837


author: Nicolas Frayer <nfrayer@redhat.com> - 2.02-162
changelog:
  - ieee1275/ofnet: Fix grub_malloc() removed after added safe
  - Remove 'fs/ntfs: Implement attribute verification' patch
  - Related: #RHEL-79837


author: Leo Sandoval <lsandova@redhat.com> - 2.02-167
changelog:
  - 99-grub-mkconfig.install: fix condition allowing correct checks if GRUB_ENABLE_BLSCFG is not present
  - Resolves: #RHEL-80168


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2:2.02-169.cloudlinux.1
changelog:
  - CLKRN-867: move /boot/grub2/grubenv to /boot/efi/EFI/centos/ if it's a regular
    file(not a symlink) while updating/installing.
  - CLKRN-916: move fixing grubenv (CLKRN-867) to posttrans scriptlet when all
    needed dirs exis


author: Therese Cornell <tcornell@redhat.com> - 2.02-170.1
changelog:
  - Fixes CVE-2025-61662 Missing unregister call for gettext command may lead to use-after-free
  - Resolves: #RHEL-141583


author: Antonio Trande <sagitter@fedoraproject.com> - 1.8.20-3
changelog:
  - Force default ldflags for Fedora (bz#1548533)
  - Switch -shared flag to -Wl,--as-needed
  - Modify low optimization level for gnu compilers
  - New URL


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-56
changelog:
  - Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
    of zero byte
  - Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
  - Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
    smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-56.4
changelog:
  - Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
    with mod_rewrite and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-62
changelog:
  - Resolves: #2221083 - Apache Bug 57087: mod_proxy_fcgi doesn't send cgi 
    CONTENT_LENGTH variable when the client request used Transfer-Encoding:chunked


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.1
changelog:
  - Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue
    in mod_rewrite (CVE-2024-38474)
  - Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding problem in
    mod_proxy (CVE-2024-38473)
  - Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output
    in mod_rewrite (CVE-2024-38475)
  - Resolves: RHEL-45758 - httpd:2.4/httpd: null pointer dereference
    in mod_proxy (CVE-2024-38477)
  - Resolves: RHEL-45743 - httpd:2.4/httpd: Potential SSRF
    in mod_rewrite (CVE-2024-39573)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.2
changelog:
  - Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend
    applications whose response headers are malicious or exploitable (CVE-2024-38476)
  - Resolves: RHEL-53022 - Regression introduced by CVE-2024-38474 fix


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.3
changelog:
  - Resolves: RHEL-56068 - Apache HTTPD no longer parse PHP files with
    unicode characters in the name


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.5
changelog:
  - Resolves: RHEL-99944 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade
  - Resolves: RHEL-99969 - CVE-2024-47252 httpd: insufficient escaping of
    user-supplied data in mod_ssl
  - Resolves: RHEL-99961 - CVE-2025-23048 httpd: access control bypass by trusted
    clients is possible using TLS 1.3 session resumption


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.6
changelog:
  - Resolves: RHEL-127073 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.7
changelog:
  - Resolves: RHEL-135054 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
    via AllowOverride FileInfo (CVE-2025-66200)
  - Resolves: RHEL-135039 - httpd: Apache HTTP Server: CGI environment variable
    override (CVE-2025-65082)
  - Resolves: RHEL-134471 - httpd: Apache HTTP Server: Server Side Includes adds
    query string to #exec cmd=... (CVE-2025-58098)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.8
changelog:
  - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server mod_proxy_ajp:
    Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)
  - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointer dereference can
    cause a child process crash (CVE-2026-33007)
  - Resolves: RHEL-175088 - httpd:2.4/httpd: off-by-one out-of-bounds reads
    in AJP getter functions (CVE-2026-33857)
  - Resolves: RHEL-175620 - httpd:2.4/httpd: NULL pointer dereference via
    specially crafted request (CVE-2026-29169)
  - Resolves: RHEL-175055 - httpd: heap-based buffer over-read and memory
    disclosure in ajp_parse_data() (CVE-2026-34059)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.9
changelog:
  - Resolves: RHEL-186198 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
    via untrusted content in mod_xml2enc (CVE-2026-42536)
  - Resolves: RHEL-186166 - httpd: Apache HTTP Server: Buffer Over-read via
    outbound OCSP requests to attacker-controlled server (CVE-2026-44185)
  - Resolves: RHEL-175620 - httpd:2.4/httpd: NULL pointer dereference via
    specially crafted request (CVE-2026-29169)
  - Resolves: RHEL-186176 - httpd: Apache HTTP Server: Buffer overflow in
    mod_proxy_html allows security bypass (CVE-2026-34355)
  - Resolves: RHEL-192751 - mod_proxy_html regression in CVE-2026-34355 fix
  - Resolves: RHEL-193114 - httpd: Apache HTTP Server: Denial of Service
    in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186)
  - Resolves: RHEL-186219 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
    via malicious backend servers (CVE-2026-34356)
  - Resolves: RHEL-191243 - httpd: Apache HTTP Server: Out-of-bounds Read in
    mod_headers and mod_mime (CVE-2026-43951)
  - Resolves: RHEL-184307 - httpd: Apache HTTP Server: Denial of Service via
    crafted regular expressions (CVE-2026-44631)
  - Resolves: RHEL-182577 - httpd: incomplete fix
    for CVE-2023-38709 (CVE-2024-42516)


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.4.7.01.1
changelog:
  - Owesome! Httpd 2.4.7 pushed. It shoud not require any hack anymore.
  - Major update to 2.4.7-01.
  - Apache from 2.4 version have modularity structure, so many changes:
  	- Mpm may be build without apache source tree!
  	- Exclude apache sources, turn mpm-itk tarball into regular source0.
  	- So drop all black magic!
  	- Instal it as module, retire separate systemd service files and related stuff.
  	- Rewrite README.Fedora.


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.4.7.01-5
changelog:
  - Fix build issue on EL7 (rhbz# 1188159). Big thanks to Athmane Madjoudj <athmane@fedoraproject.org> for the work.


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.4.7.04-1
changelog:
  - Update to version 2.4.7-04 to solve problem https://lists.err.no/pipermail/mpm-itk/2015-September/000925.html. By mail request of Marco Matarazzo.


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 10.00.15-1.cloudlinux
changelog:
  - CLKRN-639: added a script to collect data from clients' servers after a panic occurred
  - CLKRN-681: update to 10.00.9-1.cloudlinux
  - CLKRN-620: added netconsole config detailed description, corrected spec
  - CLKRN-620: added ptr for sentry server's ip (77.79.198.28)
  - Add optional 'dev' keyword
  - CLKRN-595: added logs reporting on a kernel crashing event


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 10.00.15-1.cloudlinux.2
changelog:
  - CLKRN-796: added needed dependency for scriptlets
  - CLKRN-785: improved parsing vmcore-dmesg.txt by cloudlinux-collect-panic-info script
  - CLKRN-786: deleted all debug output to prevent crontab email notifications


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 10.00.15-1.cloudlinux.5
changelog:
  - CLKRN-901: added client_id & system_id to the sent info on our KPR by rtulchii
  - CLKRN-914: redirect error output to /dev/null by rtulchii
  - CLKRN-880: organized return codes by rtulchii


author: Jan Macku <jamacku@redhat.com> - 10.00.16-1
changelog:
  - rename_device: also support dracut-style kernel cmdline configuration
  - ifup-routes: Log when using `ip $type replace`
  - ifup-routes: Use `ip route repace` to avoid race


author: Jan Macku <jamacku@redhat.com> - 10.00.17-1
changelog:
  - ifup-routes: Revert quotes
  - ifup-routes: Use `ip replace` only on type `route`
  - ci: introduce GA ci from master to rhel8-branch
  - ci: Setup packit for RHEL8 branch
  - ci: Get rid of old ci files (travis and zanata)


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1:10.00.19-1.cloudlinux.1
changelog:
  - CLKRN-1004: added needed dependencies for cloudlinux-collect-panic-info script
  - CLKRN-901: added client_id & system_id to the sent info on our KPR by rtulchii
  - CLKRN-914: redirect error output to /dev/null by rtulchii
  - CLKRN-880: organized return codes by rtulchii
  - CLKRN-866: fixed tmp directory usage by users
  - CLKRN-796: added needed dependency for scriptlets
  - CLKRN-785: improved parsing vmcore-dmesg.txt by cloudlinux-collect-panic-info
    script
  - CLKRN-786: deleted all debug output to prevent crontab email notifications
  - CLKRN-772: fixed /usr/sbin/cloudlinux-collect-panic-info erasing  filesystem
  - CLKRN-639: added a script to collect data from clients' servers after a panic
    occurred
  - CLKRN-681: update to 10.00.9-1.cloudlinux
  - CLKRN-620: added netconsole config detailed description, corrected spec
  - CLKRN-620: added ptr for sentry server's ip (77.79.198.28)
  - Add optional 'dev' keyword
  - CLKRN-595: added logs reporting on a kernel crashing event


author: gil cattaneo <puntogil@libero.it> - 1.5.2-4
changelog:
  - Fix FTBFS RHBZ#1239598
  - Fix BR list
  - Use BR mvn()-like
  - Fix some rpmlint problem
  - Introduce license macro
  - Adapt to current guideline


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 5.0.1-5
changelog:
  - Actually, specify pagesizes according to arches, closes #1545539
  - Remove patch disabling thp as this is now handled by configure, see
    upstream issue 526


author: Florian Festi <ffesti@redhat.com> - 123-1
changelog:
  - Update kmod.prov for better performance (#1794491)
  - Backport performance improvements for brp-mangle-shebangs (#1794779)


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: Anatoly Stepanov <astepanov@cloudlinux.com> - 25-19.cloudlinux
changelog:
  - KMODLVE-464: depmod: resolve different sub-dir lengths issue
  - CLKRN-819: improved prioritizing with modules sharing the same name
  - bump epoch


author: Anton Mikaiev <amikaiev@cloudlinux.com> - 2.1-16
changelog:
  - CLKRN-1176: added patch to fix ttypushback vulnerability
  - CLKRN-1195: bumped kernel version for building (cl8) for debug kernel compatibility
  - CLKRN-1093: allow freezable sleep in kmodlve


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-17
changelog:
  - CLKRN-1210: make new page cache accounting default for new installations
  - CLKRN-1089: do not account page cache memory in lve stats output


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-18
changelog:
  - CLKRN-1371: fixed kernel.proc_disable_net & introduced kernel.proc_disable_net2
  - CLKRN-1386: adapt kmodlve building with FEAT_LINK_PROT == 0


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-19
changelog:
  - KMODLVE-600: iolimits events support for CL8/9
  - KMODLVE-601: tag get/put events support
  - CLKRN-1406: revert some changes related to prod_net_disable2 - made the behaviour obliged
  - CLKRN-1355: symlink owner protection fixes for CL9
  - CLKRN-1399: improved fs.protected_symlinks_create option to close the SecureLink creating vulnerability


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-22
changelog:
  - CLKRN-1455: change kernel (cl9) building version for 5.14.0-362.13.1.el9_3
  - CLKRN-1203: switch back to using rh_reserved for tag links
  - CLKRN-1439: reduce warnings from external cgroup moves


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-24
changelog:
  - CLKRN-1488: rework security_* hooks
  - CLOS-2484: suppress the warning for nonexistent 90-cloudlinux.conf in the script


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-26
changelog:
  - CLKRN-1546: always block cgroup move in a multithreaded app
  - CLKRN-1547: stringify more lve_enter flags
  - CLKRN-1541: do not kill unkillable tasks from de_thread()
  - CLKRN-1542: do not allow to interrupt lve_unlink()
  - CLKRN-1457: fixed XFS_QMOPT_FORCE_RES for cl9 kernels


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-28
changelog:
  - CLKRN-1559: check if the ptr is invalid in lve_do_renameat2_trace hook
  - CLKRN-1566: improved restrictions on accessing another mnt ns


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-32
changelog:
  - CLKRN-1606: call missing putname within SP
  - CLKRN-1447: adapted minor log for moving tasks outside of LVEs


