Change changelog text

SonicDE/sonic-interface-libraries.spec

@@ -0,0 +1,135 @@
+%define _disable_source_fetch 0
+%define debug_package %{nil}
+
+Name:           sonic-interface-libraries
+Version:        6.4.5
+Release:        7%{?dist}
+Summary:        Foundation of the SonicDE user interface (fork of libplasma)
+
+License:        LGPL-2.0-or-later
+URL:            https://github.com/Sonic-DE/sonic-interface-libraries
+Source0:        %{url}/archive/refs/tags/v%{version}.tar.gz
+
+%global plasma_version %(echo %{version} | cut -d. -f1-3)
+
+BuildRequires:  extra-cmake-modules
+BuildRequires:  gcc-c++
+BuildRequires:  cmake(KF6Archive)
+BuildRequires:  cmake(KF6Declarative)
+BuildRequires:  cmake(KF6Su)
+BuildRequires:  cmake(KF6GlobalAccel)
+BuildRequires:  cmake(KF6Kirigami2)
+BuildRequires:  cmake(KF6Package)
+BuildRequires:  cmake(KF6Parts)
+BuildRequires:  cmake(KF6ConfigWidgets)
+BuildRequires:  cmake(KF6ColorScheme)
+BuildRequires:  kf6-rpm-macros
+BuildRequires:  cmake(KF6Solid)
+BuildRequires:  openssl-devel
+BuildRequires:  qt6-qtbase-devel
+BuildRequires:  qt6-qtbase-private-devel
+BuildRequires:  qt6-qtdeclarative-devel
+BuildRequires:  qt6-qtsvg-devel
+
+# KDE Frameworks
+BuildRequires:  cmake(KF6Config)
+BuildRequires:  cmake(KF6CoreAddons)
+BuildRequires:  cmake(KF6DBusAddons)
+BuildRequires:  cmake(KF6DocTools)
+BuildRequires:  cmake(KF6GuiAddons)
+BuildRequires:  cmake(KF6I18n)
+BuildRequires:  cmake(KF6IconThemes)
+BuildRequires:  cmake(KF6KCMUtils)
+BuildRequires:  cmake(KF6KIO)
+BuildRequires:  cmake(KF6Notifications)
+BuildRequires:  cmake(KF6Service)
+BuildRequires:  cmake(KF6Svg)
+BuildRequires:  cmake(KF6WidgetsAddons)
+BuildRequires:  cmake(KF6WindowSystem)
+BuildRequires:  cmake(KF6XmlGui)
+BuildRequires:  cmake(PlasmaWaylandProtocols)
+
+# Qt
+BuildRequires:  cmake(Qt6WaylandClient)
+
+# Plasma
+BuildRequires:  cmake(PlasmaActivities)
+
+BuildRequires:  wayland-devel
+BuildRequires:  kwayland-devel
+
+# X11 Support
+BuildRequires:  libX11-devel
+BuildRequires:  libxcb-devel
+BuildRequires:  xcb-util-devel
+BuildRequires:  libXcursor-devel
+BuildRequires:  libXrender-devel
+BuildRequires:  libXext-devel
+BuildRequires:  libXfixes-devel
+BuildRequires:  libXi-devel
+
+Provides:       libplasma%{?_isa} >= %{plasma_version}
+Provides:       libplasma >= %{plasma_version}
+Obsoletes:      libplasma <= %{plasma_version}
+	
+# Renamed from kf6-plasma
+Obsoletes:      kf6-plasma < 1:%{version}-%{release}
+Provides:       kf6-plasma = 1:%{version}-%{release}
+
+%description
+Sonic Interface Libraries is a fork of libplasma, providing the foundational
+libraries for themes, applets, and widgets in SonicDE.
+
+%package        devel
+Summary:        Development files for %{name}
+Requires:       %{name}%{?_isa} = %{version}-%{release}
+Requires:       cmake(KF6Package)
+Requires:       qt6-qtbase-devel
+Requires:       cmake(KF6Service)
+Requires:       cmake(KF6WindowSystem)
+Provides:       libplasma-devel%{?_isa} >= %{plasma_version}
+Provides:       libplasma-devel >= %{plasma_version}
+Obsoletes:      libplasma-devel <= %{plasma_version}
+
+Obsoletes:      kf6-plasma-devel < 1:%{version}-%{release}
+Provides:       kf6-plasma-devel = 1:%{version}-%{release}
+
+%description    devel
+Development files for sonic-interface-libraries.
+
+%prep
+%autosetup -p1
+
+%build
+%cmake_kf6
+%cmake_build
+
+%install
+%cmake_install
+%find_lang %{name} --all-name
+
+%files -f %{name}.lang
+%license LICENSES/*
+%{_libdir}/libPlasma.so.*
+%{_libdir}/libPlasmaQuick.so.*
+%{_qt6_plugindir}/kf6/
+%{_qt6_qmldir}/org/kde/plasma/
+%{_qt6_qmldir}/org/kde/kirigami/styles/Plasma/
+%{_datadir}/plasma/
+%{_datadir}/qlogging-categories6/*.categories
+%{_datadir}/qlogging-categories6/*.renamecategories
+
+%files devel
+%{_includedir}/Plasma/
+%{_includedir}/PlasmaQuick/
+%{_libdir}/libPlasma.so
+%{_libdir}/libPlasmaQuick.so
+%{_libdir}/cmake/Plasma/
+%{_libdir}/cmake/PlasmaQuick/
+%{_datadir}/doc/qt6/Plasma.qch
+%{_datadir}/doc/qt6/Plasma.tags
+%{_datadir}/kdevappwizard/templates/*.tar.bz2
+
+%changelog
+* Wed Mar 21 2026 Anders da Silva Rytter Hansen <andersrh@users.noreply.github.com> - 6.4.5-7
+- Initial release of SonicDE/KDE Plasma X11 for EL10 (Downgraded to 6.4.5 for EL 10.1 compatibility)

SonicDE/sonic-win.spec

@@ -0,0 +1,205 @@
+%define _disable_source_fetch 0
+%define debug_package %{nil}
+
+Name:           sonic-win
+Version:        6.4.5
+Release:        8%{?dist}
+Summary:        KWin window manager for SonicDE (fork of kwin)
+
+%global plasma_version %{version}
+
+License:        GPL-2.0-or-later
+URL:            https://github.com/Sonic-DE/sonic-win
+Source0:        %{url}/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz
+
+BuildRequires:  extra-cmake-modules
+BuildRequires:  kf6-rpm-macros
+BuildRequires:  systemd-rpm-macros
+
+# Qt
+BuildRequires:  cmake(QAccessibilityClient6)
+BuildRequires:  qt6-qtbase-devel
+BuildRequires:  qt6-qtbase-private-devel
+BuildRequires:  qt6-qtsensors-devel
+BuildRequires:  qt6-qttools-devel
+BuildRequires:  qt6-qtwayland-devel
+BuildRequires:  cmake(Qt6Core5Compat)
+BuildRequires:  cmake(Qt6Svg)
+BuildRequires:  cmake(Qt6Multimedia)
+
+# X11/OpenGL
+BuildRequires:  pkgconfig(libxcvt)
+BuildRequires:  mesa-libGL-devel
+BuildRequires:  mesa-libEGL-devel
+BuildRequires:  mesa-libgbm-devel
+BuildRequires:  libxkbcommon-devel
+BuildRequires:  libxkbcommon-x11-devel
+BuildRequires:  libX11-devel
+BuildRequires:  libXi-devel
+BuildRequires:  libxcb-devel
+BuildRequires:  libICE-devel
+BuildRequires:  libSM-devel
+BuildRequires:  libXcursor-devel
+BuildRequires:  xcb-util-wm-devel
+BuildRequires:  xcb-util-image-devel
+BuildRequires:  xcb-util-keysyms-devel
+BuildRequires:  xcb-util-cursor-devel
+BuildRequires:  xcb-util-devel
+BuildRequires:  libepoxy-devel
+BuildRequires:  libcap-devel
+
+BuildRequires:  lcms2-devel
+BuildRequires:  glib2-devel
+BuildRequires:  pipewire-devel
+
+# Wayland
+BuildRequires:  wayland-devel >= 1.22.0
+BuildRequires:  wayland-protocols-devel
+BuildRequires:  pkgconfig(libinput) >= 0.10
+BuildRequires:  pkgconfig(libudev)
+
+%if 0%{?rhel} == 10
+# Integrate with Xlibre on EL10
+BuildRequires:  xlibre-xserver-devel
+Requires:       xlibre-xserver-Xorg
+Requires:       xlibre-xf86-input-libinput
+%else
+BuildRequires:  pkgconfig(xwayland)
+%endif
+
+# KF6
+BuildRequires:  cmake(KF6Completion)
+BuildRequires:  cmake(KF6Config)
+BuildRequires:  cmake(KF6ConfigWidgets)
+BuildRequires:  cmake(KF6CoreAddons)
+BuildRequires:  cmake(KF6Crash)
+BuildRequires:  cmake(KF6DBusAddons)
+BuildRequires:  cmake(KF6GlobalAccel)
+BuildRequires:  cmake(KF6GuiAddons)
+BuildRequires:  cmake(KF6I18n)
+BuildRequires:  cmake(KF6KIO)
+BuildRequires:  cmake(KF6Notifications)
+BuildRequires:  cmake(KF6Service)
+BuildRequires:  cmake(KF6WidgetsAddons)
+BuildRequires:  cmake(KF6WindowSystem)
+BuildRequires:  cmake(KF6DocTools)
+BuildRequires:  cmake(KF6KCMUtils)
+BuildRequires:  cmake(KF6NewStuff)
+BuildRequires:  cmake(KF6Declarative)
+BuildRequires:  cmake(KF6IconThemes)
+BuildRequires:  cmake(KF6IdleTime)
+BuildRequires:  cmake(KF6TextWidgets)
+BuildRequires:  cmake(KF6Kirigami2)
+BuildRequires:  cmake(KF6Runner)
+BuildRequires:  cmake(KF6Svg)
+
+# Workspace components
+BuildRequires:  cmake(KDecoration3)
+BuildRequires:  kscreenlocker-devel
+BuildRequires:  plasma-breeze-devel
+BuildRequires:  plasma-wayland-protocols-devel
+BuildRequires:  cmake(KGlobalAccelD)
+BuildRequires:  libdisplay-info-devel
+
+BuildRequires:  cmake(KWayland)
+BuildRequires:  cmake(Plasma)
+BuildRequires:  cmake(PlasmaActivities)
+
+BuildRequires:  libeis-devel
+BuildRequires:  pkgconfig(libcanberra)
+
+# Conflicts with kwin-x11
+Conflicts:      kwin-x11
+
+Requires:       sonic-interface-libraries%{?_isa} >= %{plasma_version}
+Requires:       kscreenlocker%{?_isa}
+Requires:       kf6-kirigami2%{?_isa}
+Requires:       kf6-kdeclarative%{?_isa}
+Requires:       qt6-qtmultimedia%{?_isa}
+Requires:       qt6-qtdeclarative%{?_isa}
+
+%description
+Sonic Win is a fork of KWin, the window manager and compositor for SonicDE,
+focusing on an optimized X11 experience.
+
+%package        libs
+Summary:        KWin libraries for SonicDE
+Conflicts:      kwin-x11-libs
+
+%description    libs
+Shared libraries for sonic-win.
+
+%package        devel
+Summary:        Development files for %{name}
+Requires:       %{name}-libs%{?_isa} = %{version}-%{release}
+Requires:       %{name}%{?_isa} = %{version}-%{release}
+Conflicts:      kwin-x11-devel
+
+%description    devel
+Development files for sonic-win.
+Provides:       kwin-devel = %{version}-%{release}
+Provides:       kwin-x11-devel = %{version}-%{release}
+Provides:       cmake(KWinDBusInterface) = %{version}
+
+%prep
+%autosetup -p1
+
+%build
+%cmake_kf6
+%cmake_build
+
+%install
+%cmake_install
+# Create compatibility CMake files for sonic-workspace
+mkdir -p %{buildroot}%{_libdir}/cmake/KWinDBusInterface
+cat <<EOF > %{buildroot}%{_libdir}/cmake/KWinDBusInterface/KWinDBusInterfaceConfig.cmake
+find_package(KWinX11DBusInterface REQUIRED)
+include(\${KWinX11DBusInterface_DIR}/KWinX11DBusInterfaceConfig.cmake)
+EOF
+
+# Create compatibility symlinks for DBus interfaces
+pushd %{buildroot}%{_datadir}/dbus-1/interfaces/
+for f in kwin_x11_*.xml; do
+    newname=$(echo $f | sed 's/kwin_x11_//')
+    ln -s "$f" "$newname"
+done
+popd
+
+# The translation domain in the source is likely still 'kwin'
+%find_lang kwin --all-name --with-html
+
+%files -f kwin.lang
+%license LICENSES/*
+# Binares and specialized folders
+%{_bindir}/kwin_x11
+%{_libdir}/kconf_update_bin/kwin*
+%{_libexecdir}/kwin*
+%{_userunitdir}/plasma-kwin_x11.service
+
+# Database and plugins
+%{_libdir}/qt6/plugins/
+%{_qt6_qmldir}/org/kde/*/
+
+# Data and Assets
+%{_datadir}/kwin-x11/
+%{_datadir}/applications/*.desktop
+%{_datadir}/dbus-1/interfaces/*.xml
+%{_datadir}/icons/hicolor/*/apps/kwin-x11.*
+%{_datadir}/kconf_update/kwin-x11.upd
+%{_datadir}/knotifications6/kwin-x11.notifyrc
+%{_datadir}/knsrcfiles/*.knsrc
+%{_datadir}/krunner/dbusplugins/*.desktop
+%{_datadir}/qlogging-categories6/*.categories
+
+%files libs
+# Libraries
+%{_libdir}/lib*.so.*
+
+%files devel
+%{_includedir}/
+%{_libdir}/lib*.so
+%{_libdir}/cmake/
+
+%changelog
+* Wed Mar 21 2026 Anders da Silva Rytter Hansen <andersrh@users.noreply.github.com> - 6.4.5-8
+- Initial release of SonicDE/KDE Plasma X11 for EL10 (Downgraded to 6.4.5 for EL 10.1 compatibility)

