<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="17">
<package pkgid="15b82b500e0b614b2a53552130ea211f789bc54287956c894fa1cf7579c92757" name="bpftool" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="5d2b45e8284125290f6be08fdbad774612c719befc062b9000434da13d774d37" name="bpftool-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="de13f98da56f5eb88817b2ab94d442485bb4d174090c2efddc73ea48100fbfa9" name="kernel" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="7b66270a024a23a5efc2d7a5cb071a015c2c9141af40a08d9f01823ba91d961c" name="kernel" arch="src">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="fd81187920ace49854c7a53e959fef4d93132988884ad48cf30cd217b024a9ce" name="kernel-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="69b8ed1c62d1071eecd4aca8399497968c5a013ceb99ba797901ec19efa651d6" name="kernel-debugsource" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="c0549b0bc9f4aa539f662677f6be19bfb24a15fd6f3cbd6136eda0891d40f816" name="kernel-devel" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="649cb08addf219fd0cb35a484c91c8fda2a4128ec4d0c84dc71293457fc84528" name="kernel-source" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="ab93ae25b60243064d90ed8411a95cd18eedbf262a1264a4d7e04f0ab61be019" name="kernel-tools" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="3f1a7a017097919dde6765473ffb4d1e2634f756bc0c3225c0310f9f88f2f6a5" name="kernel-tools-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="578b478f9ffb71deae8c00000e781ec9819b0939c47a8390eecea3aec4d7f297" name="kernel-tools-devel" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="6888291d191d197753c22ff4e59c5c5cf72d814ec83b23a5208ef251024f73f7" name="perf" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="31d36ddb60f65541dce9d6aefc8b23cd0417ffe94fc5d1a573714df46da29ab6" name="perf-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="9eabbe86bb22c8e205c332cce37f2381bfafd915a9b5e06e18a848e93b7e1ceb" name="python2-perf" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="15f3dbf778b90ce48fdab7665afbf8200e177190ddd87c0e4a0d00d6882b6a3c" name="python2-perf-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="9d3e35c0090a71276672f4ce49d5ca55941a5dbbc3dc90c1debf76bf3d6604c1" name="python3-perf" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
<package pkgid="7ecf103d516141186d2ede2e17b718b501b1b2d7afc01929dba17e8d27399e7c" name="python3-perf-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.19.90" rel="2506.1.0.0331.oe2003sp4"/>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.1.0.0322" date="1743508800">- !15491  dlm: fix plock invalid read
- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- !15653  tty: goldfish: Fix free_irq() on remove
- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
- !15702  trace_events_hist: add check for return value of 'create_hist_field'
- !15708  f2fs: fix dereference of stale list iterator after loop body
- f2fs: fix dereference of stale list iterator after loop body
- tracing: Make sure trace_printk() can output as soon as it can be used
- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- !15509  ath9k_htc: fix uninit value bugs
- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
- !15505  net: sfp: fix memory leak in sfp_probe()
- trace_events_hist: add check for return value of 'create_hist_field'
- !15647  nilfs2: do not force clear folio if buffer is referenced
- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
- !15504  um: Fix out-of-bounds read in LDT setup
- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
- ARM: versatile: Add missing of_node_put in dcscb_init
- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- !15502  wifi: mac80211: fix use-after-free in chanctx code
- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
- tty: goldfish: Fix free_irq() on remove
- nilfs2: do not force clear folio if buffer is referenced
- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
- ath9k_htc: fix uninit value bugs
- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
- phy: qcom-qmp: fix struct clk leak on probe errors
- net: sfp: fix memory leak in sfp_probe()
- um: Fix out-of-bounds read in LDT setup
- wifi: mac80211: fix use-after-free in chanctx code
- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
- dlm: fix plock invalid read
- ath9k_htc: fix potential out of bounds access with invalid rxstatus-&gt;rs_keyix
- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
- can: m_can: m_can_tx_handler(): fix use after free of skb
- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.2.0.0323" date="1744200000">- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- !15377  virtio_console: eliminate anonymous module_init &amp; module_exit
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- !15784  HID: betop: check shape of output reports
- HID: betop: check shape of output reports
- !15740  ftrace: Avoid potential division by zero in function_stat_show()
- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- !15637  net_sched: sch_sfq: don't allow 1 packet limit
- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
- !15638  CVE-2022-49374
- !15692  tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- !15691  media: uvcvideo: Fix double free in error path
- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
- dmaengine: Fix double increment of client_count in dma_chan_get()
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
- ftrace: Avoid potential division by zero in function_stat_show()
- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- !15632  macsec: fix UAF bug for real_dev
- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- !15688  usb: usbip: fix a refcount leak in stub_probe()
- !15713  CVE-2022-49370
- !15712  drbd: Fix five use after free bugs in get_initial_state