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-37
changelog:
  - CLKRN-1698: disable write access to process memory via procfs
  - CLKRN-1688: CL9.5 kernel support
  - CLKRN-1685: implement iolimits for LVP


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-38
changelog:
  - CLKRN-1701: implement namespace check in __ptrace_may_access
  - CLKRN-1696: a switch to disable page cache accounting in lve pmem


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-41
changelog:
  - CLKRN-1717: enable lve_pmem_nocache by default
  - CLKRN-1716: adapted SP hooks variants for Ubuntu 22
  - CLKRN-1715: adapt datacycle hook for Ubuntu 22
  - CLKRN-1715: adapted XFS quota flag for Ubuntu 22 kernel (5.15.0)


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-53
changelog:
  - CLKRN-1910: disable unused ftrace hooks
  - CLKRN-2000: use fput_async if available and doesn't bug_on on non-kernel threads


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-56
changelog:
  - CLKRN-1818: cgroups v2 support for CL10 (new lve_cgroupv2 parameter)
  - CLKRN-1820: implement enter/leave for cgroups v2
  - CLKRN-1821: cpu limit/weight & usage support for cgroups v2
  - CLKRN-1822: cpu stats reset and throttled_time stat for cgroups v2
  - CLKRN-1823: implement memory limits with cgroups v2
  - CLKRN-1824: implement memory usage for cgroups v2
  - CLKRN-1826: implement nproc limit & usage for cgroups v2
  - CLKRN-1831: implement NOUB enter and account/reset NOUB cgroup cpu usage for cgroups v2
  - CLKRN-1851: allow symlink creation outside of lve namespaces
  - CLKRN-1871: do not OOM when reducing PMEM limit in LVP
  - CLKRN-1876: configure cgroup.subtree_control with cgroups v2
  - CLKRN-1878: optimize code with cgroups v2 support
  - CLKRN-1882: subtree_control should be enabled for LVP, not LVE
  - CLKRN-1884: load average support for cgroups v2
  - CLKRN-1909: do not allow to rmdir lve/lvp dirs with cgroups v2
  - CLKRN-1916: split CPU limit between full and noub lves
  - CLKRN-1924: recalc cpu limits after shares changes
  - CLKRN-1925: a fix for racer
  - CLKRN-1930: noub init should happen after root lvp init
  - CLKRN-1933: wrong lve ns check in symlink create hook
  - CLKRN-1939: not enough permissions to enter LVE fix
  - CLKRN-1941: carefully move process to the thread root
  - CLKRN-1948: set memory.swap.max to 0 to replicate swappiness=0 from v1
  - CLKRN-1964: fixed passing incorrect string size
  - CLKRN-1990: fixed build errors for CL8 platform
  - CLKRN-2017: added a hack for attaching noub threads to cgroup v2 cpu controller
  - CLKRN-2027: initial solution for CPU limit balancer
  - CLKRN-2035: build kmod-lve-lts fixes for CL8/CL9 LTS kernels
  - CLKRN-2044: build fixes for Ubuntu22 and CL8/9-LTS / CL8/7h, disable cgroup v2 for production


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-57
changelog:
  - CLKRN-2060: fixed noub_legacy mode to not underlimit the main cpu group
  - CLKRN-2066: fixed LVE cpu stats for a cgroups v2 hack mode
  - CLKRN-2067: improve load balancing
  - CLKRN-2075: symmetrical lve/noub hierarchy
  - CLKRN-2078: cgv2: clamp each noub quota share to kernel minimum
  - CLKRN-2083: fixed cpu weight setting for cgroups v2 case
  - CLKRN-2088: added +cpu to root cgroup subtree_control on lve init
  - CLKRN-2089: bump kmod_kernel_version to 553.111.1 for CL7h and CL8
  - CLKRN-2091: performance statistics for the cgv2 rebalancer
  - CLKRN-2045: added a couple of counters to catch heavy rebalancing code paths


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-59
changelog:
  - CLKRN-2103: cgv2: leave path to target cgroup root, not /lvub
    (fixes __lve_leave: failed to pop cpu context, rc=-16 EBUSY)


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-60
changelog:
  - CLKRN-2105: dead-code cleanup
  - CLKRN-2101: defer child insertion into parent->lvp_children until init done
  - CLKRN-1954: fix a bug in symlink protection
  - CLKRN-2115: added missing error check
  - CLKRN-2115: add missing pointer check
  - CLKRN-2108: order os_lvp_fini() before list_del_init() in lvp_fini()
  - CLKRN-2108: allow module-internal cgroup rmdir outside lve_init thread
  - CLKRN-2111: propagate NET accounting up the full LVP parent chain
  - CLKRN-2112: simplify defaults_start()
  - CLKRN-2113: drop LVE_DEBUG build option; make LVE_DEBUG_CGROUP_BREAK unconditional
  - CLKRN-2115: cleanup: fix error handling in lve_usage_write


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-62
changelog:
  - bump kmod_kernel_version to 6.12.0-211.7.3.el10_2 for AlmaLinux 10.2
  - bump kmod_kernel_version to 5.14.0-687.5.3.el9_8 for AlmaLinux 9.8


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-73
changelog:
  - CLKRN-2197: apply owner check in the symlink readlink hook
  - Remove LVE_PER_VE (OpenVZ per-VE) support


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-61
changelog:
  - bump kmod_kernel_version to 6.12.0-211.7.3.el10_2 for AlmaLinux 10.2
  - bump kmod_kernel_version to 5.14.0-687.5.3.el9_8 for AlmaLinux 9.8
  - CLKRN-1954: fix symlink protection edge case
  - internal cleanup and robustness improvements


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-93
changelog:
  - CLOS-1655: Add CRIU support for CL9 and CL10
  - CLOS-4290: Minor fixes in request parsing and configuration scripts


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-95
changelog:
  - MAXWS-1086: Link liblscapi against the renamed criu-lve (libcriu-lve)
  - MAXWS-1084: liblsapi: export lscapi_compose_request as a public API
  - MAXWS-1074: Improve own-log-path file handling in the lsphp spawner
  - MAXWS-1075: Input-handling and file-permission fixes in liblscapi and management scripts
  - MAXWS-1085: Input-validation and error-handling fixes in request/response parsing and management scripts


changelog: - Initial libmaxcache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> - 1.0.0-1


author: Sergey Kokhan <skokhan@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.0.1-1
changelog:
  - Add libmaxcache-configd subpackage - configuration daemon for
    dynamic NGINX configuration via shared memory
  - Add Sentry error reporting to maxcache-configd


author: Sergey Kokhan <skokhan@cloudlinux.com> - 1.0.2-1
changelog:
  - Add maxcache-htcache-watchd subpackage (fanotify-based cache invalidation daemon)
  - Rename libmaxcache-configd into maxcache-nginx-configd


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.0.3-1
changelog:
  - MAXWS-1030: Security hardening of maxcache-nginx-configd socket daemon
  - MAXWS-1029: Fix domain wipe on daily rescan for non-standard docroot paths


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.1.0-1
changelog:
  - MAXWS-1050: Cache all alias/sub domains at a shared docroot.
  - MAXWS-1049: Auto-heal missing SHM file on periodic healthcheck.
  - MAXWS-1043: Remove htcache-watchd daemon; htcache uses stat() polling only
  - MAXWS-1042: Rename htcache_engine.h to htaccess_engine.h


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.0-1
changelog:
  - MAXWS-1064: Emit Vary header on cache hits when gzip or SSL variants are active; honor X-Forwarded-Proto only when explicitly trusted; bound device-detection regex matches.
  - MAXWS-1053: Improved correctness in cache-path construction and .htaccess directive merge; dynamic-array scaling for large <Directory> configurations.
  - MAXWS-1046: Match mandatory cookie names exactly (was substring); cap User-Agent version-digit parsing; assorted edge-case correctness fixes.


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.1-1
changelog:
  - MAXWS-1089: Make the htaccess engine lock robust so a crashed worker can't hang Apache.
  - MAXWS-1028: Fix .htaccess caching when the edition cannot be detected.
  - MAXWS-1078: Fix dynamic-cookie and query-string suffix length handling.


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.2-1
changelog:
  - MAXWS-1095: Fix lsphp segfaults from .htaccess php_value/php_flag handling in the maxcache htaccess cache.
  - MAXWS-1091: Bump maxcache-nginx-configd Python dependencies (PyYAML, pygments).


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.3-1
changelog:
  - MAXWS-1096: Fix PATH_INFO handling in the .htaccess cache (front-controller internal-redirect loop).


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.4-1
changelog:
  - CLOS-5744: fix Apache-worker SIGSEGV on Passenger vhosts.
  - MAXWS-1088: align cache-path construction with the AccelerateWP plugin so cached pages are matched and served correctly, including per-user isolation for logged-in visitors and consistent query-string and long-filename handling.


author: Paul Howarth <paul@city-fan.org> - 1.8.0-1
changelog:
  - Update to 1.8.0
    - Added a basic dockerised test suite
    - crypto: Add support for the mbedTLS backend
    - See RELEASE-NOTES for details of bug fixes


author: Paul Howarth <paul@city-fan.org> - 1.8.0-5
changelog:
  - scp: Do not NUL-terminate the command for remote exec (#1489736, GH#208)
  - Make devel package dependency on main package arch-specific
  - Drop EL-5 support
    - noarch sub-packages always available now
    - Drop legacy Group: and BuildRoot: tags
    - Drop explicit buildroot cleaning
    - %{__isa_bits} always defined now


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-7.el8_0.1
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Danilo de Paula <ddepaula@redhat.com> - 1.8.0-8.1
changelog:
  - Rebuild all virt packages to fix RHEL's upgrade path
  - Resolves: rhbz#1696354
    (Ensure modular RPM upgrade path [ZStream Clone] [rhel-8.0.0.z])


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - drop dependency on zlib-devel and bzip2-devel no more
    referenced in libzip.pc
  - drop rpath patch merged upstream


author: Remi Collet <rcollet@redhat.com> - 1.5.2-1
changelog:
  - update to 1.5.2
  - add all explicit cmake options to ensure openssl is used
    even in local build with other lilbraries available


author: Tim Niemueller <tim@niemueller.de> - 5.1.4-7
changelog:
  - Add patch to from lua.org with smaller bugfixes
  - sed -i -e 's/5\.1\.3/5.1.4/g' on autotoolize patch, bug #641144


author:
  Vladimir Lebedev <vlebedev@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com> 4.2.2-1

changelog:
  - CLOS-2190: Implement infrastructure for the experimental LVE feature ‘Automatic Limit Overrides’, currently unavailable for public testing


author:
  Vladimir Lebedev <vlebedev@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com> 4.2.3-1

changelog:
  - CLOS-2107: Prevent the lvestats service from failing when encountering unexpected Input/Output errors
  - CLOS-2102: Update DB cleanup and maintenance infrastructure for the experimental ‘Automatic Limit Overrides’ LVE feature


author: Vladimir Lebedev <vlebedev@cloudlinux.com> 4.2.4-1
changelog:
  - CLOS-2188: Optimise CPU and RAM usage for the experimental 'Automatic Limit Overrides' LVE feature


author: Dmitry Shibut <dshibut@cloudlinux.com> 4.2.9-1
changelog:
  - CLOS-3047: Suppress warning when executing lvechart utility with the latest alt-ImageMagick installed


author:
  Tamar Tsotniashvili <ttsotniashvili@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 4.2.11-1

changelog:
  - CLOS-3005: Shorten warning logs when MySQL query snapshots cannot be created while MySQL is not running, add an option to disable MySQL snapshots
  - CLOS-3143: Modify lveps argument list to ensure correct behavior