SonicDE/sonic-workspace.spec

@@ -0,0 +1,268 @@
+%define _disable_source_fetch 0
+%define debug_package %{nil}
+
+Name:           sonic-workspace
+Version:        6.4.5
+Release:        5%{?dist}
+Summary:        Core workspace components for SonicDE (fork of plasma-workspace)
+
+License:        GPL-2.0-or-later
+URL:            https://github.com/Sonic-DE/sonic-workspace
+Source0:        %{url}/archive/refs/tags/v%{version}.tar.gz
+
+%global plasma_version %(echo %{version} | cut -d. -f1-3)
+
+BuildRequires:  extra-cmake-modules
+BuildRequires:  kf6-rpm-macros
+BuildRequires:  qt6-qtbase-devel
+BuildRequires:  qt6-qtbase-private-devel
+BuildRequires:  qt6-qtdeclarative-devel
+BuildRequires:  qt6-qtdeclarative-private-devel
+BuildRequires:  qt6-qtsvg-devel
+BuildRequires:  qt6-qtwayland-devel
+BuildRequires:  qt6-qtlocation-devel
+BuildRequires:  qt6-qtshadertools-devel
+BuildRequires:  qcoro-qt6-devel
+BuildRequires:  phonon-qt6-devel
+BuildRequires:  wayland-devel
+BuildRequires:  wayland-protocols-devel
+BuildRequires:  plasma-wayland-protocols-devel
+BuildRequires:  cmake(Qt6Core5Compat)
+
+BuildRequires:  cmake(KF6Config)
+BuildRequires:  cmake(KF6Archive)
+BuildRequires:  cmake(KF6Declarative)
+BuildRequires:  cmake(KF6ConfigWidgets)
+BuildRequires:  cmake(KF6CoreAddons)
+BuildRequires:  cmake(KF6Crash)
+BuildRequires:  cmake(KF6DBusAddons)
+BuildRequires:  cmake(KF6GlobalAccel)
+BuildRequires:  cmake(KF6GuiAddons)
+BuildRequires:  cmake(KF6I18n)
+BuildRequires:  cmake(KF6IdleTime)
+BuildRequires:  cmake(KF6KIO)
+BuildRequires:  cmake(KF6Notifications)
+BuildRequires:  cmake(KF6NotifyConfig)
+BuildRequires:  cmake(KF6Runner)
+BuildRequires:  cmake(KF6Service)
+BuildRequires:  cmake(KF6Solid)
+BuildRequires:  cmake(KF6WidgetsAddons)
+BuildRequires:  cmake(KF6WindowSystem)
+BuildRequires:  cmake(KF6XmlGui)
+BuildRequires:  cmake(KF6DocTools)
+BuildRequires:  cmake(KF6ItemModels)
+BuildRequires:  cmake(KF6KDED)
+BuildRequires:  cmake(KF6StatusNotifierItem)
+BuildRequires:  cmake(KF6UnitConversion)
+BuildRequires:  cmake(KF6Wallet)
+BuildRequires:  cmake(KF6KCMUtils)
+BuildRequires:  cmake(KF6NewStuff)
+BuildRequires:  cmake(KF6Package)
+BuildRequires:  cmake(KF6Parts)
+BuildRequires:  cmake(KF6Prison)
+BuildRequires:  cmake(KF6Sonnet)
+BuildRequires:  cmake(KF6TextEditor)
+BuildRequires:  cmake(KF6TextWidgets)
+BuildRequires:  cmake(KF6Svg)
+BuildRequires:  cmake(KF6Kirigami2)
+BuildRequires:  cmake(KF6KirigamiAddons)
+BuildRequires:  cmake(KF6NetworkManagerQt)
+BuildRequires:  cmake(KF6QuickCharts)
+BuildRequires:  cmake(KF6UserFeedback)
+BuildRequires:  cmake(KF6Baloo)
+BuildRequires:  cmake(KF6Holidays)
+BuildRequires:  kf6-kdesu-devel
+BuildRequires:  pkgconfig(libqalculate)
+BuildRequires:  sonic-win-devel
+BuildRequires:  sonic-interface-libraries-devel
+BuildRequires:  kdecoration-devel
+BuildRequires:  libkscreen-devel
+BuildRequires:  libksysguard-devel
+BuildRequires:  plasma-activities-devel
+BuildRequires:  cmake(KSysGuard)
+BuildRequires:  cmake(Plasma5Support)
+BuildRequires:  cmake(KScreenLocker)
+BuildRequires:  cmake(Breeze)
+BuildRequires:  cmake(KExiv2Qt6)
+BuildRequires:  cmake(KPipeWire)
+BuildRequires:  cmake(PlasmaActivities)
+BuildRequires:  cmake(PlasmaActivitiesStats)
+BuildRequires:  cmake(KF6Screen)
+BuildRequires:  cmake(KWayland)
+BuildRequires:  cmake(Plasma)
+BuildRequires:  cmake(PlasmaQuick)
+BuildRequires:  cmake(LayerShellQt)
+
+BuildRequires:  pkgconfig(x11)
+BuildRequires:  pkgconfig(xau)
+BuildRequires:  pkgconfig(xcb)
+BuildRequires:  pkgconfig(xcomposite)
+BuildRequires:  pkgconfig(xcursor)
+BuildRequires:  pkgconfig(xdamage)
+BuildRequires:  pkgconfig(xext)
+BuildRequires:  pkgconfig(xfixes)
+BuildRequires:  pkgconfig(xft)
+BuildRequires:  pkgconfig(xi)
+BuildRequires:  pkgconfig(xinerama)
+BuildRequires:  pkgconfig(xres)
+BuildRequires:  pkgconfig(xkbcommon)
+BuildRequires:  pkgconfig(xkbfile)
+BuildRequires:  pkgconfig(xpm)
+BuildRequires:  pkgconfig(xrender)
+BuildRequires:  pkgconfig(xtst)
+BuildRequires:  pkgconfig(xxf86vm)
+BuildRequires:  pkgconfig(ice)
+BuildRequires:  pkgconfig(sm)
+BuildRequires:  pkgconfig(xcb-aux)
+BuildRequires:  pkgconfig(xcb-cursor)
+BuildRequires:  pkgconfig(xcb-image)
+BuildRequires:  pkgconfig(xcb-event)
+BuildRequires:  pkgconfig(xcb-util)
+BuildRequires:  pkgconfig(xcb-keysyms)
+BuildRequires:  pkgconfig(xcb-icccm)
+BuildRequires:  pkgconfig(xcb-renderutil)
+BuildRequires:  pkgconfig(xcb-atom)
+BuildRequires:  pkgconfig(xcb-ewmh)
+BuildRequires:  systemd-devel
+BuildRequires:  NetworkManager-libnm-devel
+BuildRequires:  glib2-devel
+BuildRequires:  polkit-qt6-1-devel
+BuildRequires:  PackageKit-Qt6-devel
+BuildRequires:  appstream-qt-devel
+BuildRequires:  iso-codes-devel
+BuildRequires:  libcanberra-devel
+BuildRequires:  fontconfig-devel
+BuildRequires:  zlib-devel
+BuildRequires:  libicu-devel
+
+Requires:       sonic-win
+Requires:       xmessage
+Requires:       xprop
+Requires:       xrdb
+Requires:       xsetroot
+
+Conflicts:      plasma-workspace-x11
+
+Provides:       plasma-workspace%{?_isa} >= %{plasma_version}
+Provides:       plasma-workspace >= %{plasma_version}
+Obsoletes:      plasma-workspace <= %{plasma_version}
+
+Provides:       plasma-workspace-libs%{?_isa} >= %{plasma_version}
+Provides:       plasma-workspace-libs >= %{plasma_version}
+Obsoletes:      plasma-workspace-libs <= %{plasma_version}
+
+Provides:       libkworkspace6%{?_isa} >= %{plasma_version}
+Provides:       libkworkspace6 >= %{plasma_version}
+Obsoletes:      libkworkspace6 <= %{plasma_version}
+
+Provides:       desktop-notification-daemon
+
+%description
+Core workspace components for SonicDE, fork of plasma-workspace.
+
+%package        devel
+Summary:        Development files for %{name}
+Requires:       %{name}%{?_isa} = %{version}-%{release}
+Conflicts:      plasma-workspace-devel
+
+%description    devel
+Development files for sonic-workspace.
+
+%package        x11
+Summary:        SonicDE X11 session
+#Requires:       %{name}%{?_isa} = %{version}-%{release}
+Requires:       xlibre-xserver-Xorg
+Conflicts:      plasma-workspace-x11
+
+%description    x11
+SonicDE X11 session.
+
+%prep
+%autosetup -p1
+
+%build
+%cmake_kf6
+%cmake_build
+
+%install
+%cmake_install
+# Many translation files have different names than the package
+%find_lang plasmanetworkmanagement --all-name || :
+%find_lang plasmashell --all-name || :
+
+%files
+%license LICENSES/*
+%{_bindir}/plasma*
+%{_bindir}/krunner
+%{_bindir}/ksmserver
+%{_bindir}/ksplashqml
+%{_bindir}/kcminit*
+%{_bindir}/kde-systemd-start-condition
+%{_bindir}/lookandfeeltool
+%{_bindir}/kcolorschemeeditor
+%{_bindir}/kfontinst
+%{_bindir}/kfontview
+%{_bindir}/xembedsniproxy
+%{_bindir}/gmenudbusmenuproxy
+%{_bindir}/startplasma-wayland
+%{_libdir}/lib*.so.*
+%{_libdir}/kconf_update_bin/
+%{_libexecdir}/ksmserver-logout-greeter
+%{_libexecdir}/plasma*
+%{_libexecdir}/kf6/kauth/
+%{_libexecdir}/kfontprint
+%{_libexecdir}/baloorunner
+%{_qt6_plugindir}/plasma/
+%{_qt6_plugindir}/kf6/
+%{_qt6_plugindir}/phonon_platform/
+%{_qt6_plugindir}/plasma5support/
+%{_qt6_plugindir}/plasmacalendarplugins/
+%{_qt6_qmldir}/org/kde/
+%{_userunitdir}/plasma*
+%{_datadir}/plasma/
+%{_datadir}/plasma5support/
+%{_datadir}/applications/*.desktop
+%{_datadir}/desktop-directories/
+%{_datadir}/config.kcfg/
+%{_datadir}/dbus-1/
+%{_datadir}/doc/
+%{_datadir}/icons/
+%{_datadir}/kconf_update/
+%{_datadir}/kfontinst/
+%{_datadir}/kglobalaccel/
+%{_datadir}/kio*/
+%{_datadir}/knotifications6/
+%{_datadir}/knsrcfiles/
+%{_datadir}/konqsidebartng/
+%{_datadir}/krunner/
+%{_datadir}/kstyle/
+%{_datadir}/kxmlgui5/
+%{_datadir}/polkit-1/
+%{_datadir}/qlogging-categories6/
+%{_datadir}/solid/
+%{_datadir}/timezonefiles/
+%{_datadir}/wayland-sessions/
+%{_datadir}/xdg-desktop-portal/
+%{_datadir}/zsh/
+%{_datadir}/locale/*/LC_MESSAGES/*.mo
+%{_sysconfdir}/xdg/*
+
+%files devel
+%defattr(-,root,root,-)
+%{_includedir}/kworkspace6/
+%{_includedir}/taskmanager/
+%{_includedir}/notificationmanager/
+%{_includedir}/colorcorrect/
+%{_includedir}/krdb/
+%{_includedir}/plasma5support/
+%{_libdir}/lib*.so
+%{_libdir}/cmake/*/
+
+%files x11
+%defattr(-,root,root,-)
+%{_datadir}/xsessions/plasmax11.desktop
+%{_bindir}/startplasma-x11
+
+%changelog
+* Wed Mar 21 2026 Anders da Silva Rytter Hansen <andersrh@users.noreply.github.com> - 6.4.5-5
+- Initial release of SonicDE/KDE Plasma X11 for EL10 (Downgraded to 6.4.5 for EL 10.1 compatibility)

my-ostree-os/kernel/0001-Add-support-for-Android-container-and-disable-unnece.patch