- !15619  partitions: mac: fix handling of bogus partition table
- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
- !15720  nfc: nci: add flush_workqueue to prevent uaf
- phy: qcom-qmp: fix reset-controller leak on probe errors
- nfc: nci: add flush_workqueue to prevent uaf
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
- drbd: Fix five use after free bugs in get_initial_state
- fs/dcache: fix bad unlock balance in shrink_dentry_list()
- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
- rxrpc: Fix listen() setting the bar too high for the prealloc rings
- tty: fix deadlock caused by calling printk() under tty_port-&gt;lock
- media: uvcvideo: Fix double free in error path
- usb: usbip: fix a refcount leak in stub_probe()
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
- tipc: check attribute length for bearer name
- tipc: add extack messages for bearer/media failure
- net_sched: sch_sfq: don't allow 1 packet limit
- macsec: fix UAF bug for real_dev
- partitions: mac: fix handling of bogus partition table
- cpufreq: pmac32-cpufreq: Fix refcount leak bug
- virtio_console: eliminate anonymous module_init &amp; module_exit</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.3.0.0324" date="1744804800">- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
- tty: goldfish: Use tty_port_destroy() to destroy port
- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
- !15664  CVE-2025-21858
- !15815  dm raid: fix accesses beyond end of raid member array
- !15368  nfsd: clear acl_access/acl_default after releasing them
- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
- vc_screen: don't clobber return value in vcs_read
- vc_screen: modify vcs_size() handling in vcs_read()
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- !15380  media: cx25821: Fix the warning when removing the module
- !15649  media: uvcvideo: Remove dangling pointers
- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- dm raid: fix accesses beyond end of raid member array
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- geneve: Fix use-after-free in geneve_find_dev().
- media: uvcvideo: Remove dangling pointers
- media: cx25821: Fix the warning when removing the module
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: prevent underflow in nfssvc_decode_writeargs()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2504.4.0.0325" date="1745409600">- !15624  proc: fix use-after-free in proc_get_inode()
- !15900  Backport mainline patches to avoid crash caused by rsize being 0
- !15820  io_uring: prevent opcode speculation
- !15751  fix-CVE-2022-49538
- !15914  block: fix resource leak in blk_register_queue() error path
- !15930  loop: fix UAF in mutex_spin_on_owner()
- loop: loop_set_status_from_info() check before assignment
- Revert "loop: loop_set_status_from_info() check before assignment"
- block: fix resource leak in blk_register_queue() error path
- smb: client: Update IO sizes after reconnection
- smb: client: Store original IO parameters and prevent zero IO sizes
- smb:client: smb: client: Add reverse mapping from tcon to superblocks
- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb-&gt;rsize is 0"
- !15830  ASoC: rt5645: Fix errorenous cleanup order
- ASoC: rt5645: Fix errorenous cleanup order
- io_uring: prevent opcode speculation
- ALSA: jack: Fix mutex call in snd_jack_report()
- ALSA: jack: Access input_dev under mutex
- proc: fix use-after-free in proc_get_inode()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.1.0.0326" date="1746619200">- !16154  driver: base: fix UAF when driver_attach failed
- !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
- !16153  scsi: pm8001: Fix abort all task initialization
- !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16107  qede: confirm skb is allocated before using
- !16112  mpage: fix softlockup in mpage_readahead()
- !16104  md/raid1,raid10: don't ignore IO flags
- driver: base: fix UAF when driver_attach failed
- !16151  can: peak_usb: fix use after free bugs
- scsi: pm8001: Fix abort all task initialization
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
- can: peak_usb: fix use after free bugs
- ipv6: mcast: extend RCU protection in igmp6_send()
- !16142  CVE-2023-53023
- !16077  CVE-2022-49626
- !16078  CVE-2022-49429
- net: nfc: Fix use-after-free in local_cleanup()
- !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- !16122  ndisc: extend RCU protection in ndisc_send_skb()
- !16111  arp: use RCU protection in arp_xmit()
- !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- !16109  net: Fix CVE-2025-21763
- !16126  net: openvswitch: fix leak of nested actions
- net: mdio: validate parameter addr in mdiobus_get_phy()
- net: openvswitch: fix leak of nested actions
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
- ndisc: extend RCU protection in ndisc_send_skb()
- mpage: fix softlockup in mpage_readahead()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- neighbour: use RCU protection in __neigh_notify()
- neighbour: delete redundant judgment statements
- qede: confirm skb is allocated before using
- md/raid1,raid10: don't ignore IO flags
- !16082  CVE-2021-47668
- !16089  mm/khugepaged: fix -&gt;anon_vma race
- !16071  Backport SMC patchs
- mm/khugepaged: fix -&gt;anon_vma race
- !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
- can: dev: can_restart: fix use after free bug
- can: dev: can_restart(): post buffer from the right context
- RDMA/hfi1: Prevent panic when SDMA is disabled
- sfc: fix use after free when disabling sriov
- sfc: error code if SRIOV cannot be disabled
- net/smc: fix restoring of fallback changes
- net/smc: fix closing of fallback SMC sockets
- net/smc: propagate file from SMC to TCP socket
- !16067  net: fix geneve_opt length integer overflow
- !16058  udp: Fix memory accounting leak.