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Georgy Lepsaya <glepsaya@cloudlinux.com> 4.2.14-2

changelog:
  - CLOS-3864: Fix a typo in the lve-stats changelog
  - CLOS-3870: Fix lost bursting history events in lve-bursting-info


author:
  Ilya Kartavtcev <ikartavtcev@cloudlinux.com>, Aleksey Petryankin <apetryankin@cloudlinux.com> 4.1.21-1

changelog:
  - LVES-1085: Fix uncaught exception (BrokenPipeError or EOFError) during lvestats.service stop or restart
  - LVES-1083: Fix lines with duplicated timestamps in cloudlinux-statistics output


author: Dmitry Shibut <dshibut@cloudlinux.com> 4.1.22-1
changelog:
  - LU-3595: Muted error on process termination during lvestats-server stop if process is already dead


author:
  Aleksey Petryankin <apetryankin@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com>, Ilya Kartavtcev <ikartavtcev@cloudlinux.com> 4.1.23-1

changelog:
  - LVES-1087: Detect root user coorectly when multiple users with uid 0 exist
  - LVES-1093: Fix mysql error "Expression #3 of SELECT list is not in GROUP BY clause"
  - LVES-1092: Extend logging when len(lve_results) != len(gov_results)
  - Fix cl9 dependency, bump release version


author:
  Dmitry Shibut <dshibut@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com> 4.2.1-1

changelog:
  - CLOS-1952: Fix MySQL localhost connection issues when using sockets
  - CLOS-1947: Fix lvechart Numpy float conversions when generating a time frame output
  - CLOS-1858: Log details of SQL INTEGER overflow errors when incoming LVE usage stats values are too large


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 4.3.2-1
changelog:
  - CLOS-4011: Record reseller end-users' faults (non-CPU) accurately
  - CLOS-4062: Fix LiteSpeed snapshot HTTP queries and SHOW FULL PROCESSLIST UnicodeDecodeError
  - CLOS-4277: Bugfixes
  - CLOS-4380: Fix mysql probe race causing false-positive auth detection
  - CLOS-4385: Grant lvestat table-level access to alembic_version and stop masking partial-schema upgrade bug in CI


author: Roman Prilipskii <rprilipskii@cloudlinux.com> 5.0.4-1
changelog:
  - CLOS-4253: Reset unsupported SQLite WAL journal mode to DELETE on daemon startup
  - CLOS-4253: Set SQLite busy_timeout explicitly to 5000 ms
  - CLOS-4636: Fix HTML formatting in admin/reseller email templates


author: CloudLinux <packager@cloudlinux.com> - 5.0.1-1
changelog:
  - CLOS-4011: Record reseller end-users' faults (non-CPU) accurately
  - CLOS-4165: Add Sentry error reporting to lvestats-server and fix INT4/INT8 type mismatch in PostgreSQL scalar queries
  - CLOS-4368: Fix update server ID on fresh system installation


author: CloudLinux <packager@cloudlinux.com> - 5.0.2-1
changelog:
  - CLOS-4390: Filter phantom isolation entries from collector output
  - CLOS-4416: Port LiteSpeed HTTP-first probing, htpasswd-hash compatibility, and processlist UnicodeDecode fixes from lve-stats


author: CloudLinux <packager@cloudlinux.com> - 5.0.5-1
changelog:
  - CLOS-4557: Internal bugfixes in DbGovSaver history plugin
  - CLOS-4553: Internal improvement to error logging and reporting


author: CloudLinux <packager@cloudlinux.com> - 5.0.6-1
changelog:
  - CLOS-4628: Restore --show-columns and v2 usage columns in lveinfo
  - CLOS-4582: Internal bugfixes and improvements into multiple lve-stats components


author: CloudLinux <packager@cloudlinux.com> - 5.0.7-1
changelog:
  - CLOS-4675: Fix lveinfo over-reporting averaged CPU/memory/IO usage over longer periods
  - CLOS-4640: Restore the DB Governor usage overlay
  - CLOS-4639: Fix per-minute LVE resource usage statistics not being recorded
  - CLOS-4636: Honor per-reseller fault-notification settings in StatsNotifier


author: CloudLinux <packager@cloudlinux.com> - 5.0.9-1
changelog:
  - CLOS-4708: Fix database corruption and schema-handling bugs
  - CLOS-4707: Restore opt-in defaults for optional collector and saver plugins
  - CLOS-4701: Fix admin fault-notification email content
  - CLOS-4501: Fix portable aggregate averaging across MySQL and MariaDB
  - CLOS-4630: Internal bugfixes across multiple lve-stats components


author: CloudLinux <packager@cloudlinux.com> - 5.0.10-1
changelog:
  - CLOS-4845: Fix cloudlinux-top reporting N/A domain/reseller and truncated large process lists
  - CLOS-4740: Add sendmail fallback for fault-notification email delivery
  - CLOS-4739: Restore lveinfo --by-fault and --by-usage column aliases
  - CLOS-4733: Automatically recover from missing database tables
  - CLOS-4708: Throttle repeated plugin errors to reduce error-report noise
  - CLOS-4630: Internal bugfixes across multiple lve-stats components


author: CloudLinux <packager@cloudlinux.com> - 5.0.11-1
changelog:
  - CLOS-5747: Fix lveinfo/statistics reporting zero fault counts on MySQL
  - CLOS-5723: Exclude reserved/internal LVE IDs from admin fault-notification emails
  - CLOS-5721: Deliver fault notifications to all addresses in multi-address contact emails
  - CLOS-5720: Honor the per-user fault-notification opt-out setting
  - CLOS-4630,CLOS-5246: Internal bugfixes across multiple lve-stats components


author: CloudLinux <packager@cloudlinux.com> - 5.0.12-1
changelog:
  - CLOS-5781: Fix I/O usage unit shown incorrectly in cPanel
  - CLOS-5818: Fix StatsNotifier fault notifications failing on MySQL/MariaDB backends
  - CLOS-5819: Fix Python collector plugins failing to run after a plugin-runner restart
  - CLOS-5820: Fix StatsNotifier customer emails not delivered for multi-address sender addresses
  - CLOS-5822: Fix StatsNotifier customer notifications skipped on panels storing users in sys_users (e.g. Plesk)
  - CLOS-5246: Internal bugfixes across multiple lve-stats components


author: CloudLinux <packager@cloudlinux.com> - 5.0.13-1
changelog:
  - CLOS-6785: Stop logging misleading "Failed to create index" warnings on install and upgrade
  - CLOS-6010: Internal bugfixes across multiple lve-stats components


author: CloudLinux <packager@cloudlinux.com> - 5.0.14-1
changelog:
  - CLOS-6781: Fix missing tooltips on Current Usage charts in LVE Manager
  - CLOS-6808: Fix statistics silently not collected on an invalid database path
  - CLOS-4472: Fix false dbtop logging for MySQL Governor


author: Grigory Ponomarenko <gponomarenko@cloudlinux.com> 6.6.1-2
changelog:
  - CLOS-2499: Fix Unknown status for package mod_hostinglimits error after Unification release
  - CLOS-2500: Fix cloudlinux-customizer incorrectly retrieving list of packages after Unification release


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com> 6.6.3-1

changelog:
  - CLPRO-1924: Do not install SmartAdvice MU plugin and do not send notifications after automatic enabling AccelerateWP of new servers
  - CLPRO-1928: Added Smart Advice plugin installation metric to statistics
  - CLOS-2417: Monitor CentOS 7 to CloudLinux 8 conversions in statistics
  - CLOS-2355: Make LVE support transition from Shared/Admin to Solo


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 6.6.4-1

changelog:
  - CLPRO-1873: Internal refactoring: simplify code which detects supported features
  - CLOS-2558: Fix comparsion TypeError in clsummary license check
  - CLPRO-1899: Add WP2 detection to statistics


author:
  Dmitry Shibut <dshibut@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com>, Redouane Elkaboussi <relkaboussi@cloudlinux.com> 6.6.5-1

changelog:
  - CLOS-1860: Complete migration to Python 3.11
  - CLOS-2577: Enhance cagefsctl and lvectl logging
  - CLOS-2508: Fix the issue where packages without a reseller aren't removed from /etc/container/ve.cfg


author:
  Grigory Ponomarenko <gponomarenko@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com>, Anastasiia Lutsiuk <alutsiuk@cloudlinux.com> 6.6.6-1

changelog:
  - CLOS-2374: Adapt cl-quota/cloudlinux-limits to work on NO-LVE environment
  - CLOS-2312: Correct cPanel "default" plan always switching to the root user inode limits
  - CLOS-2649: Adapt the panel setup process detection for new versions of DA
  - CLPRO-2008: Do not trigger CL edition transition logic if the edition does not change


author:
  Vladimir Lebedev <vlebedev@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com> 6.6.7-1

changelog:
  - CLOS-2576: Modify the lvectl algorithm to mitigate the impact of LVEs being reset to default limits
  - CLOS-2467: Gather the users_with_faults statistic on platforms that support LVE, not RESELLER_LIMITS
  - CLOS-2616: Set user.max_user_namespaces=0 for new installations by default


author: Dmitry Shibut <dshibut@cloudlinux.com>, Mykola Ishchenko <mishchenko@cloudlinux.com> 6.6.8-1
changelog:
  - CLOS-2714: Fix the lvestats service remaining disabled after converting from CL 9 Solo to Shared edition
  - CLOS-2585: Fix the license not being properly updated on CL Solo


author: Roman Prilipskii <rprilipskii@cloudlinux.com> 6.6.9-1
changelog:
  - CLOS-2765: Remove mentions of specific hosting providers from cldiag logging
  - CLOS-2822: Add the CL9 static DB binary path into the db_info_lib library


author:
  Marieta Harutyunyan <mharutyunyan@cloudlinux.com>, Dzmitry Ryzhykau <dryzhykau@cloudlinux.com> 6.6.13-1

changelog:
  - CLOS-2901: Add a new forced-space flag to lveps to ensure correct parsing of the output
  - CLOS-2865: Print an error message if cloudlinux-edition-watcher cannot determine the current edition


author: Dzmitry Ryzhykau <dryzhykau@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 6.6.14-1
changelog:
  - CLOS-3052: Use rhn-client-tools scripts for license management on Ubuntu. Remove placeholder scripts.
  - CLOS-2083: Adapt clwizard and clsummary to handle Ubuntu versions


author:
  Dmitry Shibut <dshibut@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 6.6.15-1

changelog:
  - CLOS-3105: Adapt cloudlinux-customizer to function on Ubuntu
  - CLOS-3123: Update LSAPI Wizard module to correctly resolve package names on Ubuntu
  - CLPRO-2527: Fix cloudlinux-summary WordPress statistics collection


author: alutsiuk <alutsiuk@cloudlinux.com> 6.6.18-1
changelog:
  - CLPRO-2688: Prevent error "lsof: status error on /dev/lve: No such file or directory" while edition transition


author:
  mvoina <mvoina@cloudlinux.com>, nkeshelava <nkeshelava@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 6.6.20-1

changelog:
  - CLOS-2370: Update get_users_amount_per_plan to handle invalid package names and prevent TypeError during sorting
  - CLOS-3483: Install alt-php meta-packages on Ubuntu when installing PHP via CL Wizard
  - CLOS-3110: Fix redundant package manager preparation in CL Wizard
  - CLOS-3303: Spread the load of 5-minute cron jobs to prevent resource usage spikes
  - CLOS-3542: Add additional verifications to Elevate-related statistics


author: Roman Prilipskii <oshyshatskyi@cloudlinux.com> 6.6.28-1
changelog:
  - CLOS-3998: Add lvectl allow/deny/enable/disable-domain-limits commands
  - CLOS-4005: Remove check_cagefs_mount_points_exists from the list of cron checkers in cldiag


author:
  Roman Prilipskii <rprilipskii@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 6.6.29-1

changelog:
  - CLOS-3320: Add clsummary telemetry for cGroups in LVE
  - CLOS-4025, CLOS-4026, CLOS-4027, CLOS-4031: Isolation bugfixes and improvements


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 6.6.30-1
changelog:
  - CLOS-4129: Apply security hardening across multiple lve-utils components
  - CLOS-4105: Adapt cldiag centralized-monitoring checker to updated lve-stats service


author: alutsiuk <alutsiuk@cloudlinux.com> 6.6.31-2
changelog:
  - CLOS-4370: Stop lvectl apply all from aborting on stale isolation markers
  - CLOS-4370: Handle disk quota when loading lve config