@@ -0,0 +1,74 @@
+From 5c7a64a5034b59607558361fb7309b425ee4b1a5 Mon Sep 17 00:00:00 2001
+From: Anders da Silva Rytter Hansen <andersrh@users.noreply.github.com>
+Date: Sun, 30 Nov 2025 10:09:30 -0300
+Subject: [PATCH] Add support for Android container and disable unnecessary
+ kernels such as RT etc.
+
+---
+ my-ostree-os/kernel/kernel.spec | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+diff --git a/my-ostree-os/kernel/kernel.spec b/my-ostree-os/kernel/kernel.spec
+index 2f11cd8..ae9abc3 100644
+--- a/my-ostree-os/kernel/kernel.spec
++++ b/my-ostree-os/kernel/kernel.spec
+@@ -172,7 +172,7 @@ Summary: The Linux kernel
+ #  to build the base kernel using the debug configuration. (Specifying
+ #  the --with-release option overrides this setting.)
+ %define debugbuildsenabled 1
+-# define buildid .local
++%define buildid .andersdsrhcustom1
+ %define specrpmversion 6.12.0
+ %define specversion 6.12.0
+ %define patchversion 6.12
+@@ -213,19 +213,19 @@ Summary: The Linux kernel
+ # build the base variants
+ %define with_base      %{?_without_base:      0} %{?!_without_base:      1}
+ # build also debug variants
+-%define with_debug     %{?_without_debug:     0} %{?!_without_debug:     1}
++%define with_debug     0
+ # kernel-zfcpdump (s390 specific kernel for zfcpdump)
+-%define with_zfcpdump  %{?_without_zfcpdump:  0} %{?!_without_zfcpdump:  1}
++%define with_zfcpdump  0
+ # kernel-16k (aarch64 kernel with 16K page_size)
+-%define with_arm64_16k %{?_with_arm64_16k:    1} %{?!_with_arm64_16k:    0}
++%define with_arm64_16k 0
+ # kernel-64k (aarch64 kernel with 64K page_size)
+-%define with_arm64_64k %{?_without_arm64_64k: 0} %{?!_without_arm64_64k: 1}
++%define with_arm64_64k 0
+ # kernel-rt (x86_64 and aarch64 only PREEMPT_RT enabled kernel)
+-%define with_realtime  %{?_without_realtime:  0} %{?!_without_realtime:  1}
++%define with_realtime  0
+ # kernel-rt-64k (aarch64 RT kernel with 64K page_size)
+-%define with_realtime_arm64_64k %{?_without_realtime_arm64_64k: 0} %{?!_without_realtime_arm64_64k: 1}
++%define with_realtime_arm64_64k 0
+ # kernel-automotive (x86_64 and aarch64 with PREEMPT_RT enabled - currently off by default)
+-%define with_automotive %{?_with_automotive:  1} %{?!_with_automotive:   0}
++%define with_automotive 0
+ 
+ # Supported variants
+ #            with_base with_debug    with_gcov
+@@ -2265,6 +2265,20 @@ InitBuildVars() {
+     sed -i 's/^\(CONFIG_DEBUG_INFO.*\)=y/# \1 is not set/' .config
+ %endif
+ 
++    sed -i \
++    -e "/CONFIG_ANDROID_BINDER_IPC/d" \
++    -e "/CONFIG_ANDROID_BINDERFS/d" \
++    -e "/CONFIG_ANDROID_BINDER_DEVICES/d" \
++    -e "/CONFIG_ANDROID_BINDER_IPC_SELFTEST/d" .config \
++    -e "/CONFIG_PSI_DEFAULT_DISABLED/d" .config
++
++    echo -e "\n# Custom Android Binder Settings" >> .config
++    echo "CONFIG_ANDROID_BINDER_IPC=y" >> .config
++    echo "CONFIG_ANDROID_BINDERFS=y" >> .config
++    echo "CONFIG_ANDROID_BINDER_DEVICES=\"binder,hwbinder,vndbinder\"" >> .config
++    echo "CONFIG_ANDROID_BINDER_IPC_SELFTEST=n" >> .config
++    echo "CONFIG_PSI_DEFAULT_DISABLED=n" >> .config
++
+     Arch=`head -1 .config | cut -b 3-`
+     %{log_msg "InitBuildVars: USING ARCH=$Arch"}
+ 
+-- 
+2.52.0
+

my-ostree-os/kernel/Makefile.rhelver

@@ -12,7 +12,7 @@ RHEL_MINOR = 1
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 124.8.1
+RHEL_RELEASE = 124.38.1
 
 #
 # RHEL_REBASE_NUM

my-ostree-os/kernel/Module.kabi_x86_64

@@ -64,6 +64,7 @@
 0x07bdb893	__ip_dev_find	vmlinux	EXPORT_SYMBOL	
 0x0d542439	__ipv6_addr_type	vmlinux	EXPORT_SYMBOL	
 0x199c4833	__irq_apply_affinity_hint	vmlinux	EXPORT_SYMBOL_GPL	
+0xe08433f8	__kabi__alt_instr	vmlinux	EXPORT_SYMBOL_GPL	
 0xb47efcb0	__kmalloc_cache_node_noprof	vmlinux	EXPORT_SYMBOL	
 0xb34f2269	__kmalloc_cache_noprof	vmlinux	EXPORT_SYMBOL	
 0xa67f04f8	__kmalloc_large_node_noprof	vmlinux	EXPORT_SYMBOL	

my-ostree-os/kernel/Module.kabi_x86_64_v2

@@ -64,6 +64,7 @@
 0x07bdb893	__ip_dev_find	vmlinux	EXPORT_SYMBOL	
 0x0d542439	__ipv6_addr_type	vmlinux	EXPORT_SYMBOL	
 0x199c4833	__irq_apply_affinity_hint	vmlinux	EXPORT_SYMBOL_GPL	
+0xe08433f8	__kabi__alt_instr	vmlinux	EXPORT_SYMBOL_GPL	
 0xb47efcb0	__kmalloc_cache_node_noprof	vmlinux	EXPORT_SYMBOL	
 0xb34f2269	__kmalloc_cache_noprof	vmlinux	EXPORT_SYMBOL	
 0xa67f04f8	__kmalloc_large_node_noprof	vmlinux	EXPORT_SYMBOL	

my-ostree-os/kernel/kernel-aarch64-64k-debug-rhel.config

@@ -1287,7 +1287,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -3040,7 +3040,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -8418,6 +8417,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-aarch64-64k-rhel.config

@@ -1287,7 +1287,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -3024,7 +3024,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -8393,6 +8392,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-aarch64-debug-rhel.config

@@ -1285,7 +1285,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -3037,7 +3037,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -8414,6 +8413,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-aarch64-rhel.config

@@ -1285,7 +1285,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -3021,7 +3021,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -8389,6 +8388,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-aarch64-rt-64k-debug-rhel.config

@@ -1288,7 +1288,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -3081,7 +3081,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -8473,6 +8472,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-aarch64-rt-64k-rhel.config

@@ -1288,7 +1288,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -3065,7 +3065,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -8448,6 +8447,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-aarch64-rt-debug-rhel.config

@@ -1286,7 +1286,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -3078,7 +3078,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -8469,6 +8468,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-aarch64-rt-rhel.config

@@ -1286,7 +1286,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -3062,7 +3062,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -8444,6 +8443,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-ppc64le-debug-rhel.config

@@ -1050,7 +1050,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2701,7 +2701,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -7845,6 +7844,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-ppc64le-rhel.config

@@ -1050,7 +1050,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2685,7 +2685,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -7822,6 +7821,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-s390x-debug-rhel.config

@@ -1046,7 +1046,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2685,7 +2685,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -7827,6 +7826,9 @@ CONFIG_ZCRYPT_MULTIDEVNODES=y
 CONFIG_ZFCP=m
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+# CONFIG_ZL3073X_I2C is not set
+# CONFIG_ZL3073X is not set
+# CONFIG_ZL3073X_SPI is not set
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-s390x-rhel.config

@@ -1046,7 +1046,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2669,7 +2669,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -7804,6 +7803,9 @@ CONFIG_ZCRYPT_MULTIDEVNODES=y
 CONFIG_ZFCP=m
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+# CONFIG_ZL3073X_I2C is not set
+# CONFIG_ZL3073X is not set
+# CONFIG_ZL3073X_SPI is not set
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-s390x-zfcpdump-rhel.config

@@ -1047,7 +1047,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2675,7 +2675,6 @@ CONFIG_INTEL_SDSI=m
 # CONFIG_INTEL_SOC_PMIC_CHTWC is not set
 # CONFIG_INTEL_SOC_PMIC is not set
 # CONFIG_INTEL_TCC_COOLING is not set
-# CONFIG_INTEL_TDX_HOST is not set
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH is not set
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
@@ -7825,6 +7824,9 @@ CONFIG_ZCRYPT_MULTIDEVNODES=y
 CONFIG_ZFCP=y
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+# CONFIG_ZL3073X_I2C is not set
+# CONFIG_ZL3073X is not set
+# CONFIG_ZL3073X_SPI is not set
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-x86_64-debug-rhel.config

@@ -1104,7 +1104,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2592,7 +2592,7 @@ CONFIG_I2C_MUX=m
 CONFIG_I2C_MUX_MLXCPLD=m
 # CONFIG_I2C_MUX_MULE is not set
 # CONFIG_I2C_MUX_PCA9541 is not set
-# CONFIG_I2C_MUX_PCA954x is not set
+CONFIG_I2C_MUX_PCA954x=m
 # CONFIG_I2C_MUX_REG is not set
 CONFIG_I2C_NFORCE2=m
 CONFIG_I2C_NFORCE2_S4985=m
@@ -2916,7 +2916,7 @@ CONFIG_INTEL_SKL_INT3472=m
 CONFIG_INTEL_SPEED_SELECT_INTERFACE=m
 CONFIG_INTEL_TCC_COOLING=m
 CONFIG_INTEL_TDX_GUEST=y
-# CONFIG_INTEL_TDX_HOST is not set
+CONFIG_INTEL_TDX_HOST=y
 CONFIG_INTEL_TH_ACPI=m
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH_DEBUG is not set
@@ -3294,6 +3294,7 @@ CONFIG_KVM_GUEST=y
 CONFIG_KVM_HYPERV=y
 CONFIG_KVM_INTEL=m
 # CONFIG_KVM_INTEL_PROVE_VE is not set
+CONFIG_KVM_INTEL_TDX=y
 CONFIG_KVM=m
 CONFIG_KVM_MAX_NR_VCPUS=4096
 CONFIG_KVM_MMU_AUDIT=y
@@ -3867,6 +3868,7 @@ CONFIG_MITIGATION_SSB=y
 CONFIG_MITIGATION_TAA=y
 CONFIG_MITIGATION_TSA=y
 CONFIG_MITIGATION_UNRET_ENTRY=y
+CONFIG_MITIGATION_VMSCAPE=y
 # CONFIG_MK8 is not set
 CONFIG_MLX4_CORE_GEN2=y
 CONFIG_MLX4_CORE=m
@@ -8321,6 +8323,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-x86_64-rhel.config

@@ -1104,7 +1104,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2576,7 +2576,7 @@ CONFIG_I2C_MUX=m
 CONFIG_I2C_MUX_MLXCPLD=m
 # CONFIG_I2C_MUX_MULE is not set
 # CONFIG_I2C_MUX_PCA9541 is not set
-# CONFIG_I2C_MUX_PCA954x is not set
+CONFIG_I2C_MUX_PCA954x=m
 # CONFIG_I2C_MUX_REG is not set
 CONFIG_I2C_NFORCE2=m
 CONFIG_I2C_NFORCE2_S4985=m
@@ -2900,7 +2900,7 @@ CONFIG_INTEL_SKL_INT3472=m
 CONFIG_INTEL_SPEED_SELECT_INTERFACE=m
 CONFIG_INTEL_TCC_COOLING=m
 CONFIG_INTEL_TDX_GUEST=y
-# CONFIG_INTEL_TDX_HOST is not set
+CONFIG_INTEL_TDX_HOST=y
 CONFIG_INTEL_TH_ACPI=m
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH_DEBUG is not set
@@ -3274,6 +3274,7 @@ CONFIG_KVM_GUEST=y
 CONFIG_KVM_HYPERV=y
 CONFIG_KVM_INTEL=m
 # CONFIG_KVM_INTEL_PROVE_VE is not set
+CONFIG_KVM_INTEL_TDX=y
 CONFIG_KVM=m
 CONFIG_KVM_MAX_NR_VCPUS=4096
 CONFIG_KVM_MMU_AUDIT=y
@@ -3847,6 +3848,7 @@ CONFIG_MITIGATION_SSB=y
 CONFIG_MITIGATION_TAA=y
 CONFIG_MITIGATION_TSA=y
 CONFIG_MITIGATION_UNRET_ENTRY=y
+CONFIG_MITIGATION_VMSCAPE=y
 # CONFIG_MK8 is not set
 CONFIG_MLX4_CORE_GEN2=y
 CONFIG_MLX4_CORE=m
@@ -8297,6 +8299,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-x86_64-rt-debug-rhel.config

@@ -1105,7 +1105,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2633,7 +2633,7 @@ CONFIG_I2C_MUX=m
 CONFIG_I2C_MUX_MLXCPLD=m
 # CONFIG_I2C_MUX_MULE is not set
 # CONFIG_I2C_MUX_PCA9541 is not set
-# CONFIG_I2C_MUX_PCA954x is not set
+CONFIG_I2C_MUX_PCA954x=m
 # CONFIG_I2C_MUX_REG is not set
 CONFIG_I2C_NFORCE2=m
 CONFIG_I2C_NFORCE2_S4985=m
@@ -2957,7 +2957,7 @@ CONFIG_INTEL_SKL_INT3472=m
 CONFIG_INTEL_SPEED_SELECT_INTERFACE=m
 CONFIG_INTEL_TCC_COOLING=m
 CONFIG_INTEL_TDX_GUEST=y
-# CONFIG_INTEL_TDX_HOST is not set
+CONFIG_INTEL_TDX_HOST=y
 CONFIG_INTEL_TH_ACPI=m
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH_DEBUG is not set
@@ -3335,6 +3335,7 @@ CONFIG_KVM_GUEST=y
 CONFIG_KVM_HYPERV=y
 CONFIG_KVM_INTEL=m
 # CONFIG_KVM_INTEL_PROVE_VE is not set
+CONFIG_KVM_INTEL_TDX=y
 CONFIG_KVM=m
 CONFIG_KVM_MAX_NR_VCPUS=4096
 CONFIG_KVM_MMU_AUDIT=y
@@ -3908,6 +3909,7 @@ CONFIG_MITIGATION_SSB=y
 CONFIG_MITIGATION_TAA=y
 CONFIG_MITIGATION_TSA=y
 CONFIG_MITIGATION_UNRET_ENTRY=y
+CONFIG_MITIGATION_VMSCAPE=y
 # CONFIG_MK8 is not set
 CONFIG_MLX4_CORE_GEN2=y
 CONFIG_MLX4_CORE=m
@@ -8377,6 +8379,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-x86_64-rt-rhel.config