- !16029  CVE-2022-49647
- !16064  ndisc: Fix CVE-2025-21764
- net: fix geneve_opt length integer overflow
- ndisc: use RCU protection in ndisc_alloc_skb()
- net: add dev_net_rcu() helper
- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
- udp: Fix memory accounting leak.
- !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- !16032  net: atm: fix use after free in lec_send()
- net: atm: fix use after free in lec_send()
- cgroup: fix kabi for css_set
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- !15993  Fix CVE-2025-37785
- !15984  vlan: enforce underlying device type
- ext4: fix OOB read when checking dotdot dir
- ext4: optimize __ext4_check_dir_entry()
- !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- vlan: enforce underlying device type
- !15953  Fix CVE-2020-36789
- !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
- drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
- staging: rtl8712: fix uninit-value in r871xu_drv_init()</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.3.0.0327" date="1747224000">- !16177  Fix CVE-2022-49850
- !16176  Fix CVE-2022-49842
- !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- !16188  nvmet: avoid potential UAF in nvmet_req_complete()
- !16238  dm ioctl: fix misbehavior if list_versions races with module loading
- !16200  drm/amdkfd: Fix an illegal memory access
- dm ioctl: fix misbehavior if list_versions races with module loading
- !16175  Fix CVE-2022-49915
- drm/amdkfd: Fix an illegal memory access
- nvmet: avoid potential UAF in nvmet_req_complete()
- ata: libata-transport: fix double ata_host_put() in ata_tport_add()
- nilfs2: fix deadlock in nilfs_count_free_blocks()
- ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
- ASoC: core: Fix use-after-free in snd_soc_exit()
- mISDN: fix misuse of put_device() in mISDN_register_device()
- mISDN: fix possible memory leak in mISDN_register_device()
- !16139  Bluetooth: Fix use after free in hci_send_acl
- !16140  NFC: NULL out the dev-&gt;rfkill to prevent UAF
- !16145  CVE-2022-49755
- usb: gadget: f_fs: Add unbind event before functionfs_unbind
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
- NFC: NULL out the dev-&gt;rfkill to prevent UAF
- Bluetooth: Fix use after free in hci_send_acl</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.4.0.0328" date="1747828800">- !15445 Add IOAPIC support for Hygon family 18h model 10h
- !15444 Add LS and IF mce types for Hygon family 18h model 7h
- !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
- !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
- !16203  ext4: fix off-by-one error in do_split
- !16221  jbd2: remove wrong sb-&gt;s_sequence check
- !16205  ext4: update s_journal_inum if it changes after journal replay
- !16288  scsi: core: Clear driver private data when retrying request
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- !15446 Add support for Hygon family 18h model 8h
- !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
- !16290  CVE-2024-57982
- !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
- mISDN: fix possible memory leak in mISDN_dsp_element_register()
- net: fix kabi broken in struct netns_xfrm
- xfrm: state: fix out-of-bounds read during lookup
- net: xfrm: Localize sequence counter per network namespace
- scsi: core: Clear driver private data when retrying request
- udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
- x86: Enhanced copy capabilities for Hygon processor
- kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
- jbd2: remove wrong sb-&gt;s_sequence check
- ext4: update s_journal_inum if it changes after journal replay
- ext4: fix off-by-one error in do_split
- EDAC/amd64: Add support for Hygon family 18h model 8h
- x86/amd_nb: Add support for Hygon family 18h model 8h
- iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
- EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
- x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2505.5.0.0329" date="1748433600">- !16353  CVE-2022-49769
- !16417  dm-bufio: don't schedule in atomic context
- !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
- dm-bufio: don't schedule in atomic context
- HID: hyperv: fix possible memory leak in mousevsc_probe()
- !16375  CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
- net_sched: sch_sfq: use a temporary work area for validating configuration
- gfs2: Check sb_bsize_shift after reading superblock
- gfs2: add validation checks for size of superblock</changelog>
  <changelog author="chenyi &lt;chenyi211@huawei.com&gt; - 4.19.90-2506.1.0.0330" date="1749038400">- !16548  mm/vmscan: don't try to reclaim hwpoison folio
- !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- !16294  fs/jfs: Prevent integer overflow in AG size calculation
- mm/vmscan: don't try to reclaim hwpoison folio
- !16534  memcg: always call cond_resched() after fn()
- memcg: always call cond_resched() after fn()
- !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
- media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
- fs/jfs: Prevent integer overflow in AG size calculation</changelog>
  <changelog author="huyizhen &lt;huyizhen2@huawei.com&gt; - 4.19.90-2506.1.0.0331" date="1749211200">- backport sched_cluster feature</changelog>
</package>
</otherdata>