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 6.6.32-1
changelog:
  - CLOS-4275: Bugfixes
  - CLOS-4057: Reduce edition watcher log verbosity and add log rotation
  - CLOS-3140, CLOS-4341: Statistics improvements
  - CLOS-4060: Skip lve_setup for default-limit domains on lvectl apply all
  - CLOS-4402: Register proxyexec helpers


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 6.6.33-1
changelog:
  - CLOS-4390: Filter phantom isolation entries from lvectl list-reseller
  - CLOS-4419: Make lvectl remove-reseller idempotent for orphan and clean states


changelog: - CLOS-4513: Stop lvectl destroy from aborting on cascaded per-user isolation LVPs
author:
  Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 6.6.34-1


changelog: - CLOS-4542: Fix LVE limits applying after reboot for isolated users
author:
  Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 6.6.35-1


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 6.6.38-1
changelog:
  - CLOS-4609: Preserve custom LVE limits for allow-only isolated users
  - CLOS-5716: Fix reseller LVE limits not being enforced after update
  - CLOS-4594, CLOS-5353, CLOS-5354, CLOS-5355: Internal bugfixes across multiple lve-utils components


author: alutsiuk <alutsiuk@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com> 6.5.11-1
changelog:
  - CLPRO-1585: Add ability to activate AccelerateWP Premium from Centralized Monitoring
  - CLOS-1996: Adapt CL Solo / CL Admin to work on Virtuozzo


author: alutsiuk <alutsiuk@cloudlinux.com>, Danila Vershinin <dvershinin@cloudlinux.com> 6.5.12-1
changelog:
  - AP2NGX-73: Implement metric to see which handlers are not supported by Apache2Nginx
  - CLPRO-1676: Add ability to edit AccelerateWP upgrade url via Centralized Monitoring


author: Roman Krompets <rkrompets@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> 6.5.14-1
changelog:
  - CLPRO-1748: Modified cloudlinux-license to accept "edition" while getting trial license
  - CLPRO-1687: Added per user wordpress metrics


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com> 6.6.1-1

changelog:
  - CLOS-2352, CLOS-2353, CLOS-2411, CLOS-2435, CLPRO-1529, CLPRO-1703, CLPRO-1813, CLPRO-1886: Add CloudLinux edition migration support


author: Aleksey Zverev <azverev@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 0.7.2-1
changelog:
  - LVEW-23: Add new flags
  - LU-2298: Check spelling and correctness CL licenses in all files of Userspace projects


changelog:
  - LVEMAN-1757: stop nodejs/python in web panel
  - BuildRequires: liblve >= 2.1-2

author:
  Anton Volkov <avolkov@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, ikartavtcev <ikartavtcev@cloudlinux.com> 0.7.3-2


author: Roman Prilipskii <rprilipskii@cloudlinux.com> 0.7.14-1
changelog:
  - CLOS-4125, CLOS-4278: assorted internal bugfixes in the cagefs entry and LVE
    shell wrappers
  - CLOS-4278: log cage entry and LVE resource events to syslog
  - CLOS-4366: cagefs_enter_user: fix LVE context handling
  - CLOS-4583: assorted internal bugfixes (cagefs entry wrappers, Perl LVE bindings, packaging)
  - CLOS-4660: coerce --no-cpu-limit to a full LVE limit release on cgroup v2
  - CLOS-5830: cagefs_enter: silence stderr on the proxied end-user path (fixes LVE Manager Resource Usage 503)


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 0.7.15-1
changelog:
  - CLOS-4660: fix cagefs_enter_user --no-cpu-limit combined with temporary
    LVE options on cgroup v2


author: Roman Krompets <rkrompets@cloudlinux.com> 7.10.7-1
changelog:
  - Replaced @sentry/browser with @sentry/angular (CLPRO-1337)
  - Refactored code related to Hide/Show features in UI (CLPRO-1329)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.10.8-1
changelog:
  - Adapted AccelerateWP UI to DirectAdmin (CLPRO-1397)
  - Created screen in CL Manager to promote enabling AccelerateWP (CLPRO-1363)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.10.9-1
changelog:
  - Adapted test environment to run Governor-related tests on ubuntu (CLPRO-1485)
  - Fixed an issue with access to end-user plugins on cPanel while login as a team user (CLPRO-1498)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.10.10-1
changelog:
  - Disabled warnings timeout in UI to prevent customer missed important information (CLPRO-1575)
  - Fixed an error with pam_limits that was causing Out-Of-Memory errors in Nodejs selector (CLOS-2239)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.0-1
changelog:
  - Added "--migrate-silently" flag whenever we run rhnreg_ks without TTY (CLPRO-1886)
  - Unified UI to to rid of differences of how supported features work depending on CloudLinux Edition (CLPRO-1411, CLPRO-1532)
  - Unified the explanatory text, links and banners across all CloudLinux Editions (CLPRO-1410)
  - Unified page shown when customer hitting max account limit for Edition (CLPRO-1607)
  - Unified MySQL Governor (CLPRO-1632)
  - Added the ability to get the trial CloudLinux license for all editions (CLPRO-1633)
  - Adapted end-user's "Resource usage" plugin for non-lve environment (CLPRO-1722)
  - Rollback "Actions" column in users table and disabled actions if no limits to change (CLPRO-1750)
  - Added ability to hide total resource capacity and show only percentage in end-users plugin (CLPRO-1684)
  - Implemented UI improvements in CloudLinux Manager Users tab (CLPRO-1825)
  - Unified Website Monitoring (SSA, WMT) UI (CLPRO-1724)
  - Removed form for getting the trial license from CloudLinux Manager UI (CLPRO-1835)


author: Vladimir Lebedev <vlebedev@cloudlinux.com>, Timur Averianov <taverianov@cloudlinux.com> 7.11.2-1
changelog:
  - Replaced the SmartMatch '~~' operator with traditional Perl array search (CLOS-2396)
  - Setup the LVE settings package extension in cPanel even when kmodlve is not loaded (CLOS-2394)


author:
  Roman Krompets <rkrompets@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, Redouane Elkaboussi <relkaboussi@cloudlinux.com> 7.11.3-1

changelog:
  - Implemented the ability to translate the X-Ray plugin (CLPRO-1801)
  - Added handling the lang parameter in requests (CLPRO-1859)
  - Fixed an error that prevent to create tickets from CloudLinux Manager (CLPRO-1970)
  - Complete migration to Python 3.11 (CLOS-1860)
  - Handle exceptions in the lvemanager PHP config parser more clearly (CLOS-2331)


author: Grigory Ponomarenko <gponomarenko@cloudlinux.com> 7.11.4-1
changelog:
  - Adapt cl-quota/cloudlinux-limits to work on NO-LVE environment (CLOS-2374)
  - Correct cPanel "default" plan always switching to the root user inode limits (CLOS-2312)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.5-1
changelog:
  - Fixed issue related to parsing quoted values from the /etc/cl.selector/php.conf (CLPRO-2037)
  - Fixed logout issue when accessing CloudLinux Manager in Plesk via plain domain (CLPRO-2049)


author: Dmitry Shibut <dshibut@cloudlinux.com>, Mykola Ishchenko <mishchenko@cloudlinux.com> 7.11.6-1
changelog:
  - Fix the issue with cl-quota not working on servers with the XFS file system (CLOS-2720)
  - Fix wrong data from cloudlinux-wizard status --initial if set unsupported locale (CLOS-2567)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.7-1
changelog:
  - Added Sentry initialization logic to send errors based on the environment (CLPRO-2084)
  - Fixed the issue where a reseller could view unnecessary information in external-info response (CLPRO-2119)


author: Mykola Ishchenko <mishchenko@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 7.11.10-1
changelog:
  - Fix setlocale error thrown by cloudlinux-summary when the expected locale does not exist (CLOS-2849)
  - Improved UI to prevent displaying the deprecated Governor mode "All" if it is not activated (CLPRO-2229)


author: Dmitry Shibut <dshibut@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 7.11.12-1
changelog:
  - Add config file parsing to cloudlinux-selector to pass information about PHP Selector version muting to UI (CLOS-2894)
  - Show custom tooltip in PHP Selector which indicate that selection of PHP version in PHP Selector is disabled (CLPRO-2187)


author:
  Dmitry Shibut <dshibut@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 7.11.13-1

changelog:
  - Add conditional version selection block in selectorctl (CLOS-2948)
  - Ignore decimal points in CPU limits (CLOS-2902)
  - Improve handling of uapi tool warnings in cloudlinux-cli (CLOS-2767)
  - Improve handling of non-utf8 directory names in ruby/python/nodejs selectors (CLOS-2621)
  - Fix error while installing Cloudlinux Manager on DirectAdmin while unable to access UI as a reseller (CLPRO-2321)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.14-1
changelog:
  - Make "Website Monitoring" and "Linking server" components to be configurable via cl-manager-ui-settings.json (CLPRO-2337,CLPRO-2335)


author:
  Tamar Tsotniashvili <ttsotniashvili@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 7.11.16-1

changelog:
  - Pin aiohttp to a stable fixed version to ensure consistent behavior and prevent future compatibility issues (CLOS-3036)
  - Explicitly convert the lvemanager service port to an integer to prevent potential issues (CLOS-3036)
  - Fix error related to unsupported kernel on Ubuntu (CLOS-3119)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.17-1
changelog:
  - Allow using "Slow Site Analyser" if "Website monitoring" is not installed (CLPRO-2541)
  - Fix an error with news component while it opens on each visiting the CloudLinux Manager (CLPRO-2510)
  - Fix plugin icons displaying on Direct Admin (CLPRO-2524)
  - Add "app_key" for cPanel's plugin templates that uses LiveAPI to allow customize headers (CLPRO-1368)
  - Adjust "Content-Type" header in the DirectAdmin to fix an error while strict MIME type checking (CLPRO-2544)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.18-1
changelog:
  - Redirect automatically from the "Unavailable Page" (CLPRO-2289)
  - Fix styles issue with grey bars on the left and right in the CL PHP selector (CLPRO-2246)
  - Fix issue that prevent using Cloudlinux Plugins on Plesk via HTTP protocol (CLPRO-2287)
  - Fix PHP Deprecated Construction in the Plesk (CLPRO-2288)


author:
  Roman Krompets <rkrompets@cloudlinux.com>, Dzmitry Ryzhykau <dryzhykau@cloudlinux.com>, Miakalai Voina <mvoina@cloudlinux.com> 7.11.20-1

changelog:
  - Fix an issue in the cl-quota utility where it returns a zero exit code even on failure, causing misleading behavior (CLOS-2729)
  - Fix extra space issue when removing LVE from _PACKAGE_EXTENSIONS, preventing malformed configuration (CLOS-3166)
  - Improve error message to properly notify the user about user-limit setting failure during cl-quota execution (CLOS-3236)
  - Added ability to hide tab notifications (CLPRO-2637)
  - Improve pagination in the Selector/Domains tab to allow select items per page (CLPRO-2638)
  - Improve explanation of parameters in the Website Monitoring Settings tab (CLPRO-2639)
  - Implement the dark mode for Cloudlinux Manager (CLPRO-2640)
  - Added tooltips to the Limits table with description of each limit (CLPRO-2641)
  - Fix CageFS detection when /var/.cagefs exists in the real file system (CLOS-2881)
  - Added hooks to update data about alt versions for cloudlinux summary without delay (CLPRO-2621)
  - Fix issue when buttons in UI "DESTROY/CANCEL/SAVE" partially moves out of the screen (CLPRO-2646)


author:
  Roman Krompets <rkrompets@cloudlinux.com>, Dzmitry Ryzhykau <dryzhykau@cloudlinux.com>, Miakalai Voina <mvoina@cloudlinux.com> 7.11.21-1