@@ -1105,7 +1105,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2617,7 +2617,7 @@ CONFIG_I2C_MUX=m
 CONFIG_I2C_MUX_MLXCPLD=m
 # CONFIG_I2C_MUX_MULE is not set
 # CONFIG_I2C_MUX_PCA9541 is not set
-# CONFIG_I2C_MUX_PCA954x is not set
+CONFIG_I2C_MUX_PCA954x=m
 # CONFIG_I2C_MUX_REG is not set
 CONFIG_I2C_NFORCE2=m
 CONFIG_I2C_NFORCE2_S4985=m
@@ -2941,7 +2941,7 @@ CONFIG_INTEL_SKL_INT3472=m
 CONFIG_INTEL_SPEED_SELECT_INTERFACE=m
 CONFIG_INTEL_TCC_COOLING=m
 CONFIG_INTEL_TDX_GUEST=y
-# CONFIG_INTEL_TDX_HOST is not set
+CONFIG_INTEL_TDX_HOST=y
 CONFIG_INTEL_TH_ACPI=m
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH_DEBUG is not set
@@ -3315,6 +3315,7 @@ CONFIG_KVM_GUEST=y
 CONFIG_KVM_HYPERV=y
 CONFIG_KVM_INTEL=m
 # CONFIG_KVM_INTEL_PROVE_VE is not set
+CONFIG_KVM_INTEL_TDX=y
 CONFIG_KVM=m
 CONFIG_KVM_MAX_NR_VCPUS=4096
 CONFIG_KVM_MMU_AUDIT=y
@@ -3888,6 +3889,7 @@ CONFIG_MITIGATION_SSB=y
 CONFIG_MITIGATION_TAA=y
 CONFIG_MITIGATION_TSA=y
 CONFIG_MITIGATION_UNRET_ENTRY=y
+CONFIG_MITIGATION_VMSCAPE=y
 # CONFIG_MK8 is not set
 CONFIG_MLX4_CORE_GEN2=y
 CONFIG_MLX4_CORE=m
@@ -8353,6 +8355,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-x86_64_v2-debug-rhel.config

@@ -1104,7 +1104,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2592,7 +2592,7 @@ CONFIG_I2C_MUX=m
 CONFIG_I2C_MUX_MLXCPLD=m
 # CONFIG_I2C_MUX_MULE is not set
 # CONFIG_I2C_MUX_PCA9541 is not set
-# CONFIG_I2C_MUX_PCA954x is not set
+CONFIG_I2C_MUX_PCA954x=m
 # CONFIG_I2C_MUX_REG is not set
 CONFIG_I2C_NFORCE2=m
 CONFIG_I2C_NFORCE2_S4985=m
@@ -2916,7 +2916,7 @@ CONFIG_INTEL_SKL_INT3472=m
 CONFIG_INTEL_SPEED_SELECT_INTERFACE=m
 CONFIG_INTEL_TCC_COOLING=m
 CONFIG_INTEL_TDX_GUEST=y
-# CONFIG_INTEL_TDX_HOST is not set
+CONFIG_INTEL_TDX_HOST=y
 CONFIG_INTEL_TH_ACPI=m
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH_DEBUG is not set
@@ -3294,6 +3294,7 @@ CONFIG_KVM_GUEST=y
 CONFIG_KVM_HYPERV=y
 CONFIG_KVM_INTEL=m
 # CONFIG_KVM_INTEL_PROVE_VE is not set
+CONFIG_KVM_INTEL_TDX=y
 CONFIG_KVM=m
 CONFIG_KVM_MAX_NR_VCPUS=4096
 CONFIG_KVM_MMU_AUDIT=y
@@ -3867,6 +3868,7 @@ CONFIG_MITIGATION_SSB=y
 CONFIG_MITIGATION_TAA=y
 CONFIG_MITIGATION_TSA=y
 CONFIG_MITIGATION_UNRET_ENTRY=y
+CONFIG_MITIGATION_VMSCAPE=y
 # CONFIG_MK8 is not set
 CONFIG_MLX4_CORE_GEN2=y
 CONFIG_MLX4_CORE=m
@@ -8321,6 +8323,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-x86_64_v2-rhel.config

@@ -1104,7 +1104,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2576,7 +2576,7 @@ CONFIG_I2C_MUX=m
 CONFIG_I2C_MUX_MLXCPLD=m
 # CONFIG_I2C_MUX_MULE is not set
 # CONFIG_I2C_MUX_PCA9541 is not set
-# CONFIG_I2C_MUX_PCA954x is not set
+CONFIG_I2C_MUX_PCA954x=m
 # CONFIG_I2C_MUX_REG is not set
 CONFIG_I2C_NFORCE2=m
 CONFIG_I2C_NFORCE2_S4985=m
@@ -2900,7 +2900,7 @@ CONFIG_INTEL_SKL_INT3472=m
 CONFIG_INTEL_SPEED_SELECT_INTERFACE=m
 CONFIG_INTEL_TCC_COOLING=m
 CONFIG_INTEL_TDX_GUEST=y
-# CONFIG_INTEL_TDX_HOST is not set
+CONFIG_INTEL_TDX_HOST=y
 CONFIG_INTEL_TH_ACPI=m
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH_DEBUG is not set
@@ -3274,6 +3274,7 @@ CONFIG_KVM_GUEST=y
 CONFIG_KVM_HYPERV=y
 CONFIG_KVM_INTEL=m
 # CONFIG_KVM_INTEL_PROVE_VE is not set
+CONFIG_KVM_INTEL_TDX=y
 CONFIG_KVM=m
 CONFIG_KVM_MAX_NR_VCPUS=4096
 CONFIG_KVM_MMU_AUDIT=y
@@ -3847,6 +3848,7 @@ CONFIG_MITIGATION_SSB=y
 CONFIG_MITIGATION_TAA=y
 CONFIG_MITIGATION_TSA=y
 CONFIG_MITIGATION_UNRET_ENTRY=y
+CONFIG_MITIGATION_VMSCAPE=y
 # CONFIG_MK8 is not set
 CONFIG_MLX4_CORE_GEN2=y
 CONFIG_MLX4_CORE=m
@@ -8297,6 +8299,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-x86_64_v2-rt-debug-rhel.config

@@ -1105,7 +1105,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2633,7 +2633,7 @@ CONFIG_I2C_MUX=m
 CONFIG_I2C_MUX_MLXCPLD=m
 # CONFIG_I2C_MUX_MULE is not set
 # CONFIG_I2C_MUX_PCA9541 is not set
-# CONFIG_I2C_MUX_PCA954x is not set
+CONFIG_I2C_MUX_PCA954x=m
 # CONFIG_I2C_MUX_REG is not set
 CONFIG_I2C_NFORCE2=m
 CONFIG_I2C_NFORCE2_S4985=m
@@ -2957,7 +2957,7 @@ CONFIG_INTEL_SKL_INT3472=m
 CONFIG_INTEL_SPEED_SELECT_INTERFACE=m
 CONFIG_INTEL_TCC_COOLING=m
 CONFIG_INTEL_TDX_GUEST=y
-# CONFIG_INTEL_TDX_HOST is not set
+CONFIG_INTEL_TDX_HOST=y
 CONFIG_INTEL_TH_ACPI=m
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH_DEBUG is not set
@@ -3335,6 +3335,7 @@ CONFIG_KVM_GUEST=y
 CONFIG_KVM_HYPERV=y
 CONFIG_KVM_INTEL=m
 # CONFIG_KVM_INTEL_PROVE_VE is not set
+CONFIG_KVM_INTEL_TDX=y
 CONFIG_KVM=m
 CONFIG_KVM_MAX_NR_VCPUS=4096
 CONFIG_KVM_MMU_AUDIT=y
@@ -3908,6 +3909,7 @@ CONFIG_MITIGATION_SSB=y
 CONFIG_MITIGATION_TAA=y
 CONFIG_MITIGATION_TSA=y
 CONFIG_MITIGATION_UNRET_ENTRY=y
+CONFIG_MITIGATION_VMSCAPE=y
 # CONFIG_MK8 is not set
 CONFIG_MLX4_CORE_GEN2=y
 CONFIG_MLX4_CORE=m
@@ -8377,6 +8379,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel-x86_64_v2-rt-rhel.config

@@ -1105,7 +1105,7 @@ CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
 CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
 # CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
-CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_JITTERENTROPY_OSR=3
 # CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
 # CONFIG_CRYPTO_KEYWRAP is not set
 CONFIG_CRYPTO_LIB_AESCFB=y
@@ -2617,7 +2617,7 @@ CONFIG_I2C_MUX=m
 CONFIG_I2C_MUX_MLXCPLD=m
 # CONFIG_I2C_MUX_MULE is not set
 # CONFIG_I2C_MUX_PCA9541 is not set
-# CONFIG_I2C_MUX_PCA954x is not set
+CONFIG_I2C_MUX_PCA954x=m
 # CONFIG_I2C_MUX_REG is not set
 CONFIG_I2C_NFORCE2=m
 CONFIG_I2C_NFORCE2_S4985=m
@@ -2941,7 +2941,7 @@ CONFIG_INTEL_SKL_INT3472=m
 CONFIG_INTEL_SPEED_SELECT_INTERFACE=m
 CONFIG_INTEL_TCC_COOLING=m
 CONFIG_INTEL_TDX_GUEST=y
-# CONFIG_INTEL_TDX_HOST is not set
+CONFIG_INTEL_TDX_HOST=y
 CONFIG_INTEL_TH_ACPI=m
 CONFIG_INTEL_THC_HID=m
 # CONFIG_INTEL_TH_DEBUG is not set
@@ -3315,6 +3315,7 @@ CONFIG_KVM_GUEST=y
 CONFIG_KVM_HYPERV=y
 CONFIG_KVM_INTEL=m
 # CONFIG_KVM_INTEL_PROVE_VE is not set
+CONFIG_KVM_INTEL_TDX=y
 CONFIG_KVM=m
 CONFIG_KVM_MAX_NR_VCPUS=4096
 CONFIG_KVM_MMU_AUDIT=y
@@ -3888,6 +3889,7 @@ CONFIG_MITIGATION_SSB=y
 CONFIG_MITIGATION_TAA=y
 CONFIG_MITIGATION_TSA=y
 CONFIG_MITIGATION_UNRET_ENTRY=y
+CONFIG_MITIGATION_VMSCAPE=y
 # CONFIG_MK8 is not set
 CONFIG_MLX4_CORE_GEN2=y
 CONFIG_MLX4_CORE=m
@@ -8353,6 +8355,9 @@ CONFIG_ZBUD=y
 # CONFIG_ZEROPLUS_FF is not set
 # CONFIG_ZIIRAVE_WATCHDOG is not set
 CONFIG_ZISOFS=y
+CONFIG_ZL3073X_I2C=m
+CONFIG_ZL3073X=m
+CONFIG_ZL3073X_SPI=m
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_ZLIB_DFLTCC=y
 CONFIG_ZLIB_INFLATE=y

my-ostree-os/kernel/kernel.changelog

@@ -1,3 +1,393 @@
+* Sat Feb 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.38.1.el10_1]
+- scsi: storvsc: Process unsupported MODE_SENSE_10 (Li Tian) [RHEL-147288]
+- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144335] {CVE-2026-22998}
+Resolves: RHEL-144335, RHEL-147288
+
+* Thu Feb 05 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.37.1.el10_1]
+- i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141876]
+- bpf: Do not audit capability check in do_jit() (Jay Shin) [RHEL-135138]
+- smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126896] {CVE-2025-40064}
+Resolves: RHEL-126896, RHEL-135138, RHEL-140874, RHEL-141876
+
+* Tue Feb 03 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.36.1.el10_1]
+- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140263] {CVE-2025-68349}
+- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Myron Stowe) [RHEL-132908] {CVE-2023-53034}
+- erofs: avoid using multiple devices with different type (CKI Backport Bot) [RHEL-137977] {CVE-2025-38172}
+- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136912] {CVE-2025-40269}
+- Bluetooth: ISO: Fix possible UAF on iso_conn_free (CKI Backport Bot) [RHEL-128899] {CVE-2025-40141}
+Resolves: RHEL-128899, RHEL-132908, RHEL-136912, RHEL-137977, RHEL-140263
+
+* Sat Jan 31 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.35.1.el10_1]
+- ice: Fix kernel panic due to page refcount underflow (CKI Backport Bot) [RHEL-139734]
+- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Davide Caratti) [RHEL-129044] {CVE-2025-40133}
+- mptcp: Call dst_release() in mptcp_active_enable(). (Davide Caratti) [RHEL-129044]
+- vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137703] {CVE-2025-38403}
+Resolves: RHEL-129044, RHEL-137703, RHEL-139734
+
+* Thu Jan 29 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.34.1.el10_1]
+- ice: prevent NULL deref in ice_lag_move_new_vf_nodes() (Michal Schmidt) [RHEL-143255]
+- svcrdma: use rc_pageoff for memcpy byte offset (CKI Backport Bot) [RHEL-142793] {CVE-2025-68811}
+- exec: Make sure task->comm is always NUL-terminated (Luiz Capitulino) [RHEL-141711]
+- lib/buildid: use __kernel_read() for sleepable context (Waiman Long) [RHEL-141229]
+- net: bonding: update the slave array for broadcast mode (Hangbin Liu) [RHEL-138325]
+- net: bonding: add broadcast_neighbor netlink option (Hangbin Liu) [RHEL-138325]
+- net: bonding: add broadcast_neighbor option for 802.3ad (Hangbin Liu) [RHEL-138325]
+Resolves: RHEL-138325, RHEL-141229, RHEL-141711, RHEL-142793, RHEL-143255
+
+* Tue Jan 27 2026 Julio Faracco <jfaracco@redhat.com> [6.12.0-124.33.1.el10_1]
+- io_uring/net: commit partial buffers on retry (Jeff Moyer) [RHEL-137333] {CVE-2025-38730}
+- smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131394] {CVE-2025-39933}
+Resolves: RHEL-131394, RHEL-137333
+
+* Sat Jan 24 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.32.1.el10_1]
+- squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138024] {CVE-2025-38415}
+- Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138024] {CVE-2025-38415}
+- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137686] {CVE-2025-40304}
+- fbdev: bitblit: bound-check glyph index in bit_putcs* (CKI Backport Bot) [RHEL-136945] {CVE-2025-40322}
+Resolves: RHEL-136945, RHEL-137686, RHEL-138024
+
+* Thu Jan 22 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.31.1.el10_1]
+- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121647]
+- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121647]
+- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121647]
+- KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace (Donald Dutile) [RHEL-134763]
+- scsi: st: Skip buffer flush for information ioctls (Ewan D. Milne) [RHEL-136289]
+- scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (Ewan D. Milne) [RHEL-136289]
+- scsi: st: Don't set pos_unknown just after device recognition (Ewan D. Milne) [RHEL-136289]
+- scsi: st: New session only when Unit Attention for new tape (Ewan D. Milne) [RHEL-136289]
+- scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (Ewan D. Milne) [RHEL-136289]
+- scsi: st: Don't modify unknown block number in MTIOCGET (Ewan D. Milne) [RHEL-136289]
+- xfs: rework datasync tracking and execution (CKI Backport Bot) [RHEL-126599]
+- xfs: rearrange code in xfs_inode_item_precommit (CKI Backport Bot) [RHEL-126599]
+- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Luiz Capitulino) [RHEL-133336]
+- s390: mm: add stub for hugetlb_optimize_vmemmap_key (Luiz Capitulino) [RHEL-133336]
+- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers (Ricardo Robaina) [RHEL-129452]
+- x86/kaslr: Reduce KASLR entropy on most x86 systems (Ricardo Robaina) [RHEL-129452]
+- x86/boot/compressed: Remove unused header includes from kaslr.c (Ricardo Robaina) [RHEL-129452]
+- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CKI Backport Bot) [RHEL-134363] {CVE-2025-38022}
+- uprobes: Fix race in uprobe_free_utask (Jay Shin) [RHEL-133456]
+- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129115] {CVE-2025-40154}
+- kabi: stabilize struct alt_instr (Čestmír Kalina) [RHEL-122759]
+Resolves: RHEL-121647, RHEL-122759, RHEL-126599, RHEL-129115, RHEL-129452, RHEL-133336, RHEL-133456, RHEL-134363, RHEL-134763, RHEL-136289
+
+* Wed Jan 21 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.30.1.el10_1]
+- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jeff Moyer) [RHEL-129623] {CVE-2025-38453}
+- net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139490] {CVE-2025-68301}
+- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139465] {CVE-2025-68305}
+- vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139287] {CVE-2025-40248}
+- net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129087] {CVE-2025-40170}
+- ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129026] {CVE-2025-40135}
+- ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128991] {CVE-2025-40158}
+- net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-129026]
+- net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-129026]
+- net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-129026]
+- eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138041] {CVE-2025-38349}
+- fs/proc: fix uaf in proc_readdir_de() (CKI Backport Bot) [RHEL-137101] {CVE-2025-40271}
+- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136972] {CVE-2025-40294}
+- Bluetooth: hci_event: validate skb length for unknown CC opcode (CKI Backport Bot) [RHEL-136951] {CVE-2025-40301}
+- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CKI Backport Bot) [RHEL-136836] {CVE-2025-38568}
+- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CKI Backport Bot) [RHEL-136259] {CVE-2025-40318}
+- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CKI Backport Bot) [RHEL-134926] {CVE-2025-40251}
+- mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134451] {CVE-2025-40258}
+- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CKI Backport Bot) [RHEL-131989] {CVE-2025-37819}
+- drm/xe: Fix vm_bind_ioctl double free bug (Anusha Srivatsa) [RHEL-122312] {CVE-2025-38731}
+Resolves: RHEL-122312, RHEL-128991, RHEL-129026, RHEL-129087, RHEL-129623, RHEL-131989, RHEL-134451, RHEL-134926, RHEL-136259, RHEL-136836, RHEL-136951, RHEL-136972, RHEL-137101, RHEL-138041, RHEL-139287, RHEL-139465, RHEL-139490
+
+* Sat Jan 10 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.29.1.el10_1]
+- gitlab-ci: use rhel10.1 builder image (Michael Hofmann)
+- mm/vmalloc: fix data race in show_numa_info() (Waiman Long) [RHEL-137997] {CVE-2025-38383}
+- vmalloc: use for_each_vmap_node() in purge-vmap-area (Waiman Long) [RHEL-137997]
+- vmalloc: switch to for_each_vmap_node() helper (Waiman Long) [RHEL-137997]
+- vmalloc: add for_each_vmap_node() helper (Waiman Long) [RHEL-137997]
+- smb: client: fix refcount leak in smb2_set_path_attr (Paulo Alcantara) [RHEL-128581]
+- smb: client: fix potential UAF in smb2_close_cached_fid() (Paulo Alcantara) [RHEL-128581]
+- smb: client: fix potential cfid UAF in smb2_query_info_compound (Paulo Alcantara) [RHEL-128581]
+- smb: client: Fix refcount leak for cifs_sb_tlink (Paulo Alcantara) [RHEL-128581]
+- cifs: parse_dfs_referrals: prevent oob on malformed input (Paulo Alcantara) [RHEL-128581]
+- smb: client: remove cfids_invalidation_worker (Paulo Alcantara) [RHEL-128581]
+- smb client: fix bug with newly created file in cached dir (Paulo Alcantara) [RHEL-128581]
+- smb: client: short-circuit negative lookups when parent dir is fully cached (Paulo Alcantara) [RHEL-128581]
+- smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (Paulo Alcantara) [RHEL-128581]
+- smb: client: remove pointless cfid->has_lease check (Paulo Alcantara) [RHEL-128581]
+- smb: client: remove unused fid_lock (Paulo Alcantara) [RHEL-128581]
+- smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (Paulo Alcantara) [RHEL-128581]
+- smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (Paulo Alcantara) [RHEL-128581]
+- smb: client: account smb directory cache usage and per-tcon totals (Paulo Alcantara) [RHEL-128581]
+- smb: client: add drop_dir_cache module parameter to invalidate cached dirents (Paulo Alcantara) [RHEL-128581]
+- smb: client: show lease state as R/H/W (or NONE) in open_files (Paulo Alcantara) [RHEL-128581]
+- smb: client: show negotiated cipher in DebugData (Paulo Alcantara) [RHEL-128581]
+- smb: client: add new tracepoint to trace lease break notification (Paulo Alcantara) [RHEL-128581]
+- smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show() (Paulo Alcantara) [RHEL-128581]
+- coredump: Only sort VMAs when core_sort_vma sysctl is set (Herton R. Krzesinski) [RHEL-113364]
+Resolves: RHEL-113364, RHEL-128581, RHEL-137997
+
+* Wed Jan 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.28.1.el10_1]
+- libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137403] {CVE-2025-68285}
+Resolves: RHEL-137403
+
+* Sat Dec 27 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.27.1.el10_1]
+- arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE (Waiman Long) [RHEL-120684]
+- arm64: cputype: Add Cortex-A720AE definitions (Waiman Long) [RHEL-120684]
+- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Waiman Long) [RHEL-120684]
+- arm64: Add support for HIP09 Spectre-BHB mitigation (Waiman Long) [RHEL-120684]
+- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Waiman Long) [RHEL-120684]
+- arm64: cputype: Add MIDR_CORTEX_A76AE (Waiman Long) [RHEL-120684]
+- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Waiman Long) [RHEL-120684]
+- kmem/tracing: add kmem name to kmem_cache_alloc tracepoint (Charles Haithcock) [RHEL-129882]
+- mm: memory-tiering: fix PGPROMOTE_CANDIDATE counting (Rafael Aquini) [RHEL-128383]
+Resolves: RHEL-120684, RHEL-128383, RHEL-129882
+
+* Tue Dec 23 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.26.1.el10_1]
+- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CKI Backport Bot) [RHEL-137150] {CVE-2025-68287}
+- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134431] {CVE-2025-40277}
+- net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (CKI Backport Bot) [RHEL-129812] {CVE-2025-39905}
+Resolves: RHEL-129812, RHEL-134431, RHEL-137150
+
+* Sat Dec 20 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.25.1.el10_1]
+- sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-134010] {CVE-2025-40240}
+- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (CKI Backport Bot) [RHEL-128281]
+- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CKI Backport Bot) [RHEL-124610] {CVE-2025-39806}
+- inetpeer: do not get a refcount in inet_getpeer() (Guillaume Nault) [RHEL-115287]
+- inetpeer: update inetpeer timestamp in inet_getpeer() (Guillaume Nault) [RHEL-115287]
+- inetpeer: remove create argument of inet_getpeer() (Guillaume Nault) [RHEL-115287]
+- inetpeer: remove create argument of inet_getpeer_v[46]() (Guillaume Nault) [RHEL-115287]
+Resolves: RHEL-115287, RHEL-124610, RHEL-128281, RHEL-134010
+
+* Tue Dec 16 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.24.1.el10_1]
+- audit: fix out-of-bounds read in audit_compare_dname_path() (Richard Guy Briggs) [RHEL-119185] {CVE-2025-39840}
+Resolves: RHEL-119185
+
+* Sat Dec 13 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.23.1.el10_1]
+- redhat: use RELEASE_LOCALVERSION also for dist-get-tag (Jan Stancek)
+- redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)
+- iommufd: Fix race during abort for file descriptors (Eder Zulian) [RHEL-123789] {CVE-2025-39966}
+- smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-126227]
+- mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125522] {CVE-2025-39843}
+- dpll: zl3073x: Increase maximum size of flash utility (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Implement devlink flash callback (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Add firmware loading functionality (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Add low-level flash functions (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Add functions to access hardware registers (Ivan Vecera) [RHEL-116157]
+Resolves: RHEL-116157, RHEL-123789, RHEL-125522, RHEL-126227
+
+* Sun Dec 07 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.22.1.el10_1]
+- ASoC: Intel: sof_sdw: Add quirks for Lenovo P1 and P16 (CKI Backport Bot) [RHEL-130550]
+- tls: wait for pending async decryptions if tls_strp_msg_hold fails (CKI Backport Bot) [RHEL-128866] {CVE-2025-40176}
+- sched/deadline: Fix RT task potential starvation when expiry time passed (CKI Backport Bot) [RHEL-124660]
+Resolves: RHEL-124660, RHEL-128866, RHEL-130550
+
+* Thu Dec 04 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.21.1.el10_1]
+- CVE-2025-38499 kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Abhi Das) [RHEL-129282] {CVE-2025-38499}
+- net: tun: Update napi->skb after XDP process (CKI Backport Bot) [RHEL-122247] {CVE-2025-39984}
+Resolves: RHEL-122247, RHEL-129282
+
+* Tue Dec 02 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.20.1.el10_1]
+- iommu/vt-d: Disallow dirty tracking if incoherent page walk (CKI Backport Bot) [RHEL-125482] {CVE-2025-40058}
+- net/mlx5: fs, fix UAF in flow counter release (Michal Schmidt) [RHEL-124432] {CVE-2025-39979}
+- dpll: zl3073x: Fix output pin registration (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Handle missing or corrupted flash configuration (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Refactor DPLL initialization (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (Ivan Vecera) [RHEL-114795]
+- dpll: Make ZL3073X invisible (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Fix build failure (Ivan Vecera) [RHEL-114795]
+- redhat/configs: enable CONFIG_ZL3073X* (Ivan Vecera) [RHEL-114795]
+- redhat/configs: enable CONFIG_I2C_MUX_PCA954x on x86 (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get fractional frequency offset (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to adjust phase (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Implement phase offset monitor feature (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get phase offset on connected input pin (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get/set esync on pins (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get/set frequency on pins (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Implement input pin state setting in automatic mode (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get/set priority on input pins (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Implement input pin selection in manual mode (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Register DPLL devices and pins (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Read DPLL types and pin properties from system firmware (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Fetch invariants during probe (Ivan Vecera) [RHEL-114795]
+- dpll: Add basic Microchip ZL3073x support (Ivan Vecera) [RHEL-114795]
+- dt-bindings: dpll: Add support for Microchip Azurite chip family (Ivan Vecera) [RHEL-114795]
+- dt-bindings: dpll: Add DPLL device and pin (Ivan Vecera) [RHEL-114795]
+- idpf: set mac type when adding and removing MAC filters (CKI Backport Bot) [RHEL-123372]
+- crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Fix SNP panic notifier unregistration (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Fix dereferencing uninitialized error pointer (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Fix __sev_snp_shutdown_locked (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Move SEV/SNP Platform initialization to KVM (Lenny Szubowicz) [RHEL-76557]
+- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Add new SEV/SNP platform shutdown API (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Register SNP panic notifier only if SNP is enabled (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Reset TMR size at SNP Shutdown (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (Lenny Szubowicz) [RHEL-76557]
+- s390/pci: Do not try re-enabling load/store if device is disabled (CKI Backport Bot) [RHEL-114448]
+- s390/pci: Fix stale function handles in error handling (CKI Backport Bot) [RHEL-114448]
+Resolves: RHEL-114448, RHEL-114795, RHEL-123372, RHEL-124432, RHEL-125482, RHEL-76557
+
+* Sat Nov 29 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.19.1.el10_1]
+- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: Fix sparse errors (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: Fix possible UAFs (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: hci_sync: fix set_local_name race condition (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: set_mesh: update LE scan interval and window (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CKI Backport Bot) [RHEL-124134] {CVE-2025-39983}
+- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124110] {CVE-2025-39925}
+- can: j1939: implement NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124110] {CVE-2025-39925}
+- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CKI Backport Bot) [RHEL-123824] {CVE-2025-39982}
+Resolves: RHEL-122901, RHEL-123824, RHEL-124110, RHEL-124134
+
+* Thu Nov 27 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.18.1.el10_1]
+- ice: ice_adapter: release xa entry on adapter allocation failure (CKI Backport Bot) [RHEL-128472] {CVE-2025-40185}
+- cifs: Fix oops due to uninitialised variable (CKI Backport Bot) [RHEL-120562] {CVE-2025-38737}
+Resolves: RHEL-120562, RHEL-128472
+
+* Tue Nov 25 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.17.1.el10_1]
+- x86/hyperv: Fix kdump on Azure CVMs (Li Tian) [RHEL-129777]
+- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart) [RHEL-113919]
+- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CKI Backport Bot) [RHEL-124974] {CVE-2025-40047}
+Resolves: RHEL-113919, RHEL-124974, RHEL-129777
+
+* Sat Nov 22 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.16.1.el10_1]
+- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Xin Long) [RHEL-125759]
+- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CKI Backport Bot) [RHEL-119161] {CVE-2025-39883}
+Resolves: RHEL-119161, RHEL-125759
+
+* Thu Nov 20 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.15.1.el10_1]
+- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125623] {CVE-2025-38724}
+- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Jose Ignacio Tornos Martinez) [RHEL-123070]
+- wifi: mt76: do not add non-sta wcid entries to the poll list (Jose Ignacio Tornos Martinez) [RHEL-123070]
+- wifi: mt76: fix linked list corruption (Jose Ignacio Tornos Martinez) [RHEL-123070] {CVE-2025-39918}
+Resolves: RHEL-123070, RHEL-125623
+
+* Wed Nov 19 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.14.1.el10_1]
+- ublk: make sure ubq->canceling is set when queue is frozen (Ming Lei) [RHEL-99436] {CVE-2025-22068}
+- e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123127] {CVE-2025-39898}
+- i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123811]
+- i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123811] {CVE-2025-39968}
+- i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123811] {CVE-2025-39969}
+- i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123811] {CVE-2025-39970}
+- i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123811] {CVE-2025-39971}
+- i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123811] {CVE-2025-39972}
+- i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123811] {CVE-2025-39973}
+- nvme-multipath: Skip nr_active increments in RETRY disposition (Ewan D. Milne) [RHEL-123689]
+Resolves: RHEL-123127, RHEL-123689, RHEL-123811, RHEL-99436
+
+* Thu Nov 13 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.13.1.el10_1]
+- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia) [RHEL-127623]
+- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia) [RHEL-127623]
+- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Scott Mayhew) [RHEL-110051]
+- smb: client: get rid of d_drop() in cifs_do_rename() (Paulo Alcantara) [RHEL-124955]
+- smb: client: fix wrong index reference in smb2_compound_op() (Paulo Alcantara) [RHEL-124955]
+- smb: client: handle unlink(2) of files open by different clients (Paulo Alcantara) [RHEL-124955]
+- smb: client: fix filename matching of deferred files (Paulo Alcantara) [RHEL-124955]
+- fs/smb: Fix inconsistent refcnt update (Paulo Alcantara) [RHEL-124955] {CVE-2025-39819}
+- ice: don't leave device non-functional if Tx scheduler config fails (Petr Oros) [RHEL-116535]
+Resolves: RHEL-110051, RHEL-116535, RHEL-124955, RHEL-127623
+
+* Tue Nov 11 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.12.1.el10_1]
+- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120672]
+- tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120672] {CVE-2025-39955}
+- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113613] {CVE-2025-39730}
+Resolves: RHEL-113613, RHEL-120672
+
+* Thu Nov 06 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.11.1.el10_1]
+- of_numa: fix uninitialized memory nodes causing kernel panic (Charles Mirabile) [RHEL-123154] {CVE-2025-39903}
+- redhat: use the same cert as UKI's to sign addons (Li Tian) [RHEL-124734]
+- ibmveth: Add multi buffers rx replenishment hcall support (Mamatha Inamdar) [RHEL-116193]
+- net: ibmveth: Reset the adapter when unexpected states are detected (Mamatha Inamdar) [RHEL-116193]
+- ibmvnic: Increase max subcrq indirect entries with fallback (Mamatha Inamdar) [RHEL-116189]
+- redhat: enable TDX host config (Paolo Bonzini) [RHEL-27145]
+- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Paolo Bonzini) [RHEL-27145]
+- x86/virt/tdx: Update the kexec section in the TDX documentation (Paolo Bonzini) [RHEL-27145]
+- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Paolo Bonzini) [RHEL-27145]
+- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Paolo Bonzini) [RHEL-27145]
+- x86/sme: Use percpu boolean to control WBINVD during kexec (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Consolidate relocate_kernel() function parameters (Paolo Bonzini) [RHEL-27145]
+- x86/paravirt: Remove the WBINVD callback (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Use typedef for relocate_kernel_fn function prototype (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Cope with relocate_kernel() not being at the start of the page (Paolo Bonzini) [RHEL-27145]
+- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Mark machine_kexec() with __nocfi (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Use correct swap page in swap_pages function (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Ensure preserve_context flag is set on return to kernel (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Disable global pages before writing to control page (Paolo Bonzini) [RHEL-27145]
+- x86: Fix build regression with CONFIG_KEXEC_JUMP enabled (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Clean up register usage in relocate_kernel() (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Drop page_list argument from relocate_kernel() (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Add data section to relocate_kernel (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Move relocate_kernel to kernel .data section (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Invoke copy of relocate_kernel() instead of the original (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Copy control page into place in machine_kexec_prepare() (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Allocate PGD for x86_64 transition page tables separately (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Only swap pages for ::preserve_context mode (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Clean up and document register use in relocate_kernel_64.S (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Restore GDT on return from ::preserve_context kexec (Paolo Bonzini) [RHEL-27145]
+Resolves: RHEL-116189, RHEL-116193, RHEL-123154, RHEL-124734, RHEL-27145
+
+* Sat Nov 01 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.10.1.el10_1]
+- wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122880] {CVE-2025-39864}
+- selftests: tls: test skb copy under mem pressure and OOB (CKI Backport Bot) [RHEL-120380] {CVE-2025-39946}
+- tls: make sure to abort the stream if headers are bogus (CKI Backport Bot) [RHEL-120380] {CVE-2025-39946}
+- ixgbe: fix ixgbe_orom_civd_info struct layout (Michal Schmidt) [RHEL-119079]
+- ice: fix Rx page leak on multi-buffer frames (Petr Oros) [RHEL-116543]
+- eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111055] {CVE-2025-38614}
+Resolves: RHEL-111055, RHEL-116543, RHEL-119079, RHEL-120380, RHEL-122880
+
+* Tue Oct 28 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.9.1.el10_1]
+- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (CKI Backport Bot) [RHEL-123290]
+- smb: client: fix file open check in __cifs_unlink() (Paulo Alcantara) [RHEL-122417]
+- smb: client: fix data loss due to broken rename(2) (Paulo Alcantara) [RHEL-122417]
+- smb: client: fix compound alignment with encryption (Paulo Alcantara) [RHEL-122417]
+- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-122417]
+- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-122417]
+- use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-121702] {CVE-2025-38498}
+- do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-121702] {CVE-2025-38498}
+- cgroup/psi: Set of->priv to NULL upon file release (CKI Backport Bot) [RHEL-119143] {CVE-2025-39881}
+- kernfs: Fix UAF in polling when open file is released (CKI Backport Bot) [RHEL-119143] {CVE-2025-39881}
+- redhat: rpminspect: update emptyrpm list for kernel variants (Alexandra Hájková)
+- scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119132] {CVE-2025-39841}
+- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118462] {CVE-2025-39817}
+- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117585] {CVE-2025-39849}
+- xfs: do not propagate ENODATA disk errors into xattr code (Carlos Maiolino) [RHEL-115733]
+- ipv6: sr: Fix MAC comparison to be constant-time (CKI Backport Bot) [RHEL-116387] {CVE-2025-39702}
+- s390/ism: fix concurrency management in ism_cmd() (CKI Backport Bot) [RHEL-114500]
+- s390/hypfs: Enable limited access during lockdown (CKI Backport Bot) [RHEL-114431]
+- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (CKI Backport Bot) [RHEL-114431]
+- redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86 (Waiman Long) [RHEL-114276]
+- x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-114931]
+- net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-114931]
+- net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-114931]
+- net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-114931]
+- net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-114931]
+- net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-114931]
+- mm: swap: fix potential buffer overflow in setup_clusters() (CKI Backport Bot) [RHEL-114862] {CVE-2025-39727}
+- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114852] {CVE-2025-39751}
+- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114693] {CVE-2025-38729}
+- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114693]
+- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114693] {CVE-2025-39757}
+- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (Mamatha Inamdar) [RHEL-114439]
+- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mamatha Inamdar) [RHEL-114439]
+- ibmvnic: Add stat for tx direct vs tx batched (Mamatha Inamdar) [RHEL-114439]
+- vsock/virtio: Validate length in packet header before skb_put() (CKI Backport Bot) [RHEL-114301] {CVE-2025-39718}
+- NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113861] {CVE-2025-39697}
+Resolves: RHEL-113861, RHEL-114276, RHEL-114301, RHEL-114431, RHEL-114439, RHEL-114500, RHEL-114693, RHEL-114852, RHEL-114862, RHEL-114931, RHEL-115733, RHEL-116387, RHEL-117585, RHEL-118462, RHEL-119132, RHEL-119143, RHEL-121702, RHEL-122417, RHEL-123290
+
 * Fri Oct 17 2025 Jan Stancek <jstancek@redhat.com> [6.12.0-124.8.1.el10_1]
 - redhat: revert to using redhatsecureboot504 for RHEL UKI (Vitaly Kuznetsov) [RHEL-122226]
 Resolves: RHEL-122226