changelog:
  - Fix an issue in the cl-quota utility where it returns a zero exit code even on failure, causing misleading behavior (CLOS-2729)
  - Fix extra space issue when removing LVE from _PACKAGE_EXTENSIONS, preventing malformed configuration (CLOS-3166)
  - Improve error message to properly notify the user about user-limit setting failure during cl-quota execution (CLOS-3236)
  - Added ability to hide tab notifications (CLPRO-2637)
  - Improve pagination in the Selector/Domains tab to allow select items per page (CLPRO-2638)
  - Improve explanation of parameters in the Website Monitoring Settings tab (CLPRO-2639)
  - Implement the dark mode for Cloudlinux Manager (CLPRO-2640)
  - Added tooltips to the Limits table with description of each limit (CLPRO-2641)
  - Fix CageFS detection when /var/.cagefs exists in the real file system (CLOS-2881)
  - Added hooks to update data about alt versions for cloudlinux summary without delay (CLPRO-2621)
  - Fix issue when buttons in UI "DESTROY/CANCEL/SAVE" partially moves out of the screen (CLPRO-2646)


author: Roman Krompets <rkrompets@cloudlinux.com>, Mikalai Voina <mvoina@cloudlinux.com> 7.11.22-1
changelog:
  - Unbinding accelerate-wp from x-ray (CLPRO-2201)
  - Improve logic for filering URLs and Domains in the PHP Slow Site Analyzer and Website Monitoring tool (CLPRO-2619)
  - Add importlib support because Python older than 3.12 doesn't have imp library (CLOS-2935)


author: Roman Krompets <rkrompets@cloudlinux.com>, Mikalai Voina <mvoina@cloudlinux.com> 7.11.23-1
changelog:
  - Fixed the UI for show the Plugin icon for AccelerateWP (CLPRO-2693)
  - Fix incorrect wildcard url handling causing failures in NodeJS and Python apps version switching (CLOS-2918)


author:
  Roman Krompets <rkrompets@cloudlinux.com>, Oleksandr Shyshatskyi <ohyshatskyi@cloudlinux.com>, Miakalai Voina <mvoina@cloudlinux.com> 7.11.24-1

changelog:
  - Fix crash in Python Selector when alt-python-internal package is installed (CLOS-3346)
  - Fix blocking the navigation while CloudLinux manager submenu loading (CLPRO-2765)
  - Fix inability to hide (disable) native PHP version from CLI tools (CLOS-2983)


author: Roman Krompets <rkrompets@cloudlinux.com>, Nika Keshelava <nkeshelava@cloudlinux.com> 7.11.25-1
changelog:
  - Added CloudLinux 10 compatibility
  - Spread the load of 5-minute cron jobs to avoid resource usage spikes (CLOS-3303)


author:
  Roman Krompets <rkrompets@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.11.26-1

changelog:
  - Fix an error with resume installation while start wizard (CLPRO-2800)
  - Ensure that all user-side UI tools are limited with lve (CLOS-1278)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.28-1
changelog:
  - Add maintenance page for Virtual Assistant in panel plugin (CLPRO-2852)
  - Improve "unavailable" page shown when Solo/Admin customer exceed user limits (CLPRO-2855)
  - Improve usability of CloudLinux Manager plugin according to WCAG 2.1 (CLPRO-2802)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.30-1
changelog:
  - Implement the memory-efficient SQL snapshot retrieval in Cloudlinux UI (CLPRO-2853)
  - Improve Packages tab usability according to WCAG 2.1 (CLPRO-2903)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.31-1
changelog:
  - Fix incorrect focus behaviour in the modal windows while interacting with the Tab key (CLPRO-2923)


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.11.33-1

changelog:
  - Add support of per domain php selector (CLOS-3866, CLOS-3867, CLOS-3922, CLOS-3924, CLOS-3931, CLOS-3932)


author: Roman Krompets <rkrompets@cloudlinux.com>, Georgy Lepsaya <glepsaya@cloudlinux.com> 7.11.34-1
changelog:
  - Fix NodeJS/Python/Ruby selectors not detecting latest alt-ruby27-mod_passenger (CLOS-3980)
  - Fix opcache disable flag for php-cgi in selector causing failures with alt-php85 (CLOS-3705)


author: Andrei Zheregelia <azheregelia@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 7.11.36-1
changelog:
  - Fix Python/NodeJS selector returning stale cache_status on first call (CLOS-4055)
  - Add ability to manage PHP Options per domain in domain config modal (CLPRO-3012)
  - Implement Website Isolation UI for Plesk and DirectAdmin (CLPRO-3006)
  - Include error details in "Module unavailable" responses for better diagnostics (CLOS-4044)


author:
  Roman Krompets <rkrompets@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 7.11.38-1

changelog:
  - Fix translations for CloudLinux Manager (CLPRO-3058)
  - Isolates fixes and improvements (CLOS-4076)


author:
  Andrei Zheregelia <azheregelia@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> 7.11.39-1

changelog:
  - Fix end-user plugin loading on custom panel installations and other stability improvements (CLOS-4121)
  - Improve reliability of the panelless daemon for long-running operations (CLOS-4338)
  - Remove deprecated integration mechanism for InterWorx and ISPManager control panels (CLOS-4348)
  - Fix issue while processing unsupported parameters in CloudLinux Manager (CLPRO-3086)
  - Cleanup outdated handlers in CloudLinux Manager (CLPRO-3082)


author: Roman Krompets <rkrompets@cloudlinux.com> 7.11.40-1
changelog:
  - Improve performance of "Domains by user" sub-tab on servers with hundreds of cPanel accounts (CLPRO-3087)
  - Hide the PHP Selector account-settings banner when the Per Domain Settings tab is unavailable (CLPRO-3073)
  - Migrate SPA build from webpack to Angular CLI workspace (angular.json) (CLPRO-3099)


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.11.41-1
changelog:
  - Internal bugfixes and stability improvements in cPanel, Plesk and DirectAdmin plugins (CLOS-4433, CLOS-4389)


author: Roman Krompets <rkrompets@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.11.43-1
changelog:
  - Stop using the deprecated surveys.cloudlinux.com service and fix the CLOS Shared PRO upgrade links and button alignment (CLPRO-3078)
  - Internal bugfixes across multiple components (CLOS-4576)


author: Roman Prilipskii <rprilipskii@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> 7.11.44-1
changelog:
  - CLOS-4594: Internal bugfixes and improvements in limits and admin setup handling
  - CLPRO-3258: Improve X-Ray admin UI integration data
  - CLPRO-3255: Improve CloudLinux Manager UI reliability across panel integrations
  - CLPRO-3256: Improve CloudLinux Manager reliability for selector and panel flows
  - CLPRO-2867: Fix a cPanel resource-usage display error in rare configurations


author:
  Oleksii Soldatienko <osoldatienko@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.11.45-1

changelog:
  - CLOS-4702: Persist per-domain PHP extension changes to the per-website Selector backup so they survive CageFS regeneration under website isolation
  - CLOS-5724: Keep a per-domain `native` PHP selection on the cPanel system-native PHP under Website Isolation, instead of following the account-level version (and breaking with HTTP 500) after a global selector change
  - CLPRO-3267: Render boolean controls in per-domain PHP Selector options
  - Reset isolated domains from the current account-level PHP version, extensions and options, and allow native as a per-domain version (CLPRO-3185)
  - CLOS-5514: Internal bugfixes across multiple components


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 7.11.46-1
changelog:
  - CLOS-6789: Fix lvemanager upgrade truncating installed files to 0 bytes
  - CLOS-6070: Internal bugfixes across multiple components


author: Roman Krompets <rkrompets@cloudlinux.com> 0.8-1
changelog:
  - WEB-2239: Reduce the long of URL in X-Ray
  - WEB-2234: Update throttling notifications in X-Ray PDF reports


author: Roman Krompets <rkrompets@cloudlinux.com> 0.13-1
changelog:
  - WEB-2496: Use CLI instead of REST api calls in X-RAY admin
  - WEB-2382: Fix issues in X-Ray UI related to table updates WEB-2387: Investigate how we can improve the X-Ray tracing tasks tab
  - WEB-2365: X-Ray Autotracing: Add info and controls for enable autortacing
  - WEB-2360: Refactor code to show the same request elements for autotracing tasks as for manual task
  - WEB-2316: Add new view of autotracing tasks in X-Ray UI
  - WEB-2288: Implement cron job to automatically enable user-xray-agent based on uiconfig


author: Roman Krompets <rkrompets@cloudlinux.com>, sgevorgyan <sgevorgyan@cloudlinux.com> 0.14-1
changelog:
  - WEB-2576: Adapt icons to the Jupiter theme
  - WEB-2568 Stop sending requests on XRay tab if you leave it and restore if you back again


author: Roman Krompets <rkrompets@cloudlinux.com> 0.15-1
changelog:
  - WEB-2657: Fixed error in browser console related to upload fonts
  - WEB-2634: Fixed duplicate lines inside /etc/cron.d/xray-plugin-check-cron after reinstalling lvemanager-xray


author: Roman Krompets <rkrompets@cloudlinux.com> 1.0-3
changelog:
  - Fixed issue in the xray plugin installer caused by using an old path to the plugin archive (CLPRO-2097)


author: Roman Krompets <rkrompets@cloudlinux.com> 1.0-11
changelog:
  - Fixed issue when X-Ray is recognizing JTL-Shop or Shopware (eCommerce platforms) as WordPress sites (CLPRO-2154)
  - Add Spanish translations to xray X-Ray (CLPRO-2689)


author: Roman Krompets <rkrompets@cloudlinux.com> 1.0-17
changelog:
  - CLPRO-3135: Plugin installer file/directory copy improvements; SPA tooltip content rendering update
  - CLPRO-3136: Build helper argument quoting; Perl dispatch table cleanup; toast notification rendering update


author: Roman Krompets <rkrompets@cloudlinux.com> 1.0-18
changelog:
  - CLPRO-3120: Improved X-Ray UI localisation and dialog button rendering
  - CLPRO-3201: Improved X-Ray build dependency bootstrapping and report-upload argument handling


author: Roman Krompets <rkrompets@cloudlinux.com> 1.0-19
changelog:
  - CLPRO-3202: Improved X-Ray subprocess and upload-script argument/path handling, build image pinning, cPanel bridge and SPA route/input validation, and report telemetry handling
  - CLPRO-3203: Improved X-Ray error-report data handling and tracing form input validation
  - CLPRO-3258: Improve admin X-Ray request list and grouped request data retrieval


author: Roman Krompets <rkrompets@cloudlinux.com> 1.0-20
changelog:
  - CLPRO-3457: Improve X-Ray request processing, report navigation, task refresh behavior, plugin installation, error reporting, and Advanced Metrics fallback UI


author: Michal Schorm <mschorm@redhat.com> - 0.996-2.12
changelog:
  - Bump version for 'mysql' module rebuild
    We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo
  - Resolves: #2180411


author: Erik van Pienbroek <epienbro@fedoraproject.org> - 2.9.3-1
changelog:
  - Update to 2.9.3
  - Fixes various CVE's:
    RHBZ #1213960, #1262853, #1262854, #1274225, #1274226, #1276299
    RHBZ #1276300, #1277149, #1277150, #1281952, #1281953


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Nika Keshelava <nkeshelava@cloudlinux.com> - 1.0-46
changelog:
  - CLOS-3754: fix SIGSEGV in process_lve_error() when mod_brotli is loaded
  - CLOS-4441: Maintenance update
  - CLOS-4585: Maintenance update


author: Lubos Uhliarik <luhliari@redhat.com> - 1.11.3-3
changelog:
  - Resolves: #1744999 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount
    of data request leads to denial of service
  - Resolves: #1745086 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length
    headers leads to denial of service
  - Resolves: #1745154 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request for
    large response leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-1
changelog:
  - new version 1.15.7
  - Resolves: #1814236 - RFE: mod_http2 rebase 
  - Resolves: #1747289 - CVE-2019-10082 httpd:2.4/mod_http2: httpd: 
    read-after-free in h2 connection shutdown
  - Resolves: #1696099 - CVE-2019-0197 httpd:2.4/mod_http2: httpd: 
    mod_http2: possible crash on late upgrade
  - Resolves: #1696094 - CVE-2019-0196 httpd:2.4/mod_http2: httpd:
    mod_http2: read-after-free on a string compare
  - Resolves: #1677591 - CVE-2018-17189 httpd:2.4/mod_http2: httpd: 
    mod_http2: DoS via slow, unneeded request bodies


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-2
changelog:
  - Resolves: #1869073 - CVE-2020-9490 httpd:2.4/mod_http2: httpd: 
    Push diary crash on specifically crafted HTTP/2 header


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-4
changelog:
  - Resolves: #1966728 - CVE-2021-33193 httpd:2.4/mod_http2: httpd:
    Request splitting via HTTP/2 method injection and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-5
changelog:
  - Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference
    or SSRF in forward proxy configurations


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-9.3
changelog:
  - Resolves: RHEL-13367 - httpd:2.4/mod_http2: reset requests exhaust memory
    (incomplete fix of CVE-2023-44487)(CVE-2023-45802)


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-10.1
changelog:
  - Resolves: RHEL-46214 - Access logs and ErrorDocument don't work when HTTP431
    occurs using http/2 on RHEL8


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-10.3
changelog:
  - Resolves: RHEL-58454 - mod_proxy_http2 failures after CVE-2024-38477 fix
  - Resolves: RHEL-59017 - random failures in other requests on http/2 stream
    when client resets one request


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-10.4
changelog:
  - Resolves: RHEL-105186 - httpd:2.4/httpd: untrusted input from a client causes
    an assertion to fail in the Apache mod_proxy_http2 module (CVE-2025-49630)


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-10.5
changelog:
  - Resolves: RHEL-166277 - httpd:2.4/httpd: Apache HTTP Server: HTTP/2 DoS by
    Memory Increase (CVE-2025-53020)


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-10.6
changelog:
  - Resolves: RHEL-182418 - mod_http2: HTTP/2: Remote Denial of Service via
    compression bomb and Slowloris-style attack (CVE-2026-49975)


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-10.7
changelog:
  - Resolves: RHEL-191279 - mod_http2: Apache HTTP Server: Out-of-bounds
    Read in mod_headers and mod_mime (CVE-2026-43951)


author: Lubos Uhliarik <luhliari@redhat.com> - 1.11.3-1
changelog:
  - new version 1.11.3
  - Resolves: #1633401 - CVE-2018-11763 mod_http2: httpd:  DoS for HTTP/2
    connections by continuous SETTINGS


author: Lubos Uhliarik <luhliari@redhat.com> - 1:2.0.8-8
changelog:
  - Resolves: #1832844 - mod_md does not work with ACME server that does not
    provide keyChange or revokeCert resources


author: Luboš Uhliarik <luhliari@redhat.com> - 1:2.0.8-8.2
changelog:
  - Resolves: RHEL-134487 - httpd:2.4/httpd: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (CVE-2025-55753)


author: Leonid Kanter <lkanter@cloudlinux.com> - 0.7.2-1
changelog:
  - update to with-setid-mode="owner"
  - handle update of packages built with --with-setid-mode="owner" (dkasyanov@)


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.23-1
changelog:
  - Update to MySQL 8.0.23
  - Created mysql-fix-includes-robin-hood.patch
  - Created mysql-main-cast.patch


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.30-1
changelog:
  - Update to MySQL 8.0.30
  - Remove patches now upstream:
    chain certs, s390 and robin hood
  - Add a new plugin 'conflicting_variables.so'


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.34-1
changelog:
  - Update to MySQL 8.0.34
  - Add patch from upstream bug#110569
  - Add patch to fix binlog format issue
  - Use --skip-combinations over --binlog-format=mixed
  - Add alignment patch upstream bug#110752


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.14.0-1
changelog:
  - Resolves: #1558420 - directory permissions are now correct after processing
    USR1 signal
  - Resolves: #1601414 - nginx: drop GeoIP support


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.14.1-1
changelog:
  - new version 1.14.1
  - Resolves: #1647257 - CVE-2018-16845 nginx: Denial of service and
    memory disclosure via mp4 module
  - Resolves: #1647262 - CVE-2018-16844 nginx: Excessive CPU usage
    via flaw in HTTP/2 implementation
  - Resolves: #1647263 - CVE-2018-16843 nginx: Excessive memory consumption
    via flaw in HTTP/2 implementation


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.14.1-9
changelog:
  - Resolves: #1744811 - CVE-2019-9511 nginx:1.14/nginx: HTTP/2: large amount of
    data request leads to denial of service
  - Resolves: #1744325 - CVE-2019-9513 nginx:1.14/nginx: HTTP/2: flood using
    PRIORITY frames resulting in excessive resource consumption
  - Resolves: #1745094 - CVE-2019-9516 nginx:1.14/nginx: HTTP/2: 0-length
    headers leads to denial of service


author: Andrew Lukoshko <alukoshko@cloudlinux.com> - 2:1.14.1-9.cloudlinux.2
changelog:
  - Fix CVE-2026-42945 nginx: NGINX: Buffer overrun in rewrite module via arguments in replacement strings


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.0-1
changelog:
  - new version 1.16.0
  - enable ngx_stream_ssl_preread module
  - main package does NOT require all-modules package


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1
changelog:
  - update to 1.16.1
  - Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount
    of data request leads to denial of service
  - Resolves: #1745690 - CVE-2019-9513 nginx:1.16/nginx: HTTP/2: flood using
    PRIORITY frames resulting in excessive resource consumption
  - Resolves: #1745645 - CVE-2019-9516 nginx:1.16/nginx: HTTP/2: 0-length
    headers leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-2
changelog:
  - Resolves: #1798230 - CVE-2019-20372 nginx:1.16/nginx: HTTP request smuggling
    via error pages in http/ngx_http_special_response.c


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.16.1-2.1
changelog:
  - Resolves: #1963174 - CVE-2021-23017 nginx:1.16/nginx: Off-by-one in
    ngx_resolver_copy() when labels are followed by a pointer to a root
    domain name


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-2
changelog:
  - new version 1.18.0
  - Resolves: #1668717 - [RFE] Support loading certificates from hardware token
    (PKCS#11)
  - Increased types_hash_max_size to 4096 in default config
  - Drop location / from default config (rhbz#1564768)
  - Drop default_sever from default config (rhbz#1373822)


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-3
changelog:
  - Resolves: #1651377 - centralizing default index.html on nginx
  - Resolves: #1825683 - Outdated Red Hat branding used in nginx default pages


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.18.0-3.1
changelog:
  - Resolves: #1963178 - CVE-2021-23017 nginx:1.18/nginx: Off-by-one in
    ngx_resolver_copy() when labels are followed by a pointer to a root
    domain name


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-1.1
changelog:
  - Resolves: RHEL-12730 - nginx:1.20/nginx: HTTP/2: Multiple HTTP/2 enabled web
    servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-1
changelog:
  - Resolves: #2112345 - nginx:1.22 for RHEL 8
  - add stream_geoip_module and stream_realip_module
  - remove obsolete --with-ipv6


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-1.1
changelog:
  - Resolves: RHEL-12726 - nginx:1.22/nginx: HTTP/2: Multiple HTTP/2 enabled web
    servers are vulnerable to a DDoS attack (Rapid Reset Attack)(CVE-2023-44487)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-2
changelog:
  - Resolves: RHEL-12728 - nginx:1.22/nginx: HTTP/2: Multiple HTTP/2 enabled web
    servers are vulnerable to a DDoS attack (Rapid Reset Attack)(CVE-2023-44487)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-2
changelog:
  - Resolves: RHEL-146517 - nginx:1.24/nginx: NGINX: Data injection via
    man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.24.0-3
changelog:
  - Resolves: RHEL-157877 CVE-2026-32647 nginx:1.24/nginx: NGINX: Denial of
    Service or Code Execution via specially crafted MP4 files
  - Resolves: RHEL-159436 CVE-2026-27651 nginx:1.24/nginx: NGINX: Denial of
    Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  - Resolves: RHEL-159549 CVE-2026-27654 nginx:1.24/nginx: NGINX: Denial of
    Service or file modification via buffer overflow in ngx_http_dav_module
  - Resolves: RHEL-159528 CVE-2026-27784 nginx:1.24/nginx: NGINX: Denial of
    Service due to memory corruption via crafted MP4 file


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-3.1
changelog:
  - Resolves: RHEL-176224 - nginx:1.24/nginx: NGINX: Arbitrary Code Execution
    Vulnerability (CVE-2026-42945)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-3.2
changelog:
  - Resolves: RHEL-178676 - nginx:1.24/nginx: code execution and denial
    of service (CVE-2026-9256)
  - Resolves: RHEL-182543 - nginx: HTTP/2: Remote Denial of Service via
    compression bomb and Slowloris-style attack


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-3.3
changelog:
  - Resolves: RHEL-191779 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI
    causing crashes
  - Resolves: RHEL-188406 - nginx: NGINX: Arbitrary code execution or.
    Denial of Service via heap-based buffer overflow with crafted HTTP/2
    headers (CVE-2026-42055)


author: Korde Nakul <nakul.korde@intel.com> 1.4.1-1
changelog:
  - OPAE git repository layout changes.
  - Removed Safe String module dependency.
  - Various bug fixes.
  - Ported python tools to python3.6.
  - Various Static code scan bug fixes.
  - Removed pybind11 3rd component from OPAE source repository.


author: Tomas Hoger <thoger@redhat.com> - 16.02-7
changelog:
  - Add conditional for building with(out) GUI support.  Keep GUI enabled for
    Fedora and EPEL builds, but disabled for RHEL.
  - Add missing dependency - 7zG requires 7z.so, so p7zip-gui needs to require
    p7zip-plugins.


author: Sérgio Basto <sergio@serjux.com> - 16.02-9
changelog:
  - Security fix for CVE-2017-17969 (from Debian)
  - Add 05-hardening-flags.patch, 09-man-update.patch, 10-drop-fm-doc.patch
    and 14-Fix-g++-warning.patch patches from Debian, very small changes
    better documentation, compile flags and compile warning.


author: Anton Volkov <avolkov@cloudlinux.com>, Vladislav Fomin <vfomin@cloudlinux.com> 0.3-11
changelog:
  - PAMLVE-8: build pam_lve rpm package for CL8
  - PAMLVE-6: strange lve1 appears after attempt to create lvp
  - CAG-603: use CloudLinux Zug GmbH instead of Cloud Linux Inc
  - update EULA


changelog: - LU-3133: remove "set -e" from scriplets
author:
  Aleksey Petryankin <apetryankin@cloudlinux.com>, Alexey Lyashkov <umka@cloudlinux.com>, Anton Volkov <avolkov@cloudlinux.com> 0.4-2


author: Paul Howarth <paul@city-fan.org> - 0.161-25
changelog:
  - Spec clean-up
    - Classify buildreqs by usage
    - Make %files list more explicit
    - Use %license
    - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1.912-5
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Classify buildreqs by usage
    - Use %{make_build} and %{make_install}
    - Fix permissions verbosely
    - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 1.946-8
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Specify all build dependencies
    - Use DESTDIR rather than PERL_INSTALL_ROOT
    - Simplify find command using -delete
    - Fix permissions verbosely
    - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 1.022-8
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Classify buildreqs by usage
    - Use DESTDIR rather than PERL_INSTALL_ROOT
    - Simplify find command using -delete
    - Fix permissions verbosely
    - Use %license
    - Make %files list more explicit


author: Petr Pisar <ppisar@redhat.com> - 1.406-10
changelog:
  - Remove an unused dependency on Email::Address (bug #1475784)
  - Modernize spec file and specify all dependencies


author: Paul Howarth <paul@city-fan.org> - 1.406-14
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Specify all build requirements
    - Use %{make_build} and %{make_install}
    - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 2.216-1
changelog:
  - Update to 2.216
    - Do not re-fold folded lines
  - Classify buildreqs by usage
  - Drop legacy Group: tag
  - Drop provides/obsoletes for perl-Email-Simple-Creator added in 2010
  - Make %files list more explicit
  - Simplify find command using -delete
  - Don't need to remove empty directories from the buildroot


author: Paul Howarth <paul@city-fan.org> - 0.09-1
changelog:
  - Update to 0.09
    - Get rid of DB::single
    - Don't do POD tests by default
  - Specify all dependencies


author: Paul Howarth <paul@city-fan.org> - 0.11-1
changelog:
  - Update to 0.11
    - Release with new tooling
  - This release by ETHER → update source URL
  - BR: perl-generators
  - Simpify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 2009041301-27
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Classify buildreqs by usage
    - Use DESTDIR rather than PERL_INSTALL_ROOT
    - Drop redundant buildroot cleaning in %install section
    - Don't need to remove empty directories from the buildroot
    - Simplify find command using -delete
    - Fix permissions verbosely
    - Make %files list more explicit
    - Package upstream's documentation


author: Ralf Corsépius <corsepiu@fedoraproject.org> - 2.12-2
changelog:
  - Flatten build tree.
  - Disable RELEASE_TESTING, remove corresponding BRs.
  - Preps for upstream having renamed dist into HTML-Formatter.
  - Add %license.
  - Don't pretend to be supporting rhel < 7.


author: Ralf Corsépius <corsepiu@fedoraproject.org> - 2.16-1
changelog:
  - Update to HTML-Formatter-2.16.
  - Reflect upstream having switched to ExtUtils::MakeMaker.
  - Spec cleanup.


author: Paul Howarth <paul@city-fan.org> - 0.19-5
changelog:
  - Fix FTBFS due to missing buildreq perl-devel
  - Use a patch rather than scripted iconv to fix documentation encodings
  - Simplify find command using -empty and -delete


author: Paul Howarth <paul@city-fan.org> - 0.20-1
changelog:
  - Update to 0.20
    - Fix test skip count on Win32 (CPAN RT#76335)
  - Drop UTF8 docs patch; issue fixed upstream


author: Paul Howarth <paul@city-fan.org> - 0.007-1
changelog:
  - Update to 0.007
    - Adapt to dot no longer being in @INC
    - Adapt to unicode syswrite being deprecated
  - Drop redundant Group: tag


author: Paul Howarth <paul@city-fan.org> - 0.46-1
changelog:
  - Update to 0.46
    - Meta 0.0.2
    - Eliminate spurious trailing whitespace
    - Eliminate File::Basename from test/
    - Add t/000-compile-modules.t


author: Paul Howarth <paul@city-fan.org> - 0.89-1
changelog:
  - Update to 0.89
    - Require Test::More ≥ 0.88 (GH#19)
    - Support the use of plain 'use Test::Base' without any tests (GH#21)
  - Classify buildreqs by usage
  - Drop legacy Group: tag
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1.20180705-5
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Use %{make_build} and %{make_install}
    - Fix permissions verbosely
    - Make %files list more explicit
    - Package LICENSE file
    - Drop redundant use of %{?perl_default_filter}


author: Paul Howarth <paul@city-fan.org> - 0.05-15
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Specify all build requirements
    - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1.05-1
changelog:
  - Update to 1.05
    - Add 000-none to Meta
    - Remove t/use_ok.t
    - Meta 0.0.2
    - Dep on Test::Base 0.86


author: Paul Howarth <paul@city-fan.org> - 0.06-1
changelog:
  - Update to 0.06
    - Warnings inside a subtest were not emitted as TAP events, breaking the TAP
      and making for great confusion: this is because of a bug in the core TAP
      formatter (https://github.com/Test-More/test-more/issues/776); warnings
      are now emitted as Ok events instead of Warning events


author: Paul Howarth <paul@city-fan.org> - 0.07-1
changelog:
  - Update to 0.07
    - Reverted back to using the Warning event type, since the bug in the Test2
      core that caused this to be a problem has since been fixed
    - Replaced use of Test2::Bundle::Extended with Test2::V0
  - Package new document CODE_OF_CONDUCT.md
  - Modernize spec using %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 0.08-1
changelog:
  - Update to 0.08
    - Use IPC::Run3 instead of Capture::Tiny for all tests, which fixes an issue
      with the 'tap-bug-in-test2.t' on Windows (CPAN RT#129294)


author: Paul Howarth <paul@city-fan.org> - 1.20140328-15
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Classify buildreqs by usage
    - Simplify find command using -delete
    - Don't need to remove empty directories from the buildroot
    - Fix permissions verbosely
    - Package LICENSE file
    - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 0.99-8
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Classify buildreqs by usage
    - Explicitly require perl(Geography::Countries)
    - Use %{make_build} and %{make_install}
    - Fix permissions verbosely
    - Make %files list more explicit
    - Package README.md rather than README


author: Paul Howarth <paul@city-fan.org> - 1.0004-2
changelog:
  - Incorporate feedback from package review (#1148577)
    - Fix typo in %description
    - Package eg/ as documentation


author: Paul Howarth <paul@city-fan.org> - 1.0005-1
changelog:
  - Update to 1.0005
    - Convert the distribution to use git, GitHub, and Dist-Zilla
    - Correct some spelling errors and add more tests
    - Remove trailing whitespace


author: Paul Howarth <paul@city-fan.org> - 1.0006-1
changelog:
  - Update to 1.0006
    - Fix failing to find the difference in this scenario (CPAN RT#84546):
      Before: <element>0</element>
      After: <element></element>
  - Drop EL-5 support:
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section


author: Paul Howarth <paul@city-fan.org> - 2.000001-1
changelog:
  - Update to 2.000001
    - Update for perl 5.22 warning categories
    - Avoid using goto &UNIVERSAL::VERSION on perl 5.8, since it segfaults some
      builds
    - Also detect development directories based on .bzr directory
    - Various test clean-ups
  - Update %summary and %description to reflect that not all warnings are made
    fatal by this module


author: Paul Howarth <paul@city-fan.org> - 2.000002-1
changelog:
  - Update to 2.000002
    - Use ExtUtils::HasCompiler to detect compiler rather than ExtUtils::CBuilder
    - More comprehensive testing


author: Paul Howarth <paul@city-fan.org> - 2.000003-1
changelog:
  - Update to 2.000003
    - Update bundled ExtUtils::HasCompiler to 0.013 to fix potential false
      negative (CPAN RT#113637)
    - List optional XS dependencies as suggests rather than recommends
      (CPAN RT#107393)


author: Remi Collet <rcollet@redhat.com> - 7.2.7-1
changelog:
  - Update to 7.2.7 - http://www.php.net/releases/7_2_7.php
  - drop -mstackrealign option, workaround to #1593144


author: Remi Collet <rcollet@redhat.com> - 7.4.6-1
changelog:
  - update to 7.4.6
  - add ffi extension
  - add /usr/share/php/preload as default ffi.preload configuration
  - run FPM tests
  - set opcache.enable_cli in provided default configuration
  - ensure all shared extensions can be loaded
  - drop wddx, recode and extensions
  - run test suite using 4 concurrent workers


author: Remi Collet <rcollet@redhat.com> - 7.4.19-2
changelog:
  - fix SSRF bypass in FILTER_VALIDATE_URL
    CVE-2021-21705
  - fix Local privilege escalation via PHP-FPM
    CVE-2021-21703


author: Remi Collet <rcollet@redhat.com> - 7.4.33-1
changelog:
  - rebase to 7.4.33
  - fix: due to an integer overflow PDO::quote() may return unquoted string
    CVE-2022-31631


author: Remi Collet <rcollet@redhat.com> - 7.4.33-2
changelog:
  - fix low/moderate CVEs
    RHEL-66589
  - Fix cgi.force_redirect configuration is bypassable due to the environment variable collision
    CVE-2024-8927
  - Fix Logs from childrens may be altered
    CVE-2024-9026
  - Fix Erroneous parsing of multipart form data
    CVE-2024-8925
  - Fix filter bypass in filter_var FILTER_VALIDATE_URL
    CVE-2024-5458
  - Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
    CVE-2024-2756
  - Fix password_verify can erroneously return true opening ATO risk
    CVE-2024-3096
  - Fix Security issue with external entity loading in XML without enabling it
    CVE-2023-3823
  - Fix Buffer mismanagement in phar_dir_read()
    CVE-2023-3824
  - Fix Missing error check and insufficient random bytes in HTTP Digest
    authentication for SOAP
    CVE-2023-3247
  - fix #81744: Password_verify() always return true with some hash
    CVE-2023-0567
  - fix #81746: 1-byte array overrun in common path resolve code
    CVE-2023-0568
  - fix DOS vulnerability when parsing multipart request body
    CVE-2023-0662


author: Remi Collet <rcollet@redhat.com> - 7.4.33-3
changelog:
  - Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
    GHSA-4w77-75f9-2c8w
  - Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs
    CVE-2024-11234
  - Fix Single byte overread with convert.quoted-printable-decode filter
    CVE-2024-11233
  - Fix Leak partial content of the heap through heap buffer over-read
    CVE-2024-8929
  - Fix libxml streams use wrong `content-type` header when requesting a redirected resource
    CVE-2025-1219
  - Fix Stream HTTP wrapper header check might omit basic auth header
    CVE-2025-1736
  - Fix Stream HTTP wrapper truncate redirect location to 1024 bytes
    CVE-2025-1861
  - Fix Streams HTTP wrapper does not fail for headers without colon
    CVE-2025-1734
  - Fix Header parser of `http` stream wrapper does not handle folded headers
    CVE-2025-1217
  - Fix pgsql extension does not check for errors during escaping
    CVE-2025-1735
  - Fix NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
    CVE-2025-6491
  - Fix Null byte termination in hostnames
    CVE-2025-1220
  - Fix Null byte termination in dns_get_record()
    GHSA-www2-q4fc-65wf
  - Fix Heap buffer overflow in array_merge()
    CVE-2025-14178
  - Fix Information Leak of Memory in getimagesize
    CVE-2025-14177


author: Remi Collet <rcollet@redhat.com> - 7.4.33-4
changelog:
  - Fix XSS within status endpoint
    CVE-2026-6735
  - Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
    CVE-2026-6722
  - Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
    CVE-2026-7261
  - Fix Broken Apache map value NULL check
    CVE-2026-7262
  - Fix Signed integer overflow of char array offset
    CVE-2026-7568
  - Fix Consistently pass unsigned char to ctype.h functions
    CVE-2026-7258


author: Remi Collet <rcollet@redhat.com> - 8.2.13-1
changelog:
  - rebase to 8.2.13 RHEL-14705
  - add %__phpize and %__phpconfig macros
  - move httpd/nginx wants directives to config files in /etc
  - php-fpm.conf: move include directive after [global] section
    following upstream example, allowing overriding
  - use SPDX license IDs


author: Remi Collet <rcollet@redhat.com> - 1:1.10.12-1
changelog:
  - update PEAR to 1.10.12
  - update Archive_Tar to 1.4.9
  - update Console_Getopt to 1.4.3
  - update XML_Util to 1.4.5


author: Boris Ranto <branto@redhat.com> - 0.9.6-1
changelog:
  - Rebase to latest upstream version
  - Modify backwards compatible symlink for qt(4)
  - Enable pinentry-emacs since it was enabled by default in 0.9.5


author: Leigh Scott <leigh123linux@googlemail.com> - 0.105-14
changelog:
  - Fix source url
  - Remove build requires desktop-file-utils
  - Add version to PolicyKit-authentication-agent provides
  - Spec file clean up


author: Ralf Corsépius <corsepiu@fedoraproject.org> - 1.23-3
changelog:
  - Use /usr/bin/perl instead of /usr/bin/env perl.
  - Add BR: perl(*).
  - Use wildcards instead of hardcoded *.gz for man-pages.


author: Scott K Logan <logans@cottsay.net> - 3.0.9-1
changelog:
  - Update to 3.0.9
  - Add spec conditionals for python version targeting (rhbz#1632320)
  - Fix theme package dependency (s/sphinx_rtd_theme/sphinx-theme-alabaster/)


author: Scott K Logan <logans@cottsay.net> - 3.0.12-2
changelog:
  - Add explicit conflict between unlike python2/3 subpackages (rhbz#1708871)
  - Make the -doc subpackage dependency weaker


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-2
changelog:
  - New patch to not turn DeprecationWarning in tornado module into Exception
  - Fixes FTBFS with Python 3.8


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.3-12
changelog:
  - Python 2 binary package renamed to python2-blinker
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.12.13-6
changelog:
  - Avoid use of undefined unversioned python macro (which leads to
    the binary package owning "/" :( )


author: Tomas Orsava <torsava@redhat.com> - 2.18.4-6
changelog:
  - Skip all tests needing httpbin: httpbin has too many dependencies to be
    shipped in RHEL just for build-time package tests


author: Kalev Lember <klember@redhat.com> - 1.15.2-1
changelog:
  - Update to 1.15.2
  - Switch to new upstream at https://github.com/pygobject/pycairo
  - Switch to distutils build system
  - Tighten subpackage deps with the _isa macro
  - Rename Python 2 package to python2-cairo
  - Enable Python 3 support


author: Petr Viktorin <pviktori@redhat.com> - 1.16.3-2
changelog:
  - Allow Python 2 for build
    See: https://hurl.corp.redhat.com/rhel8-py2

  - Skip tests on Python 2 (python2-pytest is being removed)


author: Petr Viktorin <pviktori@redhat.com> - 5.1.1-2
changelog:
  - Remove the python2 version of docs
  - Remove Qt subpackages
  - Drop dependency on python2-olefile (breaking MicImagePlugin.py, FpxImagePlugin)


author: Petr Viktorin <pviktori@redhat.com> - 5.1.1-3
changelog:
  - Remove the Python 2 subpackage
  - Remove the libimagequant dependency
    The imagequant library was only used to support a non-default image
    quantization mode.