my-ostree-os/kernel/kernel.spec

@@ -172,19 +172,19 @@ Summary: The Linux kernel
 #  to build the base kernel using the debug configuration. (Specifying
 #  the --with-release option overrides this setting.)
 %define debugbuildsenabled 1
-%define buildid .andersdsrhcustom2
+%define buildid .andersdsrhcustom1
 %define specrpmversion 6.12.0
 %define specversion 6.12.0
 %define patchversion 6.12
-%define pkgrelease 124.8.1
+%define pkgrelease 124.38.1
 %define kversion 6
-%define tarfile_release 6.12.0-124.8.1.el10_1
+%define tarfile_release 6.12.0-124.38.1.el10_1
 # This is needed to do merge window version magic
 %define patchlevel 12
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 124.8.1%{?buildid}%{?dist}
+%define specrelease 124.38.1%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 6.12.0-124.8.1.el10_1
+%define kabiversion 6.12.0-124.38.1.el10_1
 
 # If this variable is set to 1, a bpf selftests build failure will cause a
 # fatal kernel package build error
@@ -2850,6 +2850,11 @@ BuildKernel() {
 %endif
 
         %pesign -s -i $KernelUnifiedImage -o $KernelUnifiedImage.signed -a %{secureboot_ca_0} -c $UKI_secureboot_cert -n $UKI_secureboot_name
+        for addon in "$KernelAddonsDirOut"/*; do
+            %pesign -s -i $addon -o $addon.signed -a %{secureboot_ca_0} -c $UKI_secureboot_cert -n $UKI_secureboot_name
+            rm -f $addon
+            mv $addon.signed $addon
+        done
 # 0%{?fedora}%{?eln}
 %endif
         if [ ! -s $KernelUnifiedImage.signed ]; then
@@ -2858,12 +2863,6 @@ BuildKernel() {
         fi
         mv $KernelUnifiedImage.signed $KernelUnifiedImage
 
-      for addon in "$KernelAddonsDirOut"/*; do
-        %pesign -s -i $addon -o $addon.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0}
-        rm -f $addon
-        mv $addon.signed $addon
-      done
-
       mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer
       cp -a $UKI_secureboot_cert $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/secureboot-uki-%{_arch}.cer
 
@@ -4404,14 +4403,14 @@ fi\
 #
 #
 %changelog
-* Tue Nov 11 2025 Eduard Abdullin <eabdullin@almalinux.org> - 6.12.0-124.8.1
+* Tue Feb 17 2026 Eduard Abdullin <eabdullin@almalinux.org> - 6.12.0-124.38.1
 - Debrand for AlmaLinux OS
 - Use AlmaLinux OS secure boot cert
 
-* Tue Nov 11 2025 Neal Gompa <ngompa@almalinux.org> - 6.12.0-124.8.1
+* Tue Feb 17 2026 Neal Gompa <ngompa@almalinux.org> - 6.12.0-124.38.1
 - Enable Btrfs support for all kernel variants
 
-* Tue Nov 11 2025 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-124.8.1
+* Tue Feb 17 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-124.38.1
 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
@@ -4422,16 +4421,365 @@ fi\
 - kernel/rh_messages.h: enable all disabled pci devices by moving to
   unmaintained
 