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-7
changelog:
  - Add upstream patch to solve build-time warning
  - Move patches to dist-git
  - Resolves: rhbz#1639348


author: Michael Mraka <michael.mraka@redhat.com> 2.10.6-1
changelog:
  - Add ability to work behind http proxies
  - Fix clean-up of Config singleton to allow new config path


author:
  Oleksandr Shyshatskyi <oshyshatsky@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com> 2.11.0-2

changelog:
  - Rebased codebase on top of upstream changes (CLPRO-1703, CLPRO-1735)
  - Added ability to change CloudLinux editions (CLPRO-1755, CLPRO-1741, CLOS-2463, CLPRO-1813, CLPRO-1787)


author: Oleksandr Shyshatskyi <oshyshatsky@cloudlinux.com> 2.11.1-1
changelog:
  - Exit rhnreg_ks when interactive question asked and shell is not TTY (CLPRO-1885)
  - Add notification about license limits before registration (CLPRO-1754)
  - Make LVE support transition from Shared/Admin to Solo (CLOS-2355)


author: Dmitry Shibut <dshibut@cloudlinux.com> 2.11.2-1
changelog:
  - Fix display of the error message 'failed to save log entry' during execution of the commands clnreg_ks and rhn_check (CLOS-2437)


author: Dzmitry Ryzhykau <dryzhykau@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 2.12.0-1
changelog:
  - CLOS-3052: Add Ubuntu 22 support. Remove up2date_client.cldetect Python module.
  - CLOS-3032: Skip the unused registration calls: add_packages, add_hw_profile


author: Roman Prilipskii <rprilipskii@cloudlinux.com> 2.12.5-1
changelog:
  - CLOS-3231: Add a fallback mechanism to the server URL configuration
  - CLOS-3379: Add additional server URL configuration for connections over IPv6


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 3.0.1-1
changelog:
  - CLOS-3495: Report number of users on machine to CLN during registration
  - CLOS-3533: Preparations for CloudLinux 10 and internal codebase cleanup
  - CLOS-3422: Upgrade and cleanup of core functionality


author: Georgy Lepsaya <glepsaya@cloudlinux.com> 3.0.3-1
changelog:
  - CLOS-3571: Implement alt-els repository auth with JWT on Ubuntu
  - CLOS-3855: Require cloudlinux-release with SWNG mirrorlist repos
  - CLOS-4049: Obsolete dnf-plugin-spacewalk


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 3.0.1-1
changelog:
  - CLOS-3495: Report number of users on machine to CLN during registration
  - CLOS-3533: Preparations for CloudLinux 10 and internal codebase cleanup
  - CLOS-3335: Fix proxy authentication failure caused by removed base64.encodestring in Python 3.9
  - CLOS-3422: Upgrade and cleanup of core functionality


author: Georgy Lepsaya <glepsaya@cloudlinux.com> 3.0.5-1
changelog:
  - CLOS-4605: Require rhn-setup so installing rhn-client-tools pulls the full registration stack
  - CLOS-4595: Internal bugfixes
  - CLOS-4661: Fix proxy registration hang by deriving the scheme from the proxy, not serverURL


author: Roman Prilipskii <rprilipskii@cloudlinux.com> 3.0.6-1
changelog:
  - CLOS-4594: Add --activationkey=- to read the activation key from standard input; clnreg_ks forwards it (and skips the IPL default) when present


author: Gennadii Altukhov <grinrag@gmail.com> 2.8.3-1
changelog:
  - Python's OpenSSL.SSL.Connection method for getting state was renamed. Now
    before run it we should determinate its name via getattr built-in function.


author: Tomas Kasparek <tkasparek@redhat.com> 2.8.4-1
changelog:
  - 1494389 - Revert "[1260527] RHEL7 reboot loop"
  - 1494389 - Revert "fix except in rhnlib to make it compatible with Python 2.4"


author: Michael Mraka <michael.mraka@redhat.com> 2.8.6-1
changelog:
  - remove install/clean section initial cleanup
  - removed Group from specfile
  - removed BuildRoot from specfiles


author: Tomas Kasparek <tkasparek@redhat.com> 2.8.6-4
changelog:
  - don't package python2 files for rhnlib (tkasparek@redhat.com)
  - be compliant with new packaging guidelines when requiring python2 packages
    (tkasparek@redhat.com)


author: Miro Hrončok <mhroncok@redhat.com> - 0.10.0-3
changelog:
  - Subpackage python2-toml has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Benjamin A. Beasley <code@musicinmybrain.net> - 20190801-6
changelog:
  - Simplify and modernize invocation of make
  - We do not switch to CMake because the configuration for it is too
    primitive in this upstream release, and several patches would be needed.


author: Jan Dobes 5.0.27-1
changelog:
  - 1383668 - close and reopen syslog when redirecting child output
  - Updated links to github in spec files
  - Migrating Fedorahosted to GitHub


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.33-1
changelog:
  - fix rhnsd triggered upgrade of rhnsd on systemd systems
  - 1494389 - Revert "[1260527] RHEL7 reboot loop"
  - 1494389 - Revert "1260527 RHEL7 rhnsd reload doesn't work"


author: Petr Pisar <ppisar@redhat.com> - 1.3.0-16
changelog:
  - perl dependency renamed to perl-interpreter
    <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-3
changelog:
  - add pcp user to /etc/aliases (#1744089)
  - set PATH if it is empty in csh.login (#1744104)
  - lang.csh: prevent grep from failing so scripts do not end
    prematurely when tcsh -e option in use (#1678706)
  - use full path for non-builtins (#1688302)
  - add nrpe tcp port 5666 to /etc/services (#1730396)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2044589)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#1945400)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#1917934)


author: Javier Martinez Canillas <javierm@redhat.com> - 15-12
changelog:
  - Fix firmware update bug in aarch64 caused by shim ignoring arguments
    Resolves: rhbz#1830871
  - Fix a shim crash when attempting to netboot
    Resolves: rhbz#1795654


author: Peter Jones <pjones@redhat.com> - 15-13
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Andrew Lukoshko <alukoshko@cloudlinux.com> - 15.8-1.cloudlinux.1
changelog:
  - Update to shim-15.8
    Resolves: CVE-2023-40546
    Resolves: CVE-2023-40547
    Resolves: СVE-2023-40548
    Resolves: СVE-2023-40549
    Resolves: CVE-2023-40550
    Resolves: CVE-2023-40551


author: Andrew Lukoshko <alukoshko@cloudlinux.com> - 1:16.1-2.cloudlinux.1
changelog:
  - Update to shim-16.1
  - Include all signed binaries as sources instead of pulling them from
    the shim-unsigned-* packages at build time
  - Drop the aarch64 build
  - Conflict with grub2-efi versions older than the one built with the
    required SBAT generation (shim 16.1 requires SBAT level 5)


author: Javier Martinez Canillas <javierm@redhat.com> - 15-3
changelog:
  - Make EFI variable copying fatal only on secureboot enabled systems
    Resolves: rhbz#1715878
  - Fix booting shim from an EFI shell using a relative path
    Resolves: rhbz#1717064


author: Peter Jones <pjones@redhat.com> - 15-4
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-5
changelog:
  - Once more with the MokListRT config table patch added.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-8
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1861977
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Andrew Lukoshko <alukoshko@cloudlinux.com> - 15.8-1.el8.cloudlinux.1
changelog:
  - Update to shim-15.8
    Resolves: CVE-2023-40546
    Resolves: CVE-2023-40547
    Resolves: СVE-2023-40548
    Resolves: СVE-2023-40549
    Resolves: CVE-2023-40550
    Resolves: CVE-2023-40551
  - Add CloudLinux Secure Boot CA 2 cert as trusted


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.1-3
changelog:
  - Rebase on upstream 4.5.1
    Resolves: bz2175806
  - [composer] Capure /etc/osbuild-composer file
    Resolves: bz2169776
  - [ostree] Collect "ostree fsck" under plugin specific opt
    Resolves: bz2161533
  - [iprconfig] guard whole plugin by sg kmod predicate
    Resolves: bz2176086
  - [cleaner] dont clean sys_tmp from final_path
    Resolves: bz2176218


author: Jan Jansky <jjansky@redhat.com> = 4.5.3-1
changelog:
  - [report] Ignore case when scrubbing via do_file_sub
    Resolves: bz2143272
  - [subscription_manager] Scrub proxy passwords from repo_server_val
    Resolves: bz2177282
  - [virsh] Scrub passwords in virt-manager logs
    Resolves: bz2184062


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.4-1
changelog:
  - [plugins] collect strings before commands
    Resolves: bz2203141
  - [collector] collect report from primary node if in node_list
    Resolves: bz2186460
  - [powerpc] collect invscout logs
    Resolves: bz2210543
  - [rhc] New plugin for RHC
    Resolves: bz2196649


author: Jan Jansky <jjansky@redhat.com> = 4.5.5-1
changelog:
  - [clean] Respect permissions of sanitised files
    Resolves: bz2218279
  - [plugin] Fix exception when calling os.makedirs
    Resolves: bz2216608
  - [cleaner] Enhance trailing characters list after AMC address
    Resolves: bz2207562


author: Jan Jansky <jjansky@redhat.com> = 4.5.5-2
changelog:
  - Adding patch for mac obfuscation
    Resolves: bz2218279
    Resolves: bz2216608
    Resolves: bz2207562


author: Pavel Moravec <pmoravec@redhat.com> = 4.6.1-1
changelog:
  - rebase to upstream 4.6.1
    Resolves: RHEL-21173
  - [redhat] Change authentication method for RHEL
    Resolves: RHEL-21177


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> 0.2-4
changelog:
  - CLKRN-1038: deleted redundant ovz specific sysctl vm.force_scan_thresh
  - KB-219: fixed spec scriptlet


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> 0.1-12
changelog:
  - CLKRN-859: tune systemd-logind capabilities to make GDM GUI work on CL 8.5 (incompatibility with hidepid)


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> 0.2-12
changelog:
  - CLKRN-2076: fix posttrans profile switching reliability
  - CLKRN-2076: add deprecation warning when switching from old unsplit profiles


author: Konstantin Vaskovtsov <derkonstantin@cloudlinux.com> 0.1-10
changelog:
  - CAG-862: Add another profile: cloudlinux-latency-performance with min_perf_pct=100 and force_latency=1


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> 0.1-11
changelog:
  - CLKRN-698: add crashkernel=auto kernel parameter by default
  - CLKRN-709: fix force_latency for cloudlinux-latency-performance


author: Sérgio Basto <sergio@serjux.com> - 2.8-1
changelog:
  - Update to 2.8 more 2 patches to fix builds on non-x86 and arm
    https://bitbucket.org/multicoreware/x265/issues/404/28-fails-to-build-on-ppc64le-gnu-linux
    https://bitbucket.org/multicoreware/x265/issues/406/arm-assembly-fail-to-compile-on-18