-* Tue Nov 11 2025 Andrew Lukoshko <alukoshko@almalinux.org> [6.12.0-124.8.1.el10_1]
-- Update RHEL_RELEASE, ZSTREAM, and DIST (Andrew Lukoshko)
-- Merge tag 'kernel-6.12.0-124.8.1.el10_1' into main (Julio Faracco)
-- Merge tag 'kernel-6.12.0-124.7.1.el10_1' into main (Jan Stancek)
-- Merge: kabi: add symbols to stablelist and enable check-kabi (Jan Stancek) [RHEL-113009]
-- Merge tag 'kernel-6.12.0-124.5.1.el10_1' into main (Jan Stancek)
-- Merge tag 'kernel-6.12.0-124.4.1.el10_1' into main (Jan Stancek)
-- Merge tag 'kernel-6.12.0-124.2.1.el10_1' into main (Jan Stancek)
-- x86/split_lock: Move Split and Bus lock code to a dedicated file (John Allen) [RHEL-50321]
-- Merge tag 'kernel-6.12.0-124.1.1.el10_1' into main (Julio Faracco)
+* Sat Feb 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.38.1.el10_1]
+- scsi: storvsc: Process unsupported MODE_SENSE_10 (Li Tian) [RHEL-147288]
+- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144335] {CVE-2026-22998}
+
+* Thu Feb 05 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.37.1.el10_1]
+- i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141876]
+- bpf: Do not audit capability check in do_jit() (Jay Shin) [RHEL-135138]
+- smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126896] {CVE-2025-40064}
+
+* Tue Feb 03 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.36.1.el10_1]
+- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140263] {CVE-2025-68349}
+- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Myron Stowe) [RHEL-132908] {CVE-2023-53034}
+- erofs: avoid using multiple devices with different type (CKI Backport Bot) [RHEL-137977] {CVE-2025-38172}
+- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136912] {CVE-2025-40269}
+- Bluetooth: ISO: Fix possible UAF on iso_conn_free (CKI Backport Bot) [RHEL-128899] {CVE-2025-40141}
+
+* Sat Jan 31 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.35.1.el10_1]
+- ice: Fix kernel panic due to page refcount underflow (CKI Backport Bot) [RHEL-139734]
+- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Davide Caratti) [RHEL-129044] {CVE-2025-40133}
+- mptcp: Call dst_release() in mptcp_active_enable(). (Davide Caratti) [RHEL-129044]
+- vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137703] {CVE-2025-38403}
+
+* Thu Jan 29 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.34.1.el10_1]
+- ice: prevent NULL deref in ice_lag_move_new_vf_nodes() (Michal Schmidt) [RHEL-143255]
+- svcrdma: use rc_pageoff for memcpy byte offset (CKI Backport Bot) [RHEL-142793] {CVE-2025-68811}
+- exec: Make sure task->comm is always NUL-terminated (Luiz Capitulino) [RHEL-141711]
+- lib/buildid: use __kernel_read() for sleepable context (Waiman Long) [RHEL-141229]
+- net: bonding: update the slave array for broadcast mode (Hangbin Liu) [RHEL-138325]
+- net: bonding: add broadcast_neighbor netlink option (Hangbin Liu) [RHEL-138325]
+- net: bonding: add broadcast_neighbor option for 802.3ad (Hangbin Liu) [RHEL-138325]
+
+* Tue Jan 27 2026 Julio Faracco <jfaracco@redhat.com> [6.12.0-124.33.1.el10_1]
+- io_uring/net: commit partial buffers on retry (Jeff Moyer) [RHEL-137333] {CVE-2025-38730}
+- smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131394] {CVE-2025-39933}
+
+* Sat Jan 24 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.32.1.el10_1]
+- squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138024] {CVE-2025-38415}
+- Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138024] {CVE-2025-38415}
+- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137686] {CVE-2025-40304}
+- fbdev: bitblit: bound-check glyph index in bit_putcs* (CKI Backport Bot) [RHEL-136945] {CVE-2025-40322}
+
+* Thu Jan 22 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.31.1.el10_1]
+- i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121647]
+- devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121647]
+- i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121647]
+- KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace (Donald Dutile) [RHEL-134763]
+- scsi: st: Skip buffer flush for information ioctls (Ewan D. Milne) [RHEL-136289]
+- scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (Ewan D. Milne) [RHEL-136289]
+- scsi: st: Don't set pos_unknown just after device recognition (Ewan D. Milne) [RHEL-136289]
+- scsi: st: New session only when Unit Attention for new tape (Ewan D. Milne) [RHEL-136289]
+- scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (Ewan D. Milne) [RHEL-136289]
+- scsi: st: Don't modify unknown block number in MTIOCGET (Ewan D. Milne) [RHEL-136289]
+- xfs: rework datasync tracking and execution (CKI Backport Bot) [RHEL-126599]
+- xfs: rearrange code in xfs_inode_item_precommit (CKI Backport Bot) [RHEL-126599]
+- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Luiz Capitulino) [RHEL-133336]
+- s390: mm: add stub for hugetlb_optimize_vmemmap_key (Luiz Capitulino) [RHEL-133336]
+- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers (Ricardo Robaina) [RHEL-129452]
+- x86/kaslr: Reduce KASLR entropy on most x86 systems (Ricardo Robaina) [RHEL-129452]
+- x86/boot/compressed: Remove unused header includes from kaslr.c (Ricardo Robaina) [RHEL-129452]
+- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CKI Backport Bot) [RHEL-134363] {CVE-2025-38022}
+- uprobes: Fix race in uprobe_free_utask (Jay Shin) [RHEL-133456]
+- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129115] {CVE-2025-40154}
+- kabi: stabilize struct alt_instr (Čestmír Kalina) [RHEL-122759]
+
+* Wed Jan 21 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.30.1.el10_1]
+- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jeff Moyer) [RHEL-129623] {CVE-2025-38453}
+- net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139490] {CVE-2025-68301}
+- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139465] {CVE-2025-68305}
+- vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139287] {CVE-2025-40248}
+- net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129087] {CVE-2025-40170}
+- ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129026] {CVE-2025-40135}
+- ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128991] {CVE-2025-40158}
+- net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-129026]
+- net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-129026]
+- net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-129026]
+- eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138041] {CVE-2025-38349}
+- fs/proc: fix uaf in proc_readdir_de() (CKI Backport Bot) [RHEL-137101] {CVE-2025-40271}
+- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136972] {CVE-2025-40294}
+- Bluetooth: hci_event: validate skb length for unknown CC opcode (CKI Backport Bot) [RHEL-136951] {CVE-2025-40301}
+- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CKI Backport Bot) [RHEL-136836] {CVE-2025-38568}
+- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CKI Backport Bot) [RHEL-136259] {CVE-2025-40318}
+- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CKI Backport Bot) [RHEL-134926] {CVE-2025-40251}
+- mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134451] {CVE-2025-40258}
+- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CKI Backport Bot) [RHEL-131989] {CVE-2025-37819}
+- drm/xe: Fix vm_bind_ioctl double free bug (Anusha Srivatsa) [RHEL-122312] {CVE-2025-38731}
+
+* Sat Jan 10 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.29.1.el10_1]
+- gitlab-ci: use rhel10.1 builder image (Michael Hofmann)
+- mm/vmalloc: fix data race in show_numa_info() (Waiman Long) [RHEL-137997] {CVE-2025-38383}
+- vmalloc: use for_each_vmap_node() in purge-vmap-area (Waiman Long) [RHEL-137997]
+- vmalloc: switch to for_each_vmap_node() helper (Waiman Long) [RHEL-137997]
+- vmalloc: add for_each_vmap_node() helper (Waiman Long) [RHEL-137997]
+- smb: client: fix refcount leak in smb2_set_path_attr (Paulo Alcantara) [RHEL-128581]
+- smb: client: fix potential UAF in smb2_close_cached_fid() (Paulo Alcantara) [RHEL-128581]
+- smb: client: fix potential cfid UAF in smb2_query_info_compound (Paulo Alcantara) [RHEL-128581]
+- smb: client: Fix refcount leak for cifs_sb_tlink (Paulo Alcantara) [RHEL-128581]
+- cifs: parse_dfs_referrals: prevent oob on malformed input (Paulo Alcantara) [RHEL-128581]
+- smb: client: remove cfids_invalidation_worker (Paulo Alcantara) [RHEL-128581]
+- smb client: fix bug with newly created file in cached dir (Paulo Alcantara) [RHEL-128581]
+- smb: client: short-circuit negative lookups when parent dir is fully cached (Paulo Alcantara) [RHEL-128581]
+- smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (Paulo Alcantara) [RHEL-128581]
+- smb: client: remove pointless cfid->has_lease check (Paulo Alcantara) [RHEL-128581]
+- smb: client: remove unused fid_lock (Paulo Alcantara) [RHEL-128581]
+- smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (Paulo Alcantara) [RHEL-128581]
+- smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (Paulo Alcantara) [RHEL-128581]
+- smb: client: account smb directory cache usage and per-tcon totals (Paulo Alcantara) [RHEL-128581]
+- smb: client: add drop_dir_cache module parameter to invalidate cached dirents (Paulo Alcantara) [RHEL-128581]
+- smb: client: show lease state as R/H/W (or NONE) in open_files (Paulo Alcantara) [RHEL-128581]
+- smb: client: show negotiated cipher in DebugData (Paulo Alcantara) [RHEL-128581]
+- smb: client: add new tracepoint to trace lease break notification (Paulo Alcantara) [RHEL-128581]
+- smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show() (Paulo Alcantara) [RHEL-128581]
+- coredump: Only sort VMAs when core_sort_vma sysctl is set (Herton R. Krzesinski) [RHEL-113364]
+
+* Wed Jan 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.28.1.el10_1]
+- libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137403] {CVE-2025-68285}
+
+* Sat Dec 27 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.27.1.el10_1]
+- arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE (Waiman Long) [RHEL-120684]
+- arm64: cputype: Add Cortex-A720AE definitions (Waiman Long) [RHEL-120684]
+- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Waiman Long) [RHEL-120684]
+- arm64: Add support for HIP09 Spectre-BHB mitigation (Waiman Long) [RHEL-120684]
+- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Waiman Long) [RHEL-120684]
+- arm64: cputype: Add MIDR_CORTEX_A76AE (Waiman Long) [RHEL-120684]
+- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Waiman Long) [RHEL-120684]
+- kmem/tracing: add kmem name to kmem_cache_alloc tracepoint (Charles Haithcock) [RHEL-129882]
+- mm: memory-tiering: fix PGPROMOTE_CANDIDATE counting (Rafael Aquini) [RHEL-128383]
+
+* Tue Dec 23 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.26.1.el10_1]
+- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CKI Backport Bot) [RHEL-137150] {CVE-2025-68287}
+- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134431] {CVE-2025-40277}
+- net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (CKI Backport Bot) [RHEL-129812] {CVE-2025-39905}
+
+* Sat Dec 20 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.25.1.el10_1]
+- sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-134010] {CVE-2025-40240}
+- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (CKI Backport Bot) [RHEL-128281]
+- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CKI Backport Bot) [RHEL-124610] {CVE-2025-39806}
+- inetpeer: do not get a refcount in inet_getpeer() (Guillaume Nault) [RHEL-115287]
+- inetpeer: update inetpeer timestamp in inet_getpeer() (Guillaume Nault) [RHEL-115287]
+- inetpeer: remove create argument of inet_getpeer() (Guillaume Nault) [RHEL-115287]
+- inetpeer: remove create argument of inet_getpeer_v[46]() (Guillaume Nault) [RHEL-115287]
+
+* Tue Dec 16 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.24.1.el10_1]
+- audit: fix out-of-bounds read in audit_compare_dname_path() (Richard Guy Briggs) [RHEL-119185] {CVE-2025-39840}
+
+* Sat Dec 13 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.23.1.el10_1]
+- redhat: use RELEASE_LOCALVERSION also for dist-get-tag (Jan Stancek)
+- redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)
+- iommufd: Fix race during abort for file descriptors (Eder Zulian) [RHEL-123789] {CVE-2025-39966}
+- smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-126227]
+- mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125522] {CVE-2025-39843}
+- dpll: zl3073x: Increase maximum size of flash utility (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Implement devlink flash callback (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Add firmware loading functionality (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Add low-level flash functions (Ivan Vecera) [RHEL-116157]
+- dpll: zl3073x: Add functions to access hardware registers (Ivan Vecera) [RHEL-116157]
+
+* Sun Dec 07 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.22.1.el10_1]
+- ASoC: Intel: sof_sdw: Add quirks for Lenovo P1 and P16 (CKI Backport Bot) [RHEL-130550]
+- tls: wait for pending async decryptions if tls_strp_msg_hold fails (CKI Backport Bot) [RHEL-128866] {CVE-2025-40176}
+- sched/deadline: Fix RT task potential starvation when expiry time passed (CKI Backport Bot) [RHEL-124660]
+
+* Thu Dec 04 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.21.1.el10_1]
+- CVE-2025-38499 kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Abhi Das) [RHEL-129282] {CVE-2025-38499}
+- net: tun: Update napi->skb after XDP process (CKI Backport Bot) [RHEL-122247] {CVE-2025-39984}
+
+* Tue Dec 02 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.20.1.el10_1]
+- iommu/vt-d: Disallow dirty tracking if incoherent page walk (CKI Backport Bot) [RHEL-125482] {CVE-2025-40058}
+- net/mlx5: fs, fix UAF in flow counter release (Michal Schmidt) [RHEL-124432] {CVE-2025-39979}
+- dpll: zl3073x: Fix output pin registration (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Handle missing or corrupted flash configuration (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Refactor DPLL initialization (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (Ivan Vecera) [RHEL-114795]
+- dpll: Make ZL3073X invisible (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Fix build failure (Ivan Vecera) [RHEL-114795]
+- redhat/configs: enable CONFIG_ZL3073X* (Ivan Vecera) [RHEL-114795]
+- redhat/configs: enable CONFIG_I2C_MUX_PCA954x on x86 (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get fractional frequency offset (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to adjust phase (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Implement phase offset monitor feature (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get phase offset on connected input pin (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get/set esync on pins (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get/set frequency on pins (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Implement input pin state setting in automatic mode (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Add support to get/set priority on input pins (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Implement input pin selection in manual mode (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Register DPLL devices and pins (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Read DPLL types and pin properties from system firmware (Ivan Vecera) [RHEL-114795]
+- dpll: zl3073x: Fetch invariants during probe (Ivan Vecera) [RHEL-114795]
+- dpll: Add basic Microchip ZL3073x support (Ivan Vecera) [RHEL-114795]
+- dt-bindings: dpll: Add support for Microchip Azurite chip family (Ivan Vecera) [RHEL-114795]
+- dt-bindings: dpll: Add DPLL device and pin (Ivan Vecera) [RHEL-114795]
+- idpf: set mac type when adding and removing MAC filters (CKI Backport Bot) [RHEL-123372]
+- crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Fix SNP panic notifier unregistration (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Fix dereferencing uninitialized error pointer (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Fix __sev_snp_shutdown_locked (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Move SEV/SNP Platform initialization to KVM (Lenny Szubowicz) [RHEL-76557]
+- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Add new SEV/SNP platform shutdown API (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Register SNP panic notifier only if SNP is enabled (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Reset TMR size at SNP Shutdown (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (Lenny Szubowicz) [RHEL-76557]
+- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (Lenny Szubowicz) [RHEL-76557]
+- s390/pci: Do not try re-enabling load/store if device is disabled (CKI Backport Bot) [RHEL-114448]
+- s390/pci: Fix stale function handles in error handling (CKI Backport Bot) [RHEL-114448]
+
+* Sat Nov 29 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.19.1.el10_1]
+- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: Fix sparse errors (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: Fix possible UAFs (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: hci_sync: fix set_local_name race condition (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: set_mesh: update LE scan interval and window (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (CKI Backport Bot) [RHEL-122901] {CVE-2025-39981}
+- Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CKI Backport Bot) [RHEL-124134] {CVE-2025-39983}
+- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124110] {CVE-2025-39925}
+- can: j1939: implement NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124110] {CVE-2025-39925}
+- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CKI Backport Bot) [RHEL-123824] {CVE-2025-39982}
+
+* Thu Nov 27 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.18.1.el10_1]
+- ice: ice_adapter: release xa entry on adapter allocation failure (CKI Backport Bot) [RHEL-128472] {CVE-2025-40185}
+- cifs: Fix oops due to uninitialised variable (CKI Backport Bot) [RHEL-120562] {CVE-2025-38737}
+
+* Tue Nov 25 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.17.1.el10_1]
+- x86/hyperv: Fix kdump on Azure CVMs (Li Tian) [RHEL-129777]
+- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart) [RHEL-113919]
+- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CKI Backport Bot) [RHEL-124974] {CVE-2025-40047}
+
+* Sat Nov 22 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.16.1.el10_1]
+- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Xin Long) [RHEL-125759]
+- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CKI Backport Bot) [RHEL-119161] {CVE-2025-39883}
+
+* Thu Nov 20 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.15.1.el10_1]
+- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125623] {CVE-2025-38724}
+- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Jose Ignacio Tornos Martinez) [RHEL-123070]
+- wifi: mt76: do not add non-sta wcid entries to the poll list (Jose Ignacio Tornos Martinez) [RHEL-123070]
+- wifi: mt76: fix linked list corruption (Jose Ignacio Tornos Martinez) [RHEL-123070] {CVE-2025-39918}
+
+* Wed Nov 19 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.14.1.el10_1]
+- ublk: make sure ubq->canceling is set when queue is frozen (Ming Lei) [RHEL-99436] {CVE-2025-22068}
+- e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123127] {CVE-2025-39898}
+- i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123811]
+- i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123811] {CVE-2025-39968}
+- i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123811] {CVE-2025-39969}
+- i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123811] {CVE-2025-39970}
+- i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123811] {CVE-2025-39971}
+- i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123811] {CVE-2025-39972}
+- i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123811] {CVE-2025-39973}
+- nvme-multipath: Skip nr_active increments in RETRY disposition (Ewan D. Milne) [RHEL-123689]
+
+* Thu Nov 13 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.13.1.el10_1]
+- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia) [RHEL-127623]
+- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia) [RHEL-127623]
+- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Scott Mayhew) [RHEL-110051]
+- smb: client: get rid of d_drop() in cifs_do_rename() (Paulo Alcantara) [RHEL-124955]
+- smb: client: fix wrong index reference in smb2_compound_op() (Paulo Alcantara) [RHEL-124955]
+- smb: client: handle unlink(2) of files open by different clients (Paulo Alcantara) [RHEL-124955]
+- smb: client: fix filename matching of deferred files (Paulo Alcantara) [RHEL-124955]
+- fs/smb: Fix inconsistent refcnt update (Paulo Alcantara) [RHEL-124955] {CVE-2025-39819}
+- ice: don't leave device non-functional if Tx scheduler config fails (Petr Oros) [RHEL-116535]
+
+* Tue Nov 11 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.12.1.el10_1]
+- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120672]
+- tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120672] {CVE-2025-39955}
+- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113613] {CVE-2025-39730}
+
+* Thu Nov 06 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.11.1.el10_1]
+- of_numa: fix uninitialized memory nodes causing kernel panic (Charles Mirabile) [RHEL-123154] {CVE-2025-39903}
+- redhat: use the same cert as UKI's to sign addons (Li Tian) [RHEL-124734]
+- ibmveth: Add multi buffers rx replenishment hcall support (Mamatha Inamdar) [RHEL-116193]
+- net: ibmveth: Reset the adapter when unexpected states are detected (Mamatha Inamdar) [RHEL-116193]
+- ibmvnic: Increase max subcrq indirect entries with fallback (Mamatha Inamdar) [RHEL-116189]
+- redhat: enable TDX host config (Paolo Bonzini) [RHEL-27145]
+- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Paolo Bonzini) [RHEL-27145]
+- x86/virt/tdx: Update the kexec section in the TDX documentation (Paolo Bonzini) [RHEL-27145]
+- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Paolo Bonzini) [RHEL-27145]
+- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Paolo Bonzini) [RHEL-27145]
+- x86/sme: Use percpu boolean to control WBINVD during kexec (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Consolidate relocate_kernel() function parameters (Paolo Bonzini) [RHEL-27145]
+- x86/paravirt: Remove the WBINVD callback (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Use typedef for relocate_kernel_fn function prototype (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Cope with relocate_kernel() not being at the start of the page (Paolo Bonzini) [RHEL-27145]
+- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Mark machine_kexec() with __nocfi (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Use correct swap page in swap_pages function (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Ensure preserve_context flag is set on return to kernel (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Disable global pages before writing to control page (Paolo Bonzini) [RHEL-27145]
+- x86: Fix build regression with CONFIG_KEXEC_JUMP enabled (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Clean up register usage in relocate_kernel() (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Drop page_list argument from relocate_kernel() (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Add data section to relocate_kernel (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Move relocate_kernel to kernel .data section (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Invoke copy of relocate_kernel() instead of the original (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Copy control page into place in machine_kexec_prepare() (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Allocate PGD for x86_64 transition page tables separately (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Only swap pages for ::preserve_context mode (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Clean up and document register use in relocate_kernel_64.S (Paolo Bonzini) [RHEL-27145]
+- x86/kexec: Restore GDT on return from ::preserve_context kexec (Paolo Bonzini) [RHEL-27145]
+
+* Sat Nov 01 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.10.1.el10_1]
+- wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122880] {CVE-2025-39864}
+- selftests: tls: test skb copy under mem pressure and OOB (CKI Backport Bot) [RHEL-120380] {CVE-2025-39946}
+- tls: make sure to abort the stream if headers are bogus (CKI Backport Bot) [RHEL-120380] {CVE-2025-39946}
+- ixgbe: fix ixgbe_orom_civd_info struct layout (Michal Schmidt) [RHEL-119079]
+- ice: fix Rx page leak on multi-buffer frames (Petr Oros) [RHEL-116543]
+- eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111055] {CVE-2025-38614}
+
+* Tue Oct 28 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.9.1.el10_1]
+- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (CKI Backport Bot) [RHEL-123290]
+- smb: client: fix file open check in __cifs_unlink() (Paulo Alcantara) [RHEL-122417]
+- smb: client: fix data loss due to broken rename(2) (Paulo Alcantara) [RHEL-122417]
+- smb: client: fix compound alignment with encryption (Paulo Alcantara) [RHEL-122417]
+- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-122417]
+- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-122417]
+- use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-121702] {CVE-2025-38498}
+- do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-121702] {CVE-2025-38498}
+- cgroup/psi: Set of->priv to NULL upon file release (CKI Backport Bot) [RHEL-119143] {CVE-2025-39881}
+- kernfs: Fix UAF in polling when open file is released (CKI Backport Bot) [RHEL-119143] {CVE-2025-39881}
+- redhat: rpminspect: update emptyrpm list for kernel variants (Alexandra Hájková)
+- scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119132] {CVE-2025-39841}
+- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118462] {CVE-2025-39817}
+- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117585] {CVE-2025-39849}
+- xfs: do not propagate ENODATA disk errors into xattr code (Carlos Maiolino) [RHEL-115733]
+- ipv6: sr: Fix MAC comparison to be constant-time (CKI Backport Bot) [RHEL-116387] {CVE-2025-39702}
+- s390/ism: fix concurrency management in ism_cmd() (CKI Backport Bot) [RHEL-114500]
+- s390/hypfs: Enable limited access during lockdown (CKI Backport Bot) [RHEL-114431]
+- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (CKI Backport Bot) [RHEL-114431]
+- redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86 (Waiman Long) [RHEL-114276]
+- x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
+- RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-114931]
+- net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-114931]
+- net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-114931]
+- net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-114931]
+- net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-114931]
+- net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-114931]
+- mm: swap: fix potential buffer overflow in setup_clusters() (CKI Backport Bot) [RHEL-114862] {CVE-2025-39727}
+- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114852] {CVE-2025-39751}
+- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114693] {CVE-2025-38729}
+- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114693]
+- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114693] {CVE-2025-39757}
+- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (Mamatha Inamdar) [RHEL-114439]
+- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mamatha Inamdar) [RHEL-114439]
+- ibmvnic: Add stat for tx direct vs tx batched (Mamatha Inamdar) [RHEL-114439]
+- vsock/virtio: Validate length in packet header before skb_put() (CKI Backport Bot) [RHEL-114301] {CVE-2025-39718}
+- NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113861] {CVE-2025-39697}
 
 * Fri Oct 17 2025 Jan Stancek <jstancek@redhat.com> [6.12.0-124.8.1.el10_1]
 - redhat: revert to using redhatsecureboot504 for RHEL UKI (Vitaly Kuznetsov) [RHEL-122226]

my-ostree-os/kernel/rpminspect.yaml

@@ -21,10 +21,22 @@ emptyrpm:
         - kernel-debug
         - kernel-debug-devel-matched
         - kernel-devel-matched
-        - kernel-lpae
         - kernel-zfcpdump
         - kernel-zfcpdump-devel-matched
         - kernel-zfcpdump-modules
+        - kernel-zfcpdump-modules-partner
+        - kernel-rt
+        - kernel-rt-debug
+        - kernel-rt-debug-devel-matched
+        - kernel-rt-devel-matched
+        - kernel-64k
+        - kernel-64k-debug
+        - kernel-64k-debug-devel-matched
+        - kernel-64k-devel-matched
+        - kernel-rt-64k
+        - kernel-rt-64k-debug
+        - kernel-rt-64k-debug-devel-matched
+        - kernel-rt-64k-devel-matched
 
 patches:
     ignore_list: