# changelog

author: mapengyuan <mapengyuan@xfusion.com> - 6.6.0-145.3.13.143.u54
changelog:
  - Type:CVE
  - CVE: CVE-2026-31729,CVE-2026-43381,CVE-2026-43037,CVE-2026-43038,CVE-2026-43040,CVE-2026-43057,CVE-2026-43492,CVE-2026-43493,CVE-2026-43119,CVE-2026-43134,CVE-2026-43123,CVE-2026-43223,CVE-2026-43472,CVE-2026-31752,CVE-2026-43428,CVE-2026-31503,CVE-2026-43170,CVE-2026-43427,CVE-2026-43483,CVE-2026-43212,CVE-2026-43408
  - DESC:!22970 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-154.0.0 to 6.6.0-155.0.0
      Revert "net: unic: adapt to the change for ETS tsa and bw configuration permission"
      Revert "net: unic: Notify MAMI when the LACP status changes"
      Revert "net: unic: The unsupported VL rate limit value is displayed as 0"
      Revert "driver core: enforce device_lock for driver_match_device()"
      gpio: omap: do not register driver in probe()
      vsock/test: verify socket options after setting them
      net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
      scsi: qla2xxx: Query FW again before proceeding with login
      scsi: qla2xxx: Allow recovery for tape devices
      wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
      nilfs2: Fix potential block overflow that cause system hang
      crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req
      crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
      crypto: octeontx - Fix length check to avoid truncation in ucode_load_store
      Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
      driver core: enforce device_lock for driver_match_device()
      usb: typec: ucsi: skip connector validation before init
      usb: typec: ucsi: validate connector number in ucsi_notify_common()
      nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
      ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
      ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
      net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
      net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
      lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
      crypto: pcrypt - Fix handling of MAY_BACKLOG requests
      dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
      dpaa2-switch: do not clear any interrupts automatically
      wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
      ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
      spi: tegra114: Preserve SPI mode bits in def_command1_reg
      spi: tegra: Fix a memory leak in tegra_slink_probe()
      btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
      hwmon: (occ) Mark occ_init_attribute() as __printf
      drm/mgag200: fix mgag200_bmc_stop_scanout()
      net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi()
      tipc: use kfree_sensitive() for session key material
      net: don't touch dev->stats in BPF redirect paths
      dpaa2-switch: add bounds check for if_id in IRQ handler
      net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
      net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
      net: liquidio: Initialize netdev pointer before queue setup
      dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
      platform/x86: hp-bioscfg: Skip empty attribute names
      platform/x86: intel_telemetry: Fix PSS event register mask
      platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
      wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
      wifi: mac80211: correctly check if CSA is active
      ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
      wifi: cfg80211: Fix bitrate calculation overflow for HE rates
      ASoC: tlv320adcx140: Propagate error codes during probe
      ASoC: amd: yc: Fix microphone on ASUS M6500RE
      ASoC: davinci-evm: Fix reference leak in davinci_evm_probe
      wifi: mac80211: collect station statistics earlier when disconnect
      ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
      HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
      HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
      HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
      netfilter: replace -EEXIST with -EBUSY
      ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
      HID: playstation: Center initial joystick axes to prevent spurious events
      HID: intel-ish-hid: Reset enum_devices_done before enumeration
      btrfs: fix reservation leak in some error paths when inserting inline extent
      HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
      HID: intel-ish-hid: Update ishtp bus match to support device ID table
      LoongArch: Enable exception fixup for specific ADE subcode
      LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED
      block,bfq: fix aux stat accumulation destination
      net: usb: sr9700: support devices with virtual driver CD
      wifi: wlcore: ensure skb headroom before skb_push
      wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
      tracing: Fix ftrace event field alignments
      KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures
      binderfs: fix ida_alloc_max() upper bound
      binder: fix BR_FROZEN_REPLY error log
      ublk: fix deadlock when reading partition table
      Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
      ARM: 9468/1: fix memset64() on big-endian
      rbd: check for EOD after exclusive lock is ensured to be held
      pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
      pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup
      pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset
      pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup
      pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state
      platform/x86: intel_telemetry: Fix swapped arrays in PSS output
      !22896 arm64/ras: Firmware-first SEI error handling w
      arm64: openeuler_defconfig: enable CONFIG_ARM64_SYNC_SEI by default
      ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS
      arm64: Add runtime switch to control ESB for SEI synchronization
      arm64/entry: Add support to synchronize SEI at the exception boundary
      !22834 config: x86: Fix openeuler_defconfig to resolve CI failure
      config: x86: Restore CONFIG_INIT_STACK_ALL_{PATTERN,ZERO} in openeuler_defconfig
      config: x86: Fix CI "checkdefconfig" warning by updating defconfig
      !22789 critical err extend
      numa: add critical_err sysfs interface for remote node recovery
      mm: mark node as critical_err on remote RAS error
      !22776 revert mpam from openEuler-24.03-LTS_SP3
      Revert "x86: Decouple resctrl with resctrl-mpam"
      Revert "x86/resctrl: Fix unused variable warning in cache_alloc_hsw_probe()"
      Revert "x86/resctrl: Remove hard-coded memory bandwidth limit"
      Revert "x86/resctrl: Read supported bandwidth sources from CPUID"
      Revert "x86/resctrl: Implement new mba_MBps throttling heuristic"
      Revert "x86/resctrl: Remove redundant variable in mbm_config_write_domain()"
      Revert "x86/resctrl: Free rmid_ptrs from resctrl_exit()"
      Revert "x86/resctrl: Create helper for RMID allocation and mondata dir creation"
      Revert "x86/resctrl: Move RMID allocation out of mkdir_rdt_prepare()"
      Revert "x86/resctrl: Track the closid with the rmid"
      Revert "x86/resctrl: Access per-rmid structures by index"
      Revert "x86/resctrl: Allow RMID allocation to be scoped by CLOSID"
      Revert "x86/resctrl: Track the number of dirty RMID a CLOSID has"
      Revert "x86/resctrl: Use __set_bit()/__clear_bit() instead of open coding"
      Revert "x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid"
      Revert "x86/resctrl: Move CLOSID/RMID matching and setting to use helpers"
      Revert "x86/resctrl: Add cpumask_any_housekeeping() for limbo/overflow"
      Revert "x86/resctrl: Queue mon_event_read() instead of sending an IPI"
      Revert "x86/resctrl: Allow resctrl_arch_rmid_read() to sleep"
      Revert "x86/resctrl: Allow arch to allocate memory needed in resctrl_arch_rmid_read()"
      Revert "x86/resctrl: Make resctrl_mounted checks explicit"
      Revert "x86/resctrl: Move alloc/mon static keys into helpers"
      Revert "x86/resctrl: Make rdt_enable_key the arch's decision to switch"
      Revert "x86/resctrl: Add helpers for system wide mon/alloc capable"
      Revert "x86/resctrl: Add CPU online callback for resctrl work"
      Revert "x86/resctrl: Allow overflow/limbo handlers to be scheduled on any-but CPU"
      Revert "x86/resctrl: Add CPU offline callback for resctrl work"
      Revert "x86/resctrl: Move domain helper migration into resctrl_offline_cpu()"
      Revert "x86/resctrl: Separate arch and fs resctrl locks"
      Revert "x86/resctrl: Remove lockdep annotation that triggers false positive"
      Revert "Documentation/x86: Document that resctrl bandwidth control units are MiB"
      Revert "Documentation/x86: Fix title underline length"
      Revert "x86/resctrl: Fix uninitialized memory read when last CPU of domain goes offline"
      Revert "x86/resctrl: Switch to new Intel CPU model defines"
      Revert "x86/resctrl: Pass domain to target CPU"
      Revert "x86/resctrl: Simplify call convention for MSR update functions"
      Revert "x86/resctrl: Rename pseudo_lock_event.h to trace.h"
      Revert "x86/resctrl: Add tracepoint for llc_occupancy tracking"
      Revert "x86/resctrl: Don't try to free nonexistent RMIDs"
      Revert "cpu: Move CPU hotplug function declarations into their own header"
      Revert "cpu: Drop "extern" from function declarations in cpuhplock.h"
      Revert "cacheinfo: Add function to get cacheinfo for a given CPU and cache level"
      Revert "x86/resctrl: Replace open coded cacheinfo searches"
      Revert "x86/resctrl: Prepare for new domain scope"
      Revert "x86/resctrl: Prepare to split rdt_domain structure"
      Revert "x86/resctrl: Prepare for different scope for control/monitor operations"
      Revert "x86/resctrl: Split the rdt_domain and rdt_hw_domain structures"
      Revert "x86/resctrl: Add node-scope to the options for feature scope"
      Revert "x86/resctrl: Introduce snc_nodes_per_l3_cache"
      Revert "x86/resctrl: Block use of mba_MBps mount option on Sub-NUMA Cluster (SNC) systems"
      Revert "x86/resctrl: Prepare for new Sub-NUMA Cluster (SNC) monitor files"
      Revert "x86/resctrl: Add a new field to struct rmid_read for summation of domains"
      Revert "x86/resctrl: Initialize on-stack struct rmid_read instances"
      Revert "x86/resctrl: Refactor mkdir_mondata_subdir() with a helper function"
      Revert "x86/resctrl: Allocate a new field in union mon_data_bits"
      Revert "x86/resctrl: Create Sub-NUMA Cluster (SNC) monitor files"
      Revert "x86/resctrl: Handle removing directories in Sub-NUMA Cluster (SNC) mode"
      Revert "x86/resctrl: Fill out rmid_read structure for smp_call*() to read a counter"
      Revert "x86/resctrl: Make __mon_event_count() handle sum domains"
      Revert "x86/resctrl: Enable shared RMID mode on Sub-NUMA Cluster (SNC) systems"
      Revert "x86/resctrl: Detect Sub-NUMA Cluster (SNC) mode"
      Revert "x86/resctrl: Update documentation with Sub-NUMA cluster changes"
      Revert "x86/resctrl: Fix arch_mbm_* array overrun on SNC"
      Revert "x86/resctrl: Avoid overflow in MB settings in bw_validate()"
      Revert "x86/resctrl: Annotate get_mem_config() functions as __init"
      Revert "x86/resctrl: Slightly clean-up mbm_config_show()"
      Revert "x86/resctrl: Support Sub-NUMA cluster mode SNC6"
      Revert "x86/resctrl: Use kthread_run_on_cpu()"
      Revert "x86/resctrl: Introduce resctrl_file_fflags_init() to initialize fflags"
      Revert "x86/resctrl: Prepare for per-CTRL_MON group mba_MBps control"
      Revert "x86/resctrl: Modify update_mba_bw() to use per CTRL_MON group event"
      Revert "x86/resctrl: Compute memory bandwidth for all supported events"
      Revert "x86/resctrl: Make mba_sc use total bandwidth if local is not supported"
      Revert "x86/resctrl: Add "mba_MBps_event" file to CTRL_MON directories"
      Revert "x86/resctrl: Add write option to "mba_MBps_event" file"
      Revert "x86/resctrl: Document the new "mba_MBps_event" file"
      Revert "x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors"
      Revert "x86/resctrl: Add a helper to avoid reaching into the arch code resource list"
      Revert "x86/resctrl: Remove fflags from struct rdt_resource"
      Revert "x86/resctrl: Use schema type to determine how to parse schema values"
      Revert "x86/resctrl: Use schema type to determine the schema format string"
      Revert "x86/resctrl: Remove data_width and the tabular format"
      Revert "x86/resctrl: Add max_bw to struct resctrl_membw"
      Revert "x86/resctrl: Generate default_ctrl instead of sharing it"
      Revert "x86/resctrl: Add helper for setting CPU default properties"
      Revert "x86/resctrl: Remove rdtgroup from update_cpu_closid_rmid()"
      Revert "x86/resctrl: Expose resctrl fs's init function to the rest of the kernel"
      Revert "x86/resctrl: Move rdt_find_domain() to be visible to arch and fs code"
      Revert "x86/resctrl: Move resctrl types to a separate header"
      Revert "x86/resctrl: Add an arch helper to reset one resource"
      Revert "x86/resctrl: Move monitor exit work to a resctrl exit call"
      Revert "x86/resctrl: Move monitor init work to a resctrl init call"
      Revert "x86/resctrl: Rewrite and move the for_each_*_rdt_resource() walkers"
      Revert "x86/resctrl: Move the is_mbm_*_enabled() helpers to asm/resctrl.h"
      Revert "x86/resctrl: Add resctrl_arch_is_evt_configurable() to abstract BMEC"
      Revert "x86/resctrl: Change mon_event_config_{read,write}() to be arch helpers"
      Revert "x86/resctrl: Move mba_mbps_default_event init to filesystem code"
      Revert "x86/resctrl: Move mbm_cfg_mask to struct rdt_resource"
      Revert "x86/resctrl: Add resctrl_arch_ prefix to pseudo lock functions"
      Revert "x86/resctrl: Allow an architecture to disable pseudo lock"
      Revert "x86/resctrl: Make prefetch_disable_bits belong to the arch code"
      Revert "x86/resctrl: Make resctrl_arch_pseudo_lock_fn() take a plr"
      Revert "x86/resctrl: Move RFTYPE flags to be managed by resctrl"
      Revert "x86/resctrl: Handle throttle_mode for SMBA resources"
      Revert "x86/resctrl: Move get_config_index() to a header"
      Revert "x86/resctrl: Move get_{mon,ctrl}_domain_from_cpu() to live with their callers"
      Revert "cpumask: kernel-doc cleanups and additions"
      Revert "cpumask: add cpumask_any_and_but()"
      Revert "cpumask: add cpumask_weight_andnot()"
      Revert "cpumask: Introduce cpumask_first_and_and()"
      Revert "cpumask: Switch from inline to __always_inline"
      Revert "cpumask: Relax cpumask_any_but()"
      Revert "find: Add find_first_andnot_bit()"
      Revert "cpumask: Add cpumask_{first,next}_andnot() API"
      Revert "ptrace: Convert ptrace_attach() to use lock guards"
      Revert "kernfs: sysfs: support custom llseek method for sysfs entries"
      Revert "kernfs: Convert kernfs_walk_ns() from strlcpy() to strscpy()"
      Revert "kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy()"
      Revert "kernfs: mount: Remove unnecessary ‘NULL’ values from knparent"
      Revert "kernfs: Acquire kernfs_rwsem in kernfs_notify_workfn()."
      Revert "kernfs: Acquire kernfs_rwsem in kernfs_get_parent_dentry()."
      Revert "kernfs: Acquire kernfs_rwsem in kernfs_node_dentry()."
      Revert "kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy()"
      Revert "kernfs: Use RCU to access kernfs_node::parent."
      Revert "kernfs: Use RCU to access kernfs_node::name."
      Revert "kernfs: annotate different lockdep class for of->mutex of writable files"
      Revert "kernfs: Drop kernfs_rwsem while invoking lookup_positive_unlocked()."
      Revert "kernfs: Move dput() outside of the RCU section."
      Revert "x86/resctrl: Optimize cpumask_any_housekeeping()"
      Revert "x86/resctrl: Remove the limit on the number of CLOSID"
      Revert "x86/resctrl: Rename resctrl_sched_in() to begin with "resctrl_arch_""
      Revert "x86/resctrl: Check all domains are offline in resctrl_exit()"
      Revert "x86/resctrl: Resctrl_exit() teardown resctrl but leave the mount point"
      Revert "x86/resctrl: Drop __init/__exit on assorted symbols"
      Revert "x86/resctrl: Move is_mba_sc() out of core.c"
      Revert "x86/resctrl: Add end-marker to the resctrl_event_id enum"
      Revert "x86/resctrl: Expand the width of domid by replacing mon_data_bits"
      Revert "x86/resctrl: Split trace.h"
      Revert "x86/resctrl: Add 'resctrl' to the title of the resctrl documentation"
      Revert "fs/resctrl: Add boiler plate for external resctrl code"
      Revert "x86/resctrl: Move the filesystem bits to headers visible to fs/resctrl"
      Revert "x86/resctrl: Move enum resctrl_event_id to resctrl.h"
      Revert "x86/resctrl: Fix types in resctrl_arch_mon_ctx_{alloc,free}() stubs"
      Revert "x86/resctrl: Move pseudo lock prototypes to include/linux/resctrl.h"
      Revert "x86/resctrl: Squelch whitespace anomalies in resctrl core code"
      Revert "x86/resctrl: Prefer alloc(sizeof(*foo)) idiom in rdt_init_fs_context()"
      Revert "x86/resctrl: Relax some asm #includes"
      Revert "x86/resctrl: Always initialise rid field in rdt_resources_all[]"
      Revert "x86/resctrl: Fix rdtgroup_mkdir()'s unlocked use of kernfs_node::name"
      Revert "x86,fs/resctrl: Move the resctrl filesystem code to live in /fs/resctrl"
      Revert "MAINTAINERS: Add reviewers for fs/resctrl"
      Revert "fs/resctrl: Restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex"
      Revert "x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem"
      Revert "resctrl: get rid of pointless debugfs_file_{get,put}()"
      Revert "fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters"
      Revert "fs/resctrl: Optimize code in rdt_get_tree()"
      Revert "x86/resctrl: Support Sub-NUMA Cluster (SNC) mode on Clearwater Forest"
      Revert "x86,fs/resctrl: Consolidate monitor event descriptions"
      Revert "x86,fs/resctrl: Replace architecture event enabled checks"
      Revert "x86/resctrl: Remove the rdt_mon_features global variable"
      Revert "x86,fs/resctrl: Prepare for more monitor events"
      !22703 sync pr 21834 22206 from OLK-6.6: net: add sockopt TCP_UBS_HANDSHAKE
      !22727 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-152.0.0 to 6.6.0-154.0.0
      Bluetooth: hci_sync: annotate data-races around hdev->req_status
      Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
      fbcon: check return value of con2fb_acquire_newinfo()
      media: pvrusb2: fix URB leak in pvr2_send_request_ex
      unshare: fix unshare_fs() handling
      bridge: br_nd_send: validate ND option lengths
      obmm: add VMA access for ptrace/GDB on PFNMAP regions
      obmm: support VMA split with ownership-aligned attributes
      obmm: refactor ownership tracking for PMD-granularity support
      obmm: fix PTE protection bits for READWRITE mappings
      mm: export split_vma for module use
      USB: core: Limit the length of unkillable synchronous timeouts
      udp: Fix wildcard bind conflict check when using hash2
      tcp: Rearrange tests in inet_csk_bind_conflict().
      usb: dwc3: gadget: Move vbus draw to workqueue context
      usb: class: cdc-wdm: fix reordering issue in read code path
      x86,fs/resctrl: Prepare for more monitor events
      x86/resctrl: Remove the rdt_mon_features global variable
      x86,fs/resctrl: Replace architecture event enabled checks
      x86,fs/resctrl: Consolidate monitor event descriptions
      x86/resctrl: Support Sub-NUMA Cluster (SNC) mode on Clearwater Forest
      fs/resctrl: Optimize code in rdt_get_tree()
      fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters
      resctrl: get rid of pointless debugfs_file_{get,put}()
      x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem
      fs/resctrl: Restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex
      MAINTAINERS: Add reviewers for fs/resctrl
      x86,fs/resctrl: Move the resctrl filesystem code to live in /fs/resctrl
      x86/resctrl: Fix rdtgroup_mkdir()'s unlocked use of kernfs_node::name
      x86/resctrl: Always initialise rid field in rdt_resources_all[]
      x86/resctrl: Relax some asm #includes
      x86/resctrl: Prefer alloc(sizeof(*foo)) idiom in rdt_init_fs_context()
      x86/resctrl: Squelch whitespace anomalies in resctrl core code
      x86/resctrl: Move pseudo lock prototypes to include/linux/resctrl.h
      x86/resctrl: Fix types in resctrl_arch_mon_ctx_{alloc,free}() stubs
      x86/resctrl: Move enum resctrl_event_id to resctrl.h
      x86/resctrl: Move the filesystem bits to headers visible to fs/resctrl
      fs/resctrl: Add boiler plate for external resctrl code
      x86/resctrl: Add 'resctrl' to the title of the resctrl documentation
      x86/resctrl: Split trace.h
      x86/resctrl: Expand the width of domid by replacing mon_data_bits
      x86/resctrl: Add end-marker to the resctrl_event_id enum
      x86/resctrl: Move is_mba_sc() out of core.c
      x86/resctrl: Drop __init/__exit on assorted symbols
      x86/resctrl: Resctrl_exit() teardown resctrl but leave the mount point
      x86/resctrl: Check all domains are offline in resctrl_exit()
      x86/resctrl: Rename resctrl_sched_in() to begin with "resctrl_arch_"
      x86/resctrl: Remove the limit on the number of CLOSID
      x86/resctrl: Optimize cpumask_any_housekeeping()
      kernfs: Move dput() outside of the RCU section.
      kernfs: Drop kernfs_rwsem while invoking lookup_positive_unlocked().
      kernfs: annotate different lockdep class for of->mutex of writable files
      kernfs: Use RCU to access kernfs_node::name.
      kernfs: Use RCU to access kernfs_node::parent.
      kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy()
      kernfs: Acquire kernfs_rwsem in kernfs_node_dentry().
      kernfs: Acquire kernfs_rwsem in kernfs_get_parent_dentry().
      kernfs: Acquire kernfs_rwsem in kernfs_notify_workfn().
      kernfs: mount: Remove unnecessary ‘NULL’ values from knparent
      kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy()
      kernfs: Convert kernfs_walk_ns() from strlcpy() to strscpy()
      kernfs: sysfs: support custom llseek method for sysfs entries
      ptrace: Convert ptrace_attach() to use lock guards
      cpumask: Add cpumask_{first,next}_andnot() API
      find: Add find_first_andnot_bit()
      cpumask: Relax cpumask_any_but()
      cpumask: Switch from inline to __always_inline
      cpumask: Introduce cpumask_first_and_and()
      cpumask: add cpumask_weight_andnot()
      cpumask: add cpumask_any_and_but()
      cpumask: kernel-doc cleanups and additions
      x86/resctrl: Move get_{mon,ctrl}_domain_from_cpu() to live with their callers
      x86/resctrl: Move get_config_index() to a header
      x86/resctrl: Handle throttle_mode for SMBA resources
      x86/resctrl: Move RFTYPE flags to be managed by resctrl
      x86/resctrl: Make resctrl_arch_pseudo_lock_fn() take a plr
      x86/resctrl: Make prefetch_disable_bits belong to the arch code
      x86/resctrl: Allow an architecture to disable pseudo lock
      x86/resctrl: Add resctrl_arch_ prefix to pseudo lock functions
      x86/resctrl: Move mbm_cfg_mask to struct rdt_resource
      x86/resctrl: Move mba_mbps_default_event init to filesystem code
      x86/resctrl: Change mon_event_config_{read,write}() to be arch helpers
      x86/resctrl: Add resctrl_arch_is_evt_configurable() to abstract BMEC
      x86/resctrl: Move the is_mbm_*_enabled() helpers to asm/resctrl.h
      x86/resctrl: Rewrite and move the for_each_*_rdt_resource() walkers
      x86/resctrl: Move monitor init work to a resctrl init call
      x86/resctrl: Move monitor exit work to a resctrl exit call
      x86/resctrl: Add an arch helper to reset one resource
      x86/resctrl: Move resctrl types to a separate header
      x86/resctrl: Move rdt_find_domain() to be visible to arch and fs code
      x86/resctrl: Expose resctrl fs's init function to the rest of the kernel
      x86/resctrl: Remove rdtgroup from update_cpu_closid_rmid()
      x86/resctrl: Add helper for setting CPU default properties
      x86/resctrl: Generate default_ctrl instead of sharing it
      x86/resctrl: Add max_bw to struct resctrl_membw
      x86/resctrl: Remove data_width and the tabular format
      x86/resctrl: Use schema type to determine the schema format string
      x86/resctrl: Use schema type to determine how to parse schema values
      x86/resctrl: Remove fflags from struct rdt_resource
      x86/resctrl: Add a helper to avoid reaching into the arch code resource list
      x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors
      x86/resctrl: Document the new "mba_MBps_event" file
      x86/resctrl: Add write option to "mba_MBps_event" file
      x86/resctrl: Add "mba_MBps_event" file to CTRL_MON directories
      x86/resctrl: Make mba_sc use total bandwidth if local is not supported
      x86/resctrl: Compute memory bandwidth for all supported events
      x86/resctrl: Modify update_mba_bw() to use per CTRL_MON group event
      x86/resctrl: Prepare for per-CTRL_MON group mba_MBps control
      x86/resctrl: Introduce resctrl_file_fflags_init() to initialize fflags
      x86/resctrl: Use kthread_run_on_cpu()
      x86/resctrl: Support Sub-NUMA cluster mode SNC6
      x86/resctrl: Slightly clean-up mbm_config_show()
      x86/resctrl: Annotate get_mem_config() functions as __init
      x86/resctrl: Avoid overflow in MB settings in bw_validate()
      x86/resctrl: Fix arch_mbm_* array overrun on SNC
      x86/resctrl: Update documentation with Sub-NUMA cluster changes
      x86/resctrl: Detect Sub-NUMA Cluster (SNC) mode
      x86/resctrl: Enable shared RMID mode on Sub-NUMA Cluster (SNC) systems
      x86/resctrl: Make __mon_event_count() handle sum domains
      x86/resctrl: Fill out rmid_read structure for smp_call*() to read a counter
      x86/resctrl: Handle removing directories in Sub-NUMA Cluster (SNC) mode
      x86/resctrl: Create Sub-NUMA Cluster (SNC) monitor files
      x86/resctrl: Allocate a new field in union mon_data_bits
      x86/resctrl: Refactor mkdir_mondata_subdir() with a helper function
      x86/resctrl: Initialize on-stack struct rmid_read instances
      x86/resctrl: Add a new field to struct rmid_read for summation of domains
      x86/resctrl: Prepare for new Sub-NUMA Cluster (SNC) monitor files
      x86/resctrl: Block use of mba_MBps mount option on Sub-NUMA Cluster (SNC) systems
      x86/resctrl: Introduce snc_nodes_per_l3_cache
      x86/resctrl: Add node-scope to the options for feature scope
      x86/resctrl: Split the rdt_domain and rdt_hw_domain structures
      x86/resctrl: Prepare for different scope for control/monitor operations
      x86/resctrl: Prepare to split rdt_domain structure
      x86/resctrl: Prepare for new domain scope
      x86/resctrl: Replace open coded cacheinfo searches
      cacheinfo: Add function to get cacheinfo for a given CPU and cache level
      cpu: Drop "extern" from function declarations in cpuhplock.h
      cpu: Move CPU hotplug function declarations into their own header
      x86/resctrl: Don't try to free nonexistent RMIDs
      x86/resctrl: Add tracepoint for llc_occupancy tracking
      x86/resctrl: Rename pseudo_lock_event.h to trace.h
      x86/resctrl: Simplify call convention for MSR update functions
      x86/resctrl: Pass domain to target CPU
      x86/resctrl: Switch to new Intel CPU model defines
      x86/resctrl: Fix uninitialized memory read when last CPU of domain goes offline
      Documentation/x86: Fix title underline length
      Documentation/x86: Document that resctrl bandwidth control units are MiB
      x86/resctrl: Remove lockdep annotation that triggers false positive
      x86/resctrl: Separate arch and fs resctrl locks
      x86/resctrl: Move domain helper migration into resctrl_offline_cpu()
      x86/resctrl: Add CPU offline callback for resctrl work
      x86/resctrl: Allow overflow/limbo handlers to be scheduled on any-but CPU
      x86/resctrl: Add CPU online callback for resctrl work
      x86/resctrl: Add helpers for system wide mon/alloc capable
      x86/resctrl: Make rdt_enable_key the arch's decision to switch
      x86/resctrl: Move alloc/mon static keys into helpers
      x86/resctrl: Make resctrl_mounted checks explicit
      x86/resctrl: Allow arch to allocate memory needed in resctrl_arch_rmid_read()
      x86/resctrl: Allow resctrl_arch_rmid_read() to sleep
      x86/resctrl: Queue mon_event_read() instead of sending an IPI
      x86/resctrl: Add cpumask_any_housekeeping() for limbo/overflow
      x86/resctrl: Move CLOSID/RMID matching and setting to use helpers
      x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid
      x86/resctrl: Use __set_bit()/__clear_bit() instead of open coding
      x86/resctrl: Track the number of dirty RMID a CLOSID has
      x86/resctrl: Allow RMID allocation to be scoped by CLOSID
      x86/resctrl: Access per-rmid structures by index
      x86/resctrl: Track the closid with the rmid
      x86/resctrl: Move RMID allocation out of mkdir_rdt_prepare()
      x86/resctrl: Create helper for RMID allocation and mondata dir creation
      x86/resctrl: Free rmid_ptrs from resctrl_exit()
      x86/resctrl: Remove redundant variable in mbm_config_write_domain()
      x86/resctrl: Implement new mba_MBps throttling heuristic
      x86/resctrl: Read supported bandwidth sources from CPUID
      x86/resctrl: Remove hard-coded memory bandwidth limit
      x86/resctrl: Fix unused variable warning in cache_alloc_hsw_probe()
      x86: Decouple resctrl with resctrl-mpam
      crypto: hisilicon - remove unused and non-public APIs for qm and sec
      crypto: hisilicon/qm - drop redundant variable initialization
      crypto: hisilicon/qm - remove else after return
      crypto: hisilicon/qm - add const qualifier to info_name in struct qm_cmd_dump_item
      crypto: hisilicon - fix the format string type error
      crypto: hisilicon/sec2 - prevent req used-after-free for sec
      crypto: hisilicon - add device load query functionality to debugfs
      crypto: hisilicon/qm - increase wait time for mailbox
      crypto: hisilicon/qm - obtain the mailbox configuration at one time
      crypto: hisilicon/qm - remove unnecessary code in qm_mb_write()
      Revert "crypto: hisilicon/qm - obtain the mailbox configuration at one time"
      Revert "hisi_acc_vfio_pci: obtain the mailbox configuration at one time"
      crypto: hisilicon/qm - move the barrier before writing to the mailbox register
      crypto: hisilicon/zip - add lz4 algorithm for hisi_zip
      virtCCA-Live-Migration: Add host agent support for CVM live migration
      fix migvm_queue_dev_mmap buffer check
      gpiolib: acpi: Fix potential out-of-boundary left shift
      bpf/selftests: test_select_reuseport_kern: Remove unused header
      Revert "net: Remove conditional threaded-NAPI wakeup based on task state."
      Revert "net: Allow to use SMP threads for backlog NAPI."
      ksmbd: fix recursive locking in RPC handle list access
      pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins
      mptcp: avoid dup SUB_CLOSED events after disconnect
      writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
      drm/msm/a6xx: fix bogus hwcg register updates
      pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
      ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check
      net/sched: act_ife: convert comma to semicolon
      btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate()
      drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
      wifi: mac80211: move TDLS work to wiphy work
      ksmbd: Fix race condition in RPC handle list access
      drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV
      ksmbd: smbd: fix dma_unmap_sg() nents
      mei: trace: treat reg parameter as string
      mm/kfence: randomize the freelist on initialization
      drm/amdgpu/gfx11: fix wptr reset in KGQ init
      drm/amdgpu/gfx10: fix wptr reset in KGQ init
      drm/amdgpu/soc21: fix xclk for APUs
      drm/imx/tve: fix probe device leak
      scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
      flex_proportions: make fprop_new_period() hardirq safe
      selftests: mptcp: join: fix local endp not being tracked
      mptcp: only reset subflow errors when propagated
      scsi: qla2xxx: edif: Fix dma_free_coherent() size
      gpio: pca953x: mask interrupts in irq shutdown
      ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
      scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
      ASoC: fsl: imx-card: Do not force slot width to sample width
      rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target
      riscv: compat: fix COMPAT_UTS_MACHINE definition
      pinctrl: meson: mark the GPIO controller as sleeping
      dma/pool: distinguish between missing and exhausted atomic pools
      gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
      ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
      scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
      net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
      net: bridge: fix static key check
      nfc: nci: Fix race between rfkill and nci_unregister_device().
      net/mlx5e: Account for netdev stats in ndo_get_stats64
      net/mlx5e: Report rx_discards_phy via rx_dropped
      ice: stop counting UDP csum mismatch as rx_errors
      nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
      rocker: fix memory leak in rocker_world_port_post_fini()
      net: wwan: t7xx: fix potential skb->frags overflow in RX path
      ipv6: use the right ifindex when replying to icmpv6 from localhost
      net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
      octeon_ep: Fix memory leak in octep_device_setup()
      net: bcmasp: fix early exit leak with fixed phy
      net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
      Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
      KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
      net/oenetcls: free sk entry hash on ntuple cleanup
      sched/fair: Fix overflow in vruntime_eligible()
      sched/fair: Introduce and use the vruntime_cmp() and vruntime_op() wrappers for wrapped-signed aritmetics
      sched/fair: Mark m*_vruntime() with __maybe_unused
      sched/fair: Clear rel_deadline when initializing forked entities
      Revert "sched/fair: Clear rel_deadline when initializing forked entities"
      LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE
      ceph: add a bunch of missing ceph_path_info initializers
      blk-cgroup: skip dying blkg in blkcg_activate_policy()
      urma: fix the panic when ipourma module is repeatedly loaded
      net: ipa: fix event ring index not programmed for IPA v5.0+
      net/oenetcls: remove duplicated linux/inet.h include
      net/oenetcls: fix mode-0 init rollback for ntuple resources
      net/oenetcls: fix RPS CPU index scaling bias
      net/oenetcls: Add rps policy switch for phy NIC
      net/oenetcls: Make OENETCLS default as module
      net/oenetcls: Support ipv6 for ntuple mode
      net/oenetcls: Supports rxq multiplexing
      net/oenetcls: Add local flow NUMA-aware rps
      net/oenetcls: Fix possible hash collision issue
      net/oenetcls: Prioritize oenetcls hooks over rps
      net/oenetcls: Add mode 2 for rps numa affinity
      usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
      ptrace: Fix kabi breakage in struct task_struct
      ptrace: slightly saner 'get_dumpable()' logic
      urma: Enable RH2D streaming by IPoURMA
      urma: fix spinlock usage in ubagg_get_seg_info function
      smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
      apei: use blocking notifier for page offline policy chain
      urma: fix reference count imbalance in ubagg and uburma modules
      powerpc, perf: Check that current->mm is alive before getting user callchain
      ub:ubus: Add KABI_RESERVE to struct ub_decoder and message_device
      ub:ubus: Will not enable decoder if matt jurisdiction is UBFM
      ub:ubus: change the condition of io decoder creating page table or not
      net: unic: The unsupported VL rate limit value is displayed as 0
      net: unic: Notify MAMI when the LACP status changes
      net: unic: adapt to the change for ETS tsa and bw configuration permission
      iommu/ummu-core: fix uaf in ummu_core_invalidate_cfg()
      iommu: Optimize the iommu PLBI Framework
      iommu/ummu: remove swap operation when ungrant
      iommu/ummu-core: ummu_fill_pages interface provides GFP flags for memory allocation
      perf/x86/intel/uncore: Fix die ID init and look up bugs
      scsi: target: tcm_loop: Drain commands in target_reset handler
      net: make CONFIG_UB_SOCKET_HANDSHAKE independent of CONFIG_UB_UMS
      net: add sockopt TCP_UBS_HANDSHAKE


author: mapengyuan <mapengyuan@xfusion.com> - 6.6.0-145.3.14.145.u55
changelog:
  - Type:CVE
  - CVE:CVE-2026-43503,CVE-2026-46300,CVE-2026-43148,CVE-2026-43201,CVE-2026-43292,CVE-2026-45911,CVE-2026-45982,CVE-2026-46171,CVE-2026-46082,CVE-2026-46076,CVE-2026-43366,CVE-2026-45947,CVE-2026-43288,CVE-2026-46006,CVE-2026-43163,CVE-2026-43061,CVE-2026-46181,CVE-2026-46093,CVE-2026-43406,CVE-2026-46165,CVE-2026-43466,CVE-2026-46033,CVE-2026-43468,CVE-2026-46051,CVE-2026-46044,CVE-2026-43156,CVE-2026-46121,CVE-2026-46178,CVE-2026-45834,CVE-2026-46138
  - DESC:!23085 sync CVE LTS and bugfix from OLK-6.6 from 8238b832b9ac to 14ed6c3948b1
    net: skbuff: preserve shared-frag marker during coalescing
    net: skbuff: propagate shared-frag marker through frag-transfer helpers
    powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()
      LoongArch: package EFI kernel image
      !23496 sync CVE LTS and bugfix from OLK-6.6 from 8238b832b9ac to 354122fd6c91
    urma: refactor connect_bonding from ubcore to ubagg
    urma: change wk1 to wk2 to send data and add responsibility
    APEI/GHES: ARM processor Error: don't go past allocated memory
    mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
    obmm: validate VMA identity via vm_ops before accessing vm_file
    obmm: add PMD huge entry support for ptrace/GDB vma access
    obmm: fix VMA access for ptrace/GDB on export regions
    obmm: fix page table walk for ownership permission updates
    obmm: reject MAP_PRIVATE
    urma: increase topo max node limit to 1024
    usb: cdns3: fix role switching during resume
    iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec
    iommu/ummu: Fix incorrect xarray index in map_pages error path
    ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
    riscv: kvm: fix vector context allocation leak
    KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
    KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
    io_uring/kbuf: check if target buffer list is still legacy on recycle
    drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
    ext4: move ext4_percpu_param_init() before ext4_mb_init()
    drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
    md/bitmap: fix GPF in write_page caused by resize race
    serial: 8250: Fix TX deadlock when using DMA
    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
    refcount: provide ops for cases when object's memory can be reused
    urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap
    mm/vmalloc: take vmap_purge_lock in shrinker
    libceph: prevent potential out-of-bounds reads in process_message_header()
    sched/cputime: Fix time overflow in cputime_adjust()
    ub: udma: change default value of set dev name
    openvswitch: vport: fix self-deadlock on release of tunnel ports
    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
    crypto: authencesn - reject short ahash digests during instance creation
    net/mlx5: Fix deadlock between devlink lock and esw->wq
    md/raid5: fix soft lockup in retry_aligned_read()
    ipmi:ssif: NULL thread on error
    ipmi:ssif: Clean up kthread on errors
    net: yt6801: fix link info for yt6801
    urma: fix main_ue_eid flush ioctl argument
    net: usb: pegasus: enable basic endpoint checking
    mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
    bpf-rvi: Fix possible AA deadlock pidns_list_lock
    RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
    Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
    Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
    usb: ulpi: fix memory leak on ulpi_register() error paths
    usb: ulpi: fix double free in ulpi_register_interface() error path
    x86/kexec: add a sanity check on previous kernel's ima kexec buffer
    ima: verify the previous kernel's IMA buffer lies in addressable RAM
    usb: usblp: fix heap leak in IEEE 1284 device ID via short response
    usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
    mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
    wifi: rsi: fix kthread lifetime race between self-exit and external-stop
    vsock/virtio: fix accept queue count leak on transport mismatch
    net: caif: clear client service pointer on teardown
    net: qrtr: ns: Fix use-after-free in driver remove()
    xen-netback: reject zero-queue configuration from guest
    openeuler_defconfig: disable CONFIG_USERSWAP by default
    mm/userswap: remove boot param
    ceph: only d_add() negative dentries when they are unhashed
    net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path
    net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
    thermal: core: Fix thermal zone governor cleanup issues
    soc cache: Fix unsafe shift left
    urma: fix device change namespace calltrace
    urma: topology supports parallel planes
    urma: fix main_ue_eid query table configuration path
    bpf: Fix variable length stack write over spilled pointers
    bpf: Do not allow deleting local storage in NMI
    bpf: Convert bpf_selem_unlink to failable
    bpf: Convert bpf_selem_link_map to failable
    bpf: Convert bpf_selem_unlink_map to failable
    bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage
    eventfs: Hold eventfs_mutex and SRCU when remount walks events
    gfs2: Fix use-after-free in iomap inline data write path
    gfs2: Add metapath_dibh helper
    erofs: fix inline data read failure for ztailpacking pclusters
    gfs2: Fix slab-use-after-free in qd_put
    gfs2: fix memory leaks in gfs2_fill_super error path
    erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
    erofs: fix the out-of-bounds nameoff handling for trailing dirents
    ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
    ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
    net: consume xmit errors of GSO frames
    ub:ubfi: add numa node get from firmware mode
    urma: fix the scenario-specific message processing interface
    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
    arm64: topology: Fix false warning in counters_read_on_cpu() for same-CPU reads
    cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs
    cpufreq: CPPC: Factor out cppc_fie_kworker_init()
    ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu()
    cpufreq: CPPC: Don't warn if FIE init fails to read counters
    Revert "cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus"
    PM / devfreq: use _visible attribute to replace create/remove_sysfs_files()
    cpufreq: Replace magic number
    cpufreq: Update sscanf() to kstrtouint()
    update to sysfs_emit() for safer buffer handling
    urma: fix resource leaks in uburma and ubcore error paths
    ub:ubfi: fix the resource maintenance issue in the ubfi ummu node parsing
    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
    Bluetooth: SMP: force responder MITM requirements before building the pairing response
    mm: fix some minor per-VMA lock issues in userfaultfd
    userfaultfd: use per-vma locks in userfaultfd operations
    mm: add vma_assert_locked() for !CONFIG_PER_VMA_LOCK
    userfaultfd: protect mmap_changing with rw_sem in userfaulfd_ctx
    userfaultfd: fix operator precedence bug in UFFDIO_COPY mode check
    ub/ubmem-vmmu: optimize prints
    ub/ubmempfd: update note and optimize format
    ub/ubdevshm: Fix spelling errors and optimize prints
    urma: Introduce EID patricia trie for primary EID lookup
    urma: move capability of querying physical devices from ubcore to ubagg
    ub:ubus: add error return when send config message
    iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
    tools/dma: Add dma_map_sg support
    dma-mapping: benchmark: add support for dma_map_sg
    dma-mapping: benchmark: modify the framework to adapt to more map modes
    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
    net/oenetcls: validate module params and reject zero table sizes
    net/oenetcls: make rps policy module params read-only
    net/oenetcls: fix async delete race with pending rule add
    net/oenetcls: move listen-time tuple resolution to worker context
    !23145 sync CVE LTS and bugfix from OLK-6.6 from 14ed6c3948b1 to b39d11626963
    sched: idle: Make skipping governor callbacks more consistent
    cpuidle: Skip governor when only one idle state is available
    vxlan: validate ND option lengths in vxlan_na_create
    net: use skb_header_pointer() for TCPv4 GSO frag_off check
    ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
    USB: serial: option: add Telit FN920C04 RNDIS compositions
    f2fs: fix to avoid mapping wrong physical block for swapfile
    f2fs: fix zoned block device information initialization
    f2fs: fix to avoid UAF in f2fs_write_end_io()
    f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
    f2fs: fix out-of-bounds access in sysfs attribute read/write
    f2fs: fix to add gc count stat in f2fs_gc_range
    fbdev: smscufx: properly copy ioctl memory to kernelspace
    fbdev: rivafb: fix divide error in nv3_arb()
    Revert "wireguard: device: enable threaded NAPI"
    gpiolib: acpi: Fix gpio count with string references
    ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
    ASoC: cs42l43: Correct handling of 3-pole jack load detection
    platform/x86: panasonic-laptop: Fix sysfs group leak in error path
    platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
    ASoC: amd: yc: Add quirk for HP 200 G2a 16
    ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
    drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used
    romfs: check sb_set_blocksize() return value
    ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel
    ALSA: hda/realtek: Add quirk for Inspur S14-G1
    gpio: sprd: Change sprd_gpio lock to raw_spin_lock
    ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
    ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
    PCI: endpoint: Avoid creating sub-groups asynchronously
    PCI: endpoint: Remove unused field in struct pci_epf_group
    Revert "driver core: enforce device_lock for driver_match_device()"
    driver core: enforce device_lock for driver_match_device()


author: ChenYanpan <chenyanpan@xfusion.com> - 6.6.0-145.3.14.145.u58
changelog:
  - Type:bugfix
  - CVE:
  - DESC:unify TC_SCHED clock source to rq_clock_task, fix series-3rd-xfusion.conf


author: mapengyuan <mapengyuan@xfusion.com> - 6.6.0-145.3.14.145.u59
changelog:
  - Type:CVE
  - CVE:CVE-2026-43026,CVE-2026-43035,CVE-2026-43068,CVE-2026-43107,CVE-2026-43140,CVE-2026-43167,CVE-2026-43171,CVE-2026-43216,CVE-2026-43238,CVE-2026-43277,CVE-2026-43315,CVE-2026-43319,CVE-2026-43432,CVE-2026-43439,CVE-2026-31414,CVE-2025-21786
  - DESC:fix CVE-2026-43026,CVE-2026-43035,CVE-2026-43068,CVE-2026-43107,CVE-2026-43140,CVE-2026-43167,CVE-2026-43171,CVE-2026-43216,CVE-2026-43238,CVE-2026-43277,CVE-2026-43315,CVE-2026-43319,CVE-2026-43432,CVE-2026-43439,CVE-2026-31414,CVE-2025-21786


author: ChenYanpan <chenyanpan@xfusion.com> - 5.113.0-2
changelog:
  - use 
    /usr/bin/cmake --build "aarch64-FusionOS-linux-gnu" -j10 --verbose and 
    DESTDIR="/home/abuild/rpmbuild/BUILDROOT/kf5-plasma-5.113.0-2.fos26.aarch64" /usr/bin/cmake --install "aarch64-FusionOS-linux-gnu" to fix build failure


author: ChenYanpan <chenyanpan@xfusion.com> - 5.113.0-2
changelog:
  - use 
    /usr/bin/cmake --build "aarch64-FusionOS-linux-gnu" -j10 --verbose and 
    DESTDIR="/home/abuild/rpmbuild/BUILDROOT/kf5-sonnet-5.113.0-2.fos26.aarch64" /usr/bin/cmake --install "aarch64-FusionOS-linux-gnu" to fix build failure


author: ChenYanpan <chenyanpan@xfusion.com> - 5.113.0-2
changelog:
  - use 
    /usr/bin/cmake --build "aarch64-FusionOS-linux-gnu" -j10 --verbose and 
    /usr/bin/cmake --build "aarch64-FusionOS-linux-gnu" -j10 --verbose


author: Liu Chao <liuchao173@huawei.com> - 30-7
changelog:
  - disable make test because cannot find /lib/modules/`uname -r`/build
  - add extramodules to depmod search path


author: jinsaihang <jinsaihang@h-partners.com> - 1:0.9.9-13
changelog:
  - Type:bugfix
  - CVE:NA  
  - SUG:NA  
  - DESC:check whether the directory is a user source code directory


author: fuanan <fuanan3@h-partners.com> - 1:0.9.9-19
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patch
         backport-lookup-fix-local-bind-check.patch


author: wangsihong <wangsihong@xfusion.com> - 1:0.9.9-19.u1
changelog:
  - Type:requirement
  - CVE:
  - DESC:use the project-defined macros to configure the vendor information for FusionOS


author: fandehui<fandehui@xfusion.com> - 1.0.0-u3
changelog:
  - Type:requirement 
  - CVE:
  - DESC:Update script and module comments; refine error handling and timeout parameters; add process and interrupt context actions.
      Update copyright notice and author information in shell scripts;
      Refine error handling in send_code function of kpgen_adm.sh;
      Adjust timeout parameters parsing in kpgen_ld_kpgenm.sh;
      Enhance unloading checks in kpgen_unld_kpgenm.sh;
      Add process context actions for various error conditions in kpgenm.c;
      Improve interrupt context actions and timer handling in kpgenm.c.


author: fandehui<fandehui@xfusion.com> - 1.0.0-u4
changelog:
  - Type:requirement 
  - CVE:
  - DESC:Update alignment check faults messages; enhance parallel processing and emergency restart functionalities.
      Update alignment check fault messages in process and interrupt contexts;
      Correct general protection fault context message in kpgenm.c;
      Implement parallel oom and panic functionality in handle_fusionos_para_panic_oom and handle_fusionos_para_oom;
      Add emergency restart and kernel restart parallel processing in gen_parallel_restart;
      Remove unused and commented-out code for clarity and maintainability.


author: fandehui<fandehui@xfusion.com> - 1.0.0-u5
changelog:
  - Type:requirement 
  - CVE:
  - DESC:Update script logic and enhance module loading checks; improve print function to use pr_info.


author: guowenjia <guowenjia@xfusion.com> - 1.21.2-19.u1
changelog:
  - Type:bugfix
  - CVE:
  - DESC:backport patches to fix bugs
         Fix crash on empty TXT records
         Fix potential PAC processing crash
         In PKINIT, check for null PKCS7 enveloped fields
         Simplify preauth fallback disabling


author: lingsheng <lingsheng1@h-partners.com> - 3.7.1-7
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5915,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5915 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: mapengyuan <mapengyuan@xfusion.com> - 3.7.1-11.u3
changelog:
  - Type:CVE
  - CVE:CVE-2026-4424,CVE-2026-4426,CVE-2026-5121
  - DESC:Fix CVE-2026-4424,CVE-2026-4426,CVE-2026-5121


author: cenhuilin <cenhuilin@kylinos.cn> - 2.39.1-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:lsblk: fix memory leak [coverity scan]
         lsblk: fix possible use-after-free


author: yixiangzhike <yixiangzhike007@163.com> - 2.39.1-31
changelog:
  - backport community patches
      fix columns reduction
      fix memory leak issue in read_Subid_range
      fix off-by-one in maximum last sector calculation
      fix memory corruption in size calculation
      fix memory corruption in read buffers


author: mapengyuan <mapengyuan@xfusion.com> - 2.39.1-31.u1
changelog:
  - Type:requirement
  - CVE:
  - DESC:add check to resolve uname26-version test failed
         add IAC support
         limit su command when trirole is enabled


author: mapengyuan <mapengyuan@xfusion.com> - 2.39.1-34.u4
changelog:
  - Type:bugfix
  - CVE:
  - DESC:backport community patches
         hardlink: fix fiemap use
         hwclock: free temporary variable before return
         lib/pty-session: Don't ignore SIGHUP.
         lsns: fix netns use
         wdctl: properyl test timeout conditions


author: wangzhiqiang <swangzhiqiang95@huawei.com> - 3.0.4-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Add BDPluginSpec constructor and use it in plugin_specs_from_names


author: tianmuyang <tianmuyang@huawei.com> 2:1.2.2-11
changelog:
  - Adaption for sched type eBPF program:
    backport-libbpf-Adaption-for-sched-type-eBPF-program.patch


author: chenyanpanHW <chenyanpan@huawei.com> - 2.1.0-3
changelog:
  - DESC: delete -S git from 
  %setup       -q



  /usr/lib/rpm/rpmuncompress /home/abuild/rpmbuild/SOURCES/backport-correct-realpath-test-failure.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


  /usr/lib/rpm/rpmuncompress /home/abuild/rpmbuild/SOURCES/0001-fix-Werror-format-security.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f

  , and delete BuildRequires git


author: chenhaixing <chenhaixing@huawei.com> - 0.70.2-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libdnf:Avoid reinstalling installonly packages marked for ERASE
                Fix utimes error message in dnf-repo
                Do not download repository if our local cache is up to date in dnf-repo
                python bindings:Load all modules with RTLD_GLOBAL


author: yuanchao <1050706328@qq.com> - 2.1.12-13
changelog:
  - Fix function undeclared,incompatible pointer and parameter lack in 'add-testcases-for-event.c-apis.patch',support clang build


author: andy <liuyang01@kylinos.cn> - 2.1.12-14
changelog:
  - Fix leak in evbuffer_add_file() on empty files
  - evthread: fix NULL dereference in evthread_setup_global_lock_()
  - Fix potential null dereference in http-server


author: shixuantong <shixuantong1@h-partners.com> - 2.1.12-15
changelog:
  - fix: arc4_getword integer overflow, detected by -fsanitize=undefined
  - Fix divide-by-zero in ev_token_bucket_get_tick_
  - fixed missing check for null after strdup in evutil_inet_pton_scope
  - Fix integer-overflow in ev_token_bucket_cfg_new
  - Fix integer overflow in HTTP version
  - Fix potential Null pointer dereference in bufferevent_openssl.c
  - Fix potential Null pointer dereference in dns-example.c
  - Fix potential Null pointer dereference in event-read-fifo.c
  - Fix unlikely (for libevent) UB in HT_GROW()


author: yanglongkang <yanglongkang@h-partners.com> - 3.4.4-5
changelog:
  - Fix x86/ffi64 calls with 6 gp and some sse registers
    Robustify floating point comparison in test
    Fix floating point compare


author: weijin deng <weijin.deng@turbolinux.com.cn> - 0.18.1-1
changelog:
  - Upgrade to 0.18.1
  - Update Version, Release, Source0, stage 'files'
  - Stage 'build' use meson build


author: Wenhua Huang <huangwenhua@kylinos.cn> - 0.14.2-2
changelog:
  - Rebuild for gimp-3.0.2
    exiv2 fix cve and abi change(https://gitee.com/src-openeuler/exiv2/pulls/95)


author: mapengyuan <mapengyuan@xfusion.com> - 2.5.31-3.u1
changelog:
  - Type:CVE
  - CVE:CVE-2026-40334,CVE-2026-40338,CVE-2026-40339,CVE-2026-40340,CVE-2026-40341,CVE-2026-40335
  - DESC:Fix CVE-2026-40334,CVE-2026-40338,CVE-2026-40339,CVE-2026-40340,CVE-2026-40341,CVE-2026-40335


author: maxin <maxin@xfusion.com> - 2.5.34-1.u1
changelog:
  - Type:CVE
  - CVE:CVE-2026-40333,CVE-2026-40336
  - DESC:update to 2.5.34 for fix CVE-2026-40333,CVE-2026-40336


author: Donghua Huang <huangdonghua3@h-partners.com> - 50.0-32
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libhns: Increase input parameter checks and adjust inline data size.


author: Donghua Huang <huangdonghua3@h-partners.com> - 50.0-36
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libhns: Fix wrong WQE data in new post send API when QP wraps around


author: yanglu <yanglu72@h-partners.com> - 3.0.17-2
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:avoid crashing in icalcomponent_normalize
         fix a memleak in icalcomponent_normalize


author: changhan <changhan@xfusion.com> - 2.9.4-19.u1
changelog:
  - Type:CVE
  - CVE:CVE-2026-6245
  - DESC:backport patches to fix bugs
         fix CVE-2026-6245 and PAM/PASSKEY avoid unnecessary memcpy
         oidc_child: fix wrong usage of printf format (a2bd434)
         ad: use right memory context in GPO code (723a30b)
         Responder: fix passkey auth when user-verification is off (4c6c010)
         KRB5: fix mem leak in authenticate_stored_users (8b452b3)
         KCM: fix use-after-free in kcm_read_options (50ae35f)
         NSS: Fix wrong condition invalidating an optimization (6d71291)


author: yixiangzhike <yixiangzhike007@163.com> - 1.4.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:refix the failure of building with cppcheck>=2.11 by using upstream patch


author: yixiangzhike <yixiangzhike007@163.com> - 1.6.4-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patch to fix possible uninitialized variable


author: Hu Bin <hubin73@huawei.com> - 0.1.3-10
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:add libmetalink testcases for api and error handling, fix automake error


author: Hu Bin <hubin73@huawei.com> - 0.1.3-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport patches to fix NULL pointer dereference and memory leak bug


author: changhan <changhan@xfusion.com> - 25.0.3-48.u1
changelog:
  - Type:CVE
  - CVE:CVE-2025-54410,CVE-2026-33997,CVE-2026-34040
  - DESC:backport to fix CVE-2025-54410
         libcontainerd: change the digest used when restoring
         update 25.0.3-34 to libcontainerd fix
         backport builder/dockerfile: ADD with best-effort xattrs
         man/docker-build.1: typo in parameter variable: CID => IID
         Restore INC iptables rules on firewalld reload
         fix TestPassthrough 
         fix issue where node promotion could fail
         libnetwork/drivers/overlay: fix naked returns, output variables
         libnetwork: fix flaky Swarm service DNS
         volume/local: use t.TempDir
         libnetwork/drivers/bridge: fix non-constant format string in call (govet)
         volume/service: rename interface that collided with vars
         plugin: fix naked returns, output vars
         fix CVE-2026-33997,CVE-2026-34040


author: chengyechun <chengyechun1@huawei.com> - 3.7.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:prevent segfault in af_request_type
         fix bridge info parsing


author: Weifeng Su <suweifeng1@huawe.com> - 1.8-1
changelog:
  - Upgrade to version 1.8
    -Support added for Flexible Data Placement(TP4146)
    -Add support for Persistent Discovery Controllers
    -Replaced the libsystemd dependency with libdbus
    -A parser for the NBFT table
    -Ignoring fabric connect attempts if the execution context doesn't match
    -support for TP8018
    -use sysfs only for topology scan
    -auto cleanup for resources
    -buf fixed and clean code


author: xinghe <xinghe2@h-partners.com> - 2:1.6.40-2
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


author: changhan <changhan@xfusion.com> - 2:1.6.40-12.u1
changelog:
  - Type:CVE
  - CVE:CVE-2026-22801,CVE-2026-22695,CVE-2025-28162,CVE-2025-28164,CVE-2026-25646,CVE-2026-33416,CVE-2026-33636,CVE-2026-34757,CVE-2026-3713,CVE-2026-40930
  - DESC:support build with apng feature but do not enable it by default
         fix CVE-2026-22801,CVE-2026-22695,CVE-2025-28162,CVE-2025-28164,CVE-2026-25646,CVE-2026-33416,CVE-2026-33636,CVE-2026-34757,CVE-2026-3713,CVE-2026-40930
         move libpng-1.6.40-apng.patch.gz to backport-libpng-1.6.40-apng.patch
         fix CVE-2026-40930 patch error


author: yixiangzhike <yixiangzhike007@163.com> - 1.4.5-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patch to remove redundant inclusion of libintl.h


author: yixiangzhike <yixiangzhike007@163.com> - 1.15.2-3
changelog:
  - backport patches from upstream
      Fix a memory leak of the glib slist
      Add missing end callback for already downloaded zchunk files
      Fix memory leak of repo and repomd
      Fix a crash when the gnupghomedir is NULL or not specified on Python API


author: yinsist <jianhui.oerv@isrc.iscas.ac.cn> - 0.20.5-2
changelog:
  - Valgrind does not support certain architectures like RISC-V, Before depending on Valgrind, first check if Valgrind supports the architecture


author: yuanchao <1050706328@qq.com> - 0.20.5-3
changelog:
  - fix `incompatible function pointer types passing`errors in test-vala-unstable.vala and test-vala-lang.vala


author: liaoshuai <liaoshuai@xfusion.com> - 4.19.3-9.u1
changelog:
  - Type:CVE
  - CVE:CVE-2026-3012,CVE-2026-3238,CVE-2026-4408,CVE-2026-4480
  - DESC:Fix CVE-2026-3012,CVE-2026-3238,CVE-2026-4408,CVE-2026-4480


author: changhan <changhan@xfusion.com> - 1.2.2-5.u2
changelog:
  - Type:CVE
  - CVE:CVE-2026-37555
  - DESC:fix CVE-2026-37555 (ima_adpcm: fix int overflow when calculating sf.frames)


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-7
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-10
changelog:
  - Type:cves
  - ID:CVE-2025-4476 CVE-2025-4948 CVE-2025-4969
  - SUG:NA
  - DESC:fix CVE-2025-4476 CVE-2025-4948 CVE-2025-4969


author: wangsihong <wangsihong@xfusion.com> - 2.74.3-16.u3
changelog:
  - Type:CVE
  - CVE:CVE-2026-0716,CVE-2026-1467,CVE-2026-1539,CVE-2026-1761,CVE-2026-2443,CVE-2026-5119,CVE-2026-1760,CVE-2026-1801,CVE-2026-2369
  - DESC:Fix CVE-2026-0716,CVE-2026-1467,CVE-2026-1539,CVE-2026-1761,CVE-2026-2443,CVE-2026-5119,CVE-2026-1760,CVE-2026-1801,CVE-2026-2369
         backport upstream to add CVE-2026-1760's after patch


author: changhan <changhan@xfusion.com> - 3.4.5-17.u2
changelog:
  - Type:CVE
  - CVE:CVE-2025-12105,CVE-2025-14523,CVE-2025-32914,CVE-2025-46420,CVE-2025-4945,CVE-2025-4948,CVE-2025-4969,CVE-2026-0716,CVE-2026-1467,CVE-2026-1536,CVE-2026-1539,CVE-2026-1760,CVE-2026-2369,CVE-2026-2436,CVE-2026-2708,CVE-2026-5119
  - DESC:fix CVE-2025-12105,CVE-2025-14523,CVE-2025-32914,CVE-2025-46420,CVE-2025-4945,CVE-2025-4948,CVE-2025-4969,CVE-2026-0716,CVE-2026-1467,CVE-2026-1536,CVE-2026-1539,CVE-2026-1760,CVE-2026-2369,CVE-2026-2436,CVE-2026-2708,CVE-2026-5119


author: changhan <changhan@xfusion.com> - 3.4.5-20.u4
changelog:
  - Type:CVE
  - CVE:CVE-2026-0719,CVE-2026-1761,CVE-2026-1801,CVE-2026-2443,CVE-2025-32908,CVE-2026-4271
  - DESC:Fix CVE-2026-0719,CVE-2026-1761,CVE-2026-1801,CVE-2026-2443,CVE-2025-32908,CVE-2026-4271


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-5
changelog:
  - Type:CVE
  - Id:CVE-2025-4877 CVE-2025-4878 CVE-2025-5351 CVE-2025-5987 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877CVE-2025-4878CVE-2025-5351CVE-2025-5987CVE-2025-5372


author: liaoshuai <liaoshuai@xfusion.com> - 0.10.5-10.u1
changelog:
  - Type:CVE
  - CVE:CVE-2026-0968,CVE-2026-0967,CVE-2026-0966,CVE-2026-0965,CVE-2026-0964,CVE-2025-14821,CVE-2026-3731
  - DESC:fix CVE-2026-0968,CVE-2026-0967,CVE-2026-0966,CVE-2026-0965,CVE-2026-0964,CVE-2025-14821,CVE-2026-3731


author: liaoshuai <liaoshuai@xfusion.com> - 1.11.0-5.u1
changelog:
  - Type:bugfix
  - CVE:
  - DESC:backport some patches from upstream
         Add input bounds checking to SFTP API (#1679)
         Fix small leak in base64_encode() with empty data #1627
         Handle malformed comments in known_hosts parsing #1628
         Improve known_hosts parsing and harden
         kex: fix DH-GEX-sha256 bignum initialization
         mbedtls: fix using garbage value (reported by clang-tidy)
         packet: authagent_open: fix failure packet length (#1701)
         scp: fix NULL dereference in path arg of send/recv (#1625)


author: huayadong <huayadong@kylinos.cn> - 3.1.2-33
changelog:
  - Type:bugfix
  - ID  :NA
  - SUG :NA
  - DESC:Patch203:fix-the-display-resolution-does-not-match-the-actual-resolution.patch


author: ZixinLi <lizixin10@h-partners.com> - 9.10.0-23
changelog:
  - Fix CVE-2025-12748 CVE-2025-13193
  - conf: Add virDomainDefIDsParseString
  - bhyve: Check ACLs before parsing the whole domain XML
  - libxl: Check ACLs before parsing the whole domain XML
  - lxc: Check ACLs before parsing the whole domain XML
  - vz: Check ACLs before parsing the whole domain XML
  - ch: Check ACLs before parsing the whole domain XML
  - qemu: Check ACLs before parsing the whole domain XML
  - qemu: snapshot: Set umask for 'qemu-img' when creating external inactive snapshots


author: mapengyuan <mapengyuan@xfusion.com> - 2.11.9-13.u1
changelog:
  - Type:CVE
  - CVE:CVE-2025-8732,CVE-2026-0990,CVE-2026-0992,CVE-2026-0989,CVE-2026-1757
  - DESC:fix CVE-2025-8732,CVE-2026-0990,CVE-2026-0992,CVE-2026-0989,CVE-2026-1757 and backport upstream patches


author: ChenYanpan <chenyanpan@xfusion.com> - 1.1.0-2
changelog:
  - Type:bugfix
  - CVE:
  - DESC:fix TimeoutExpired import error, KeyboardInterrupt handling and help message typos


author: liuchao <liuchao173@huawei.com> - 2.13.7-1
changelog:
  - Update to 2.13.7:
    - fix: invoke MKDIR_P before changing directories
    - fix: -Wsingle-bit-bitfield-constant-conversion with clang16
    - fix: clean java inner class files in examples
    - Introduce sync vs unsync enablers
    - Fix: misaligned urcu reader accesses
    - ustfork: Fix warning about volatile qualifier
    - ustfork: Fix possible race conditions
    - Fix: tracepoint: Remove trailing \ at the end of macro
    - fix: python agent: use stdlib distutils when setuptools is installed
    - fix: python agent: install on Debian python >= 3.10
    - fix: python agent: Add a dependency on generated files
    - python: use setuptools with python >= 3.12


author: Liu Qingtao <liu.qingtao2@zte.com.cn> - 1.9.4-3
changelog:
  - Add patch riscv_zicclsm_lz4_force_mem_access_2.patch to configure LZ4_FORCE_MEMORY_ACCESS=2 for RISC-V with Zicclsm extension


author: yuanxing <yuanxing@kylinsec.com.cn> - 1.28.1-1
changelog:
  - initial build
  - KYOS-B: add kylin mask and part of translations
  - KYOS-B: set text preview content
  - KYOS-B: add a action in mate-terminal.desktop.in.in
  - KYOS-B: change default color and system color to Dracula Dark(#30872)
  - KYOS-B: select the default charset by locale


author: mashenxiao <mashenxiao@xfusion.com> - 1:1.1.0-u13
changelog:
  - Type:bugfix
  - CVE:
  - DESC:fix missing warning on large memory allocation failure in mguard subsystem


author: Funda Wang <fundawang@yeah.net> - 102.9.0-9
changelog:
  - set CC and CXX so that clang won't be selected automatically
  - fix compilation errors in sw_64 support


author: yanglu <yanglu72@h-partners.com> - 2:0.95-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Change UDP and ICMP sockets binding to accept a source IP from the -a CLI option


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: changhan <changhan@xfusion.com> - 8.0.46-1
changelog:
  - Type:CVE
  - CVE:CVE-2026-21968,CVE-2026-21964,CVE-2026-21948,CVE-2026-21941,CVE-2026-21937,CVE-2026-21936,CVE-2026-35240,CVE-2026-35239,CVE-2026-35238,CVE-2026-35237,CVE-2026-35236,CVE-2026-34308,CVE-2026-34304,CVE-2026-34303,CVE-2026-34293,CVE-2026-34278,CVE-2026-34276,CVE-2026-34271,CVE-2026-34270,CVE-2026-34267,CVE-2026-22017,CVE-2026-22015,CVE-2026-22009,CVE-2026-22005,CVE-2026-22004,CVE-2026-22002,CVE-2026-22001,CVE-2026-21998,CVE-2026-34317,CVE-2026-34319,CVE-2026-34318
  - DESC:Update to 8.0.46 for fix CVEs
         fix install mariadb-config error on mysql-config installed


author: yaoxin <yao_xin001@hoperun.com> - 8.0-1
changelog:
  - Update to 8.0
    * CVE-2024-5742: Avoid privilege escalations via symlink attacks
      on emergency save file (boo#1226099)
    * By default ^F is bound to starting a forward search, and ^B to
      starting a backward search, while M-F and M-B repeat the search
      in the corresponding direction. (See the documentation if you
      want the old bindings back.)
    * Command-line option --modernbindings (-/) makes ^Q quit, ^X cut,
      ^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a file,
      ^R replace, ^G find again, ^D find again backwards, ^A set the mark,
      ^T jump to a line, ^P show the position, and ^E execute.
    * For easier access, M-" is bound to placing/removing an anchor,
      and M-' to jumping to the next anchor.


author: changhan <changhan@xfusion.com> - 8.7.1-2.u1
changelog:
  - Type:CVE
  - CVE:CVE-2026-6842,CVE-2026-6843
  - DESC:update to 8.7.1 and fix CVE-2026-6842,CVE-2026-6843


author: baoyonglei<baoyonglei@xfusion.com> - 1.1-1.u1
changelog:
  - Type:requirement
  - CVE:
  - DESC:Change the baseline values of sysctl configurations in 6.6 kernel version.


author: mapengyuan <mapengyuan@xfusion.com> - 1.0.0-u12
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Fix Python programming standardization issues and optimization problems.


author: lingsheng <lingsheng1@h-partners.com> - 1:1.0.8-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: liweigang <liweiganga@uniontech.com> - 1:1.0.8-4
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: evaluate: guard against NULL basetype
  evaluate: error out if basetypes are different
  evaluate: reject attempt to update a set
  evaluate: release mpz type in expr_evaluate_list() error path
  expression: missing line in describe command with invalid expression
  evaluate: handle invalid mapping expressions in stateful object statements gracefully


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: disable meta set with ranges
         src: reject large raw payload and concat expressions
         evaluate: fix stack overflow with huge priority string
         tcpopt: don't create exthdr expression without datatype
         src: do not allow to chain more than 16 binops
         rule: fix ASAN errors in chain priority to textual names
         tests: shell: add regression test for double-free crash bug
         evaluate: handle invalid mapping expressions in stateful object
         evaluate: Fix incorrect checking the `base` variable in case of IPV6


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:ct expectation: fix 'list object x' vs. 'list objects in table' confusion
         tests: shell: connect chains to hook point


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         parser_json: release buffer returned by json_dumps
         parser_json: fix crash in json_parse_set_stmt_list
         parser_json: fix handle memleak from error path
         parser_json: fix several expression memleaks from error path
         libnftables: Zero ctx->vars after freeing it


author: eaglegai <eaglegai@163.com> - 1:1.0.8-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: don't allow nat map with specified protocol
         rule: return error if table does not exist
         json: make sure timeout list is initialised
         evaluate: don't update cache for anonymous chains
         json: return error if table does not exist
         json: don't BUG when asked to list synproxies
         evaluate: compact STMT_F_STATEFUL checks
         evaluate: only allow stateful statements in set and map definitions
         optimize: expand expression list when merging into concatenation
         netlink: fix stack overflow due to erroneous rounding
         netlink: bogus concatenated set ranges with netlink message overrun
         netlink: fix crash when ops doesn't support udata
         netlink: Catch unknown types when deserializing objects
         netlink: Avoid potential NULL-ptr deref parsing set elem expressions
         netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY
         evaluate: don't BUG on unexpected base datatype
         src: BASECHAIN flag no longer implies presence of priority expression
         parser_bison: only reset by name is supported by now


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         segtree: fix string data initialisation
         src: netlink: netlink_delinearize_table() may return NULL
         src: ensure chain policy evaluation when specified
         src: fix memory leak in anon chain error handling
         mnl: silence compiler warning
         datatype: Increase symbolic constant printer robustness
         evaluate: follow prefix expression recursively if needed


author: andy <liuyang01@kylinos.cn> - 2.0.16-12
changelog:
  - backport patches from upstream
  - libnuma: Make numa_available respect EPERM
  - libnuma: fix nodemask allocation size for get_mempolicy


author: yanglongkang <yanglongkang@h-partners.com> - 0.34.7-4
changelog:
  - Replace SELinux deprecated functions
  - Replace deprecated libxml2 calls
  - Fix implicit cast from const to non const


author: wulinfeng <wulinfeng@xfusion.com> - 2022.10.1-7
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Modify rpmsg buffer size to 2048 to optimize the communication latency between uniproton and mcs


author: wulinfeng <wulinfeng@xfusion.com> - 2024.10.0-2
changelog:
  - Type:bugfix
  - CVE:
  - DESC: Modify MAX_FUNC_ID_LEN to unsigned long int to solve the RPC service coredump problem


author: Funda Wang <fundawang@yeah.net> - 0.23.0-7
changelog:
  - fix CVE-2024-8443, CVE-2024-45615, CVE-2024-45616,
    CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, CVE-2024-45620


author: mapengyuan <mapengyuan@xfusion.com> - 0.23.0-9.u1
changelog:
  - Type:CVE
  - CVE:CVE-2025-49010,CVE-2025-66037,CVE-2025-66215
  - DESC:Fix CVE-2025-49010,CVE-2025-66037,CVE-2025-66215


author: mapengyuan <mapengyuan@xfusion.com> - 9.6p1-10.u1
changelog:
  - Type:requirement
  - CVE:
  - DESC:replace the openEuler with FusionOS in sshd_config and add IAC support


author: changhan <changhan@xfusion.com> - 9.6p1-11.u7
changelog:
  - Type:CVE
  - CVE:CVE-2026-3497,CVE-2026-35414,CVE-2026-35385,CVE-2026-35386,CVE-2026-35387,CVE-2026-35388
  - DESC: backport upstream patch
  fix CVE-2026-3497
  fix CVE-2026-3497,CVE-2026-35414,CVE-2026-35385,CVE-2026-35386,CVE-2026-35387,CVE-2026-35388


author: wangyong <wangyong2@xfusion.com> - 1:3.0.12-47.u1
changelog:
  - Type:CVE
  - CVE:CVE-2025-15467,CVE-2025-69418,CVE-2025-69419,CVE-2025-69420,CVE-2025-69421,CVE-2026-22795,CVE-2026-22796,CVE-2025-68160,CVE-2023-5678,CVE-2026-28388,CVE-2026-28387,CVE-2026-28389,CVE-2026-28390,CVE-2026-31789,CVE-2026-31790
  - DESC:fix CVE-2025-15467,CVE-2025-69418,CVE-2025-69419,CVE-2025-69420,CVE-2025-69421,CVE-2026-22795,CVE-2026-22796,CVE-2025-68160,CVE-2023-5678,CVE-2026-28388,CVE-2026-28387,CVE-2026-28389,CVE-2026-28390,CVE-2026-31789,CVE-2026-31790
         Backport fix check_set_resp_len method to return 0 on error occurred
         Backport Fix a possible memory leak in load_builtin_compressions
         Backport When changing IV length invalidate previously set IV
         Backport Return error if key is not set
         Backport zero data in hm_fragment on alloc
         Backport Move freeing of an old enc_write_ctx/write_hash to dtls1_clear_sent_buffer
         Backport Fix build with icx and nvc compilers
         Backport Use proper KDF SS parameter name


author: wangyong2 <wangyong2@xfusion.com> - 1:3.0.12-51.u2
changelog:
  - Type:CVE
  - CVE:CVE-2026-45445,CVE-2026-45446
  - DESC:Fix CVE-2026-45445,CVE-2026-45446
         Fix CFB/OFB s390x partial block encryption
         Fix possible memory leak in req_main


author: wangyong2 <wangyong2@xfusion.com> - 1:3.0.12-52.u3
changelog:
  - Type:CVE
  - CVE:CVE-2026-34180,CVE-2026-34182,CVE-2026-42766,CVE-2026-42767,CVE-2026-42770,CVE-2026-45447,CVE-2026-7383,CVE-2026-907,CVE-2026-9076
  - DESC:Fix CVE-2026-34180,CVE-2026-34182,CVE-2026-42766,CVE-2026-42767,CVE-2026-42770,CVE-2026-45447,CVE-2026-7383,CVE-2026-907,CVE-2026-9076


author: baiguo <baiguo@kylinos.cn> - 0.4.34-2
changelog:
  - Use vasprintf() if available for error messages and otherwise vsnprintf();orccompiler, orcparse: Use secure UCRT printing functions on Windows


author: wangweichao <wangweichao@xfusion.com> - 1.0.0-1.u17
changelog:
  - Type:requirement
  - CVE:
  - DESC: Add integration tests for audit, sandbox, rollback, session, approval, compact, core, cli, providers, e2e


author: wangweichao <wangweichao@xfusion.com> - 1.0.0-1.u20
changelog:
  - Type:bugfix
  - CVE:
  - DESC: Improve Ctrl+C priority during model requests, tool execution, and sudo passthrough


author: wangweichao <wangweichao@xfusion.com> - 1.0.0-1.u21
changelog:
  - Type:bugfix
  - CVE:
  - DESC: Retry initial stream body interruptions and redact or reject password-bearing commands


author: wulinfeng <wulinfeng@xfusion.com> - 1.0.0-1.u22
changelog:
  - Type:bugfix
  - CVE:
  - DESC: command executions and other operations in audit logs; file permissions of user directories are minimized


author: wulinfeng <wulinfeng@xfusion.com> - 1.0.0-1.u25
changelog:
  - Type:bugfix
  - CVE:
  - DESC: There are multiple usability issues; No result records are kept for operations such as tool calls and command execution in audit logs


author: wangweichao <wangweichao@xfusion.com> - 1.0.0-1.u26
changelog:
  - Type:bugfix
  - CVE:
  - DESC: Fix race condition on process exit to prevent losing remaining stdout/stderr lines


author: wangyong <wangyong2@xfusion.com> - 3.8.0-3
changelog:
  - Type:requirement
  - CVE:
  - DESC:update the groupdel and promisc mode rules based on the current system log.


author: liweigang <liweiganga@uniontech.com> - 3.6-2
changelog:
  - remove patch support gpt_sync_mbr
  - file: huawei-bugfix-add-support-of-gpt_sync_mbr.patch
  - file: add support for gpt_sync_mbr and fix failure of it.


author: mapengyuan <mapengyuan@xfusion.com> - 0.80-11.u1
changelog:
  - Type:requirement
  - CVE:
  - DESC:do not allow root to modify privileged user passwords
          when trirole is enabled.


author: hugel <gengqihu2@h-partners.com> - 10.42-12
changelog:
  - DESC:sync patches from upstream
         backport-Further-ASCII-tests-and-minor-bugfix-plus-ChangeLog-.patch
         backport-avoid-inconsistency-between-d-and-digit-when-using-a.patch
         backport-Fix-the-lookahead-after-d-or-posix-to-skip-whitespac.patch
         backport-Improve-error-offsets-for-character-classes-548.patch
         backport-Non-recursive-scan-prefix-in-JIT-560.patch


author: tangyuchen <tangyuchen5@huawei.com> - 2.0.0-1
changelog:
  - update to 2.0.0
    - Adjust USB drivers path at run-time via environment variable PCSCLITE_HP_DROPDIR
    - Add '--disable-polkit' option
    - Reset eventCounter when a reader is removed
    - Add "polkit" in "pcscd -v" output if enabled
    - Doxygen: document SCARD_E_INVALID_VALUE for some functions
    - use secure_getenv(3) if available
    - Some other minor improvements


author: dongyuzhen <dongyuzhen@h-partners.com> - 2:3.51-1
changelog:
  - upgrade vertion to 3.51:
    - fix OVERLOAD and FALLBACK handling
    - fix ExtUtils::ParseXS compatibility with perl < 5.8.8
    - add support for elifdef and elifndef
    - allow symbolic alias of default function
    - better support for duplicate ALIASes
    - make versions in ExtUtils-ParseXS consistent


author: dongyuzhen <dongyuzhen@h-partners.com> - 1:2.57-1
changelog:
  - upgrade version to 2.57:
    - fix long standing bug that duplicate options were not detected when the options differ in case while ignore_case is in effect
    - allow periods in option names
    - move Getopt::Long::Parser to a separate module and add documentation
    - do not use Getopt::Long to establish Getopt::Long::Parser version
    - adapt tests for perl core


author: dongyuzhen <dongyuzhen@h-partners.com> - 0.42-1
changelog:
  - upgrade version to 0.42:
    - updated for Perl v5.14 - use `package NAME VERSION` syntax
    - fix typo 'behvior'
    - fix for DragonflyBSD and IPV6_V6ONLY from core perl


author: dongyuzhen <dongyuzhen@h-partners.com> - 2.084-1
changelog:
  - upgrade version to 2.084:
    - various fixes for edge cases
    - update documentation to reflect default SSL_version


author: Wenlong Zhang <zhangwenlong@loongson.cn> - 2.084-2
changelog:
  - Passing NO_NETWORK_TESTING=1 as an environment variable
    solves the interactive issue required for using rpmbuild locally


author: zhangyao <zhangyao108@huawei.com> - 1:20231213-1
changelog:
  - Upgrade version to 20231213
  - Update certificates
  - Stop installing mk-ca-bundle.pl script
  - Switched tests from Test to Test::More


author: woody2918 <wudi1@uniontech.com> - 1.94-1
changelog:
  - update version to 1.94
  - supports all stable releases of OpenSSL 3.1 and 3.2, and LibreSSL 3.5 - 3.8.
  - Enhancements to the API.


author: huyubiao <huyubiao@huawei.com> - 2:3.48-1
changelog:
  - update version to 3.48
    - Accept TAP version 14
    - Fix HARNESS_PERL_SWITCHES=-I handling in TAP::Harness::Env
    - Color the "ok"s as well.
    - Skip symlink tests on msys2
    - Use use absolute path for executable tests
    - Space-quote executable if has spaces
    - Avoid using Errno::EINTR directly for platforms without it
    - stop calling import on App::Prove plugins


author: zhangyao <zhangyao108@huawei.com> - 2:2.36-1
changelog:
  - DESC: Upgrade version to 2.36, test code modify, build optimization, avoid the use of magic numbers, deal compilation warning


author: gaihuiying <eaglegai@163.com> - 0.9.5-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add macros to control if need libdrm, pango, libpng and if need to exclude bootlog


author: zhangxingrong <zhangxingrong@uniontech.cn> - 1.19-4
changelog:
  - Fix poptCallbackType documentation
  - Fix multiple typos in comments
  - Fix potential double-free in test3.c


author: Funda Wang <fundawang@yeah.net> - 2.15-2
changelog:
  - fix build with latest gettext
  - harden systemd service file from openSUSE
  - add patch regarding risc-v arch support


author: yaoguangzhong<yaoguangzhong@xfusion.com> - 1.0-0.54
changelog:
  - Type:requirement
  - CVE:
  - DESC:modify the length of the text_buf array because the log display is incomplete


author: Zhu Jin <zhujin18@huawei.com> - 4.0.4-8
changelog:
  - library: address a potential race resulting in a fault and avoid strdup() calls in sd2proc() if possible


author: dongyuzhen <dongyuzhen@h-partners.com> - 25.1-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: Funda Wang <fundawang@yeah.net> - 25.1-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: fix build with wrong permission
  - DESC: fix conflicts with protobuf2
  - DESC: revert:distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: liuchao <liuchao173.huawei.com> - 1.5.0-1
changelog:
  - upgrade to 1.5.0:
    - Makefile.am: change link order
    - GitHub actions fail on Windows due to missing unzip command
    - Export and install CMake targets
    - Use CMAKE_CURRENT_BINARY_DIR instead of CMAKE_BINARY_DIR
    - remove deprecated functionality
    - Avoid "unused variable" compiler warning
    - Update autotools
    - Support for new Google protobuf 22.x, 23.x releases
    - Miscellaneous fixes
    - Remove protobuf 2.x support
    - Silence some compiler diagnostics
    - Fixing MSVC build for Msbuild and Makefile generators


author: mapengyuan <mapengyuan@xfusion.com> - 23.3.1-10.u1
changelog:
  - Type:CVE
  - CVE:CVE-2026-1703,CVE-2026-21441,CVE-2026-25645
  - DESC:fix CVE-2026-1703,CVE-2026-21441,CVE-2026-25645


author: lipengyu <lipengyu@kylinos.cn> - 3.11.6-20
changelog:
  - Type:CVE
  - CVE:CVE-2025-13836 CVE-2025-13837 CVE-2025-12084
  - SUG:NA
  - DESC:fix CVE-2025-13836 CVE-2025-13837 CVE-2025-12084


author: guowenjia <guowenjia@xfusion.com> - 3.11.6-27.u7
changelog:
  - Type:CVE
  - CVE:CVE-2025-13462,CVE-2026-3479,CVE-2026-3644,CVE-2026-4224
  - DESC:Fix CVE-2025-13462,CVE-2026-3479,CVE-2026-3644,CVE-2026-4224


author: changhan <changhan@xfusion.com> - 3.11.6-29.u8
changelog:
  - Type:CVE
  - CVE:CVE-2026-1502,CVE-2026-4786,CVE-2026-6100,CVE-2026-6019,CVE-2026-7210,CVE-2026-8328
  - DESC:Fix CVE-2026-1502,CVE-2026-4786,CVE-2026-6100,CVE-2026-6019,CVE-2026-7210,CVE-2026-8328


author: Weifeng Su <suweifeng1@huawei.com> - 5.0.8-1
changelog:
  - upgrade to 5.0.8
    -fix a regression error in 5.0.7
    -update testing to validate against python version 2.7 and 3.5-3.11
    -update broken links / no-existent services and references


author: xu_ping <707078654@qq.com> - 7.0.0-1
changelog:
  - Upgrade version to 7.0.0
  - Python 3.12 support and python 3.7 no longer supported
  - Add support bind mount propagation.


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 23.2-1
changelog:
  - Update package with version 23.2
    Add python 3.12 support.
    Add types for packaging.version._Version.
    Add platform tag support for LoongArch.
    Update pyupgrade to Python 3.7+
    Support enriched metadata.


author: kaijie Gu <jiekgu@foxmail.com> - 24.1-1
changelog:
  - Update package with version 24.1
    Add support for Python 3.13
    Fix typo in _parser docstring
    Modernise type annotations using FA rules from ruff
    Document markers.default_environment()


author: yixiangzhike <yixiangzhike007@163.com> - 3.1.1-1
changelog:
  - update version to 3.1.1
    - Fixed bug in NotAny where expr parse action was not being run
    - Fix regex matching for Python quoted strings
    - Make create_diagram() code compatible with latest version of railroad-diagrams
    - Support Python 3.12
    - Small perf optimization for `expr | ""` mapping to `Optional(expr)`
    - Redo QuotedString '\' escape handling as a state machine
    - Add ParseResults.deepcopy()
    - Remove ^ and $ tags from pp.common.url regex
    - Added DelimitedList class, for better handling of naming and diagramming
    - Deprecate ParserElement.validate()
    - Added new class method ParserElement.using_each
    - Fix bug in delimited_list
    - Added python_quoted_string; fixed exception messages for ParseElementEnhance subclasses
    - Enable packrat in verilogParse.py by default
    - Add embed argument to create_diagram
    - Add support for slice in expr[] notation
    - Fixed bug in srange
    - Added Lox language parser


author: fandehui <fandehui@xfusion.com> - 4.18.2-30.u4
changelog:
  - Type:bugfix
  - CVE:
  - DESC:switch from xsec_whitelist to xsec_baseline with posix_spawn and fsm hooks


author: fandehui <fandehui@xfusion.com> - 4.18.2-30.u6
changelog:
  - Type:bugfix
  - CVE:
  - DESC:skip baseline for innersafer packages, add single-user check,
    and recover whitelist.db on transaction failure


author: wangyong <wangyong2@xfusion.com> - 1.1.0-u4
changelog:
  - Type:bugfix
  - CVE:
  - DESC:'xsec_hub' has been updated to 'xsec-policy-core', configuration file path adapted to 'xsec-policy-core'.


author: guowentao <guowentao@xfusion.com> - 1.1.0-u9
changelog:
  - Type:requirement
  - CVE:
  - DESC: add hook restrict root access files owned by other user
          add hook restrict access to files under /var/log
          set ACL permissions for auditadm on /var/log
          use euid instead of uid for permission checks
          optimize hash table lookup using full_name_hash


author: liaoshuai <liaoshuai@xfusion.com> - 1.17.1-16.u2
changelog:
  - Type:CVE
  - CVE:CVE-2026-33278,CVE-2026-41292,CVE-2026-42944,CVE-2026-42959,CVE-2026-42960
  - DESC:Fix CVE-2026-33278,CVE-2026-41292,CVE-2026-42944,CVE-2026-42959,CVE-2026-42960


author: liaoshuai <liaoshuai@xfusion.com> - 1.17.1-17.u3
changelog:
  - Type:CVE
  - CVE:CVE-2026-32792,CVE-2026-40622,CVE-2026-42534,CVE-2026-42923,CVE-2026-44390,CVE-2026-44608
  - DESC:Fix CVE-2026-32792,CVE-2026-40622,CVE-2026-42534,CVE-2026-42923,CVE-2026-44390,CVE-2026-44608


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


author: liaoshuai <liaoshuai@xfusion.com> - 1.26.18-7.u1
changelog:
  - Type:CVE
  - CVE:CVE-2025-66471,CVE-2026-21441
  - DESC:fix CVE-2025-66471,CVE-2026-21441
         Prevent issue in HTTPResponse().read() when decoded_content is True and then False


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-54
changelog:
  - Add BuildRequires umdk-urma-devel ifarch aarch64
  - system: add support of hugepage use on demand
  - ub: support enable or disable ub feature
  - ub: add bus controller state for ub init
  - ub: realize base ub device framework
  - ub: add base ubbus framework
  - ub acpi: introduce acpi header
  - ub acpi: introduce ub mem header file
  - ub: add mem reserve help function
  - ub: support ubc device
  - ub: support ub acpi report
  - ub: adapter acpi change for last commit
  - ub config: introduce ub config base framework
  - ub: do more realize for ub device
  - ub port: setup ub port info
  - ub: init ub bus controller dev config space
  - ub: realize ub fm memory region ops
  - ub: support ubc msg process
  - ub: realize ub config space msg process
  - ub: support ub cna mgmt msg process
  - ub: support enum msg process
  - ub: support sec msg process
  - ub: realize more for ubbus and realize ub ers update
  - ub: extract common mmu translate
  - ub: add ummu base framework
  - ub: use ummu and init ummu registers
  - ub ummu: realize some ummu read/write process
  - ub: support mcmdq process
  - ub: ummu supprot create kvtbl and del kvtbl mcmdq process
  - ub: support mcmdq sync handler
  - migration: support ldst migration
  - migration/ham: a new approach to vm live migration: deterministic migration
  - migration/ham: add deterministic migration information transmission QM…
  - migration/ham: modify the shutdown criteria for deterministic migration
  - migration/ham: HAM migration memory cancellation dirty page synchronization
  - migration: CONFIG_HAM_MIGRATION is associated with the aarch64 architecture.
  - ub: add kvm irqchip usi route help function
  - ub: just default build on aarch64 machine
  - ub: ummu glb int enable
  - ub: ummu add ummu_ops for vfio-ub preprare
  - ub: ummu realize config tecte mcmdq process
  - ub: realize more mcmd process
  - ub: support ummu dma address translate
  - ub: add lock for bus instance
  - backends: Add support of one guest numa node alloc memory from multi host nodes
  - ub: add some common function for later vfo-ub realize
  - ub: add function for later alloc idev ers addr
  - ub: add bus instance verify for vfo-ub prepare
  - ub: prepare some function for later vfio-ub realize
  - ub: init usi operator function  
  - ub: add base vfio-ub device framework
  - ub: realize detail for vfio-ub device
  - ub: realize ubbus and udev reset callbalk
  - ub: add qapi query-ub for get ub info
  - ub: add bitmap_scnprintf help function for later hmp cmd
  - ub: and some hmp cmd for query ub info
  - ub: realize vfio ers exit
  - ub: code reinforcement
  - ub: fix ummu_dev_set_iommu_dev's return
  - ub: switch name fers to ers
  - ub: fix use gpa instead of hva to R/W msgq data problem
  - system: add return false when all_subpages_in_hugepage_freed has invalid parameters
  - Migration: support the basic framework of URMA migration
  - Migration: support send data through urma protocol during migration
  - Migration: support onecopy migration
  - Migration: support skip GPU pixman image I/O during URMA migration
  - Migration: support devices-parallel feature
  - Migration: support skip GPU pixman image I/O during HAM migration
  - backends: fix memory leak in the function host_memory_backend_memory_complete
  - Migration/urma: fix small bugs during socket parse
  - ub: fix build faild if target-arch not aarch64
  - system: hugepage use on demand only use in aarch64
  - ub: fix qtest bios-tables-test failed not build on aarch64 machine


author: maxin <maxin@xfusion.com> - 11:8.2.0-59.u2
changelog:
  - Type:bugfix
  - CVE:
  - DESC:QEMU update to version 8.2.0-59
         aio-posix: keep polling enabled with fdmon-io_uring.c
         block: Zero block driver state before reopening Block drivers
         qemu-img: Fix amend option parse error handling cherry-pick
         qemu-img rebase: don't exceed IO_BUF_SIZE in one operation
         target/arm: Correct STRD atomicity
         util/cacheflush: Make first DSB unconditional on aarch64
         vfio: Fix CSV3 mapping device mmio issue


author: maxin <maxin@xfusion.com> - 11:8.2.0-60.u3
changelog:
  - Type:bugfix
  - CVE:
  - DESC:QEMU update to version 8.2.0-60
         hid: fix incorrect return value for hid
         hw/rtc/goldfish: keep time offset when resetting
         net: parameterize the removing client from nc list
         qga: Fix channel initialization check in run_agent_once
         qga: Fix truncated output handling in guest-exec status
         qga/installer: Remove QGA VSS if QGA installation failed
         target/arm: Correct LDRD atomicity and fault behaviour
         target/arm: Make DisasContext.{fp, sve}_access_checked
         util/qemu-timer.c: Don't warp timer from timerlist_rearm()
         wdt_i6300esb: fix incorrect mask for interrupt type


author: maxin <maxin@xfusion.com> - 11:8.2.0-61.u4
changelog:
  - Type:bugfix
  - CVE:
  - DESC:QEMU update to version 8.2.0-61
         gtk: Skip drawing if console surface is NULL
         hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to
         hw/intc/arm_gicv3_its: Zero initialize local DTEntry etc
         hw/scsi: Use error_setg_file_open() for a better error
         hw/virtio: Use error_setg_file_open() for a better error
         qmp: update vhost-user protocol feature maps
         replay: Improve assert in replay_char_read_all_load()
         tracetool: fix usage of try_import()
         ui/vnc: Fix qemu abort when query vnc info
         vfio/iommufd: Fix SIGSEV in iommufd_cdev_attach()


author: luoshengwei <luoshengwei@huawei.com> - 0.8.0-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cpu isolate errors when some cpus are offline
    before the service started


author: andy <liuyang01@kylinos.cn> - 0.8.0-9
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patches
         Use the right dev_t decoding for diskerror handler


author: shixuantong <shixuantong1@huawei.com> - 8.2-4
changelog:
  - Add shell command to switch bracketed-paste mode from on to off to keep consistent with realine-8.0


author: wangkai <13474090681@163.com> - 7.2.7-1
changelog:
  - Update to 7.2.7
  - Fix CVE-2021-32626 CVE-2021-32627 CVE-2021-32762 CVE-2021-32675
    CVE-2021-41099 CVE-2021-32628 CVE-2021-32687 CVE-2022-24735
    CVE-2022-24736 CVE-2022-3647 CVE-2022-3734 CVE-2022-35977
    CVE-2023-25155 CVE-2024-46981


author: guowenjia <guowenjia@xfusion.com> - 7.2.14-1
changelog:
  - Type:CVE
  - CVE:CVE-2026-23631,CVE-2026-25243,CVE-2026-23479
  - DESC:update to 7.2.14 for fix CVE-2026-23631,CVE-2026-25243,CVE-2026-23479


author: zhouyihang <zhouyihang3@h-partners.com> - 0.9.1-4
changelog:
  - Type:requirements
  - Id:NA
  - SUG:NA
  - DESC:use libsoup2 instead of libsoup3 for build when no libsoup3 provided


author: sunsuwan <sunsuwan3@huawei.com> - 1.2.6-6
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:add a user directory when the rpc user directory does not exist


author: Funda Wang <fundawang@yeah.net> - 3.2.7-6
changelog:
  - fix CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087,
    CVE-2024-12088, CVE-2024-12747


author: zhangyaqi <zhangyaqi@kylinos.cn> - 8.2312.0-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix memory leak in omazureeventhubs on accepted PN_DELIVERY event


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 8.2312.0-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix passing the value to EscapeChar
         Do not free the uninitialized cstring
         Keep original free pattern
         network subsystem: improve connection failure error message
         Fix runConf NULL pointer refence
         rainerscript: do not try to call a function if it does not exist
         nsd_ptcp regression fix: remove debugging messages emited to stderr
         Fix legacy $ActionQueueDiscardMark parameter


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 8.2312.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:gnutls bugfix: Avoid blocking sockets during TLS handshake
         gnutls bugfix: Add timeout to GnuTLS handshake
         core: fix potential NULL ptr access on HUP in very early startup phase
         omfwd: fix segfault in UDP freeaddrinfo
         gnutls TLS driver: fix small memory leak
         rsyslog startup bugfix: cosmetic memory leak
         core: fix potential misadressing in sigmask
         covscan: remove defect type of RESOURCE_LEAK
         Fix a buffer overflow when the argument to replace is empty


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 8.2312.0-9
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:omusrmsg bugfix: potential null pointer dereference causes segfault
         omusrmsg bugfix: potential double free, which can cause segfault
         imjournal: fix double sd_journal_close() during thread cancellation
         imuxsock: Add statistics counter for discarded messages
         omjournal: Fix priority value
         fix stringop-overread warning in omusrmsg
         fix hashtable realloc memset range
         fix off-by-one buffer overflow


author: maxin <maxin@xfusion.com> - 1.1.8-33.u3
changelog:
  - Type:bugfix
  - CVE:
  - DESC:bump version for using golang update for bugfix
         fix the logic error in the isMountPoint function


author: fandehui <fandehui@xfusion.com> - 1:1.0.0-u17
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Improve stability and error handling across several SCT module components.


author: mapengyuan <mapengyuan@xfusion.com> - 2.0-1.88.u2
changelog:
  - Type:requirement
  - CVE:
  - DESC: fix dual grub.cfg files,redundant password configs
          adapt for kernel 6.6.
          implement rollback for different hardening levels
          add USR_SECURITY flag to control user-defined hardening policies
          fix the issue of breaking symbolic links


author: wangyong <wangyong2@xfusion.com> - 2.0-1.88.u3
changelog:
  - Type:bugfix
  - CVE: 
  - DESC:fn_handle_allow displays a warning instead of an error when a package is not found.


author: liningjie <liningjie1@xfusion.com> - 2.0-1.88.u8
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Move PermitRootLogin and PASS_MAX_DAYS from extra-security.conf to security.conf to enable by default.
         Comment out conflicting SSH algorithm configs in extra-security.conf.


author: wangyong <wangyong2@xfusion.com> - 2.0-1.88.u10
changelog:
  - Type:bugfix
  - CVE:
  - DESC:add secondary hardening: icmp_echo_ignore_all; 
         ecurity: support exec action and harden /tmp with noexec
         Disable coredump generation system-wide.


author: wangyong <wangyong2@xfusion.com> - 2.0-1.88.u11
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Delete useless files(xfusion-add-exec-command-support-and-tmp-noexec-hardening.patch).


author: mapengyuan <mapengyuan@xfusion.com> - 2:4.14.3-8.u1
changelog:
  - Type:requirement
  - CVE:
  - DESC:add trirole support:
         - unable to modify the uid of a privileged user.
         - userdel cannot delete secadm and auditadm when trirole on.
         - root access cannot change the passwords for seadm and audiodm.


author: changhan <changhan@xfusion.com> - 15.7-26.u5
changelog:
  - Type:CVE
  - CVE:CVE-2025-69421,CVE-2026-22796,CVE-2026-28388,CVE-2026-28389
  - DESC:fix CVE-2025-69421,CVE-2026-22796
  spec: Remove debugsource requirement from debuginfo
  Allow debuginfo to be installed alone without pulling in the debugsource package.
  Backport bugfix patches from upstream
  Fix build with binutils 2.46 (c4665d2)
  Fix memory leak on TPM log error in mirror_one_mok_variable (92630f2)
  Apply patch: backport-tpm--Boot-with-a-warning-if-the-event-log-is-full.patch
  Apply patch: backport-lib-simple_file-c--Allocate-zeroed-pool-for-Simple.patch
  Fix CVE-2026-28388
  Fix CVE-2026-28389


author: liuqingtao <liu.qingtao2@zte.com.cn> -1.1.10-3
changelog:
  - optimized-RV-FindMatchLength-improving-compress-speed--upstream-accepted
  - DESC:Use-high-performance-FindMatchLength-to-Optimize for RV


author: ChenYanpan <chenyanpan@xfusion.com> - 1.0.0-7
changelog:
  - Type:bugfix
  - CVE:
  - DESC:fixed missing commas causing elements order problem; signature kernel module


author: ChenYanpan <chenyanpan@xfusion.com> - 1.0.0-12
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Added spinlock protection for the watch_descs array access in file_watch.c


author: mapengyuan <mapengyuan@xfusion.com> - 255-50.u1
changelog:
  - Type:requirement
  - CVE:
  - DESC: xfusion disable the test-systemctl-enable in the chroot environment


author: changhan <changhan@xfusion.com> - 255-59.u2
changelog:
  - Type:CVE
  - CVE:CVE-2026-4105,CVE-2026-29111,CVE-2026-40226,CVE-2026-40225
  - DESC:umount do not move busy network mounts
         backport community patches and skip bios_version test:
         backport-login-user-runtime-dir-free-ignored-sd_bus_error-avo.patch
         backport-login-user-runtime-dir-use-STRLEN-where-appropriate.patch
         backport-systemctl-gracefully-adjust-bus-transport-and-runtim.patch
         backport-journal-do-not-rotate-journal-when-MaxRetentionSec-i.patch
         backport-nspawn-use-strv_extend-and-friends-to-build-director.patch
         backport-nspawn-only-remount-usr-with-idmap-when-volatile-yes.patch
         backport-nspawn-mount-var-after-remount_idmap-when-volatile-s.patch
         backport-compress-avoid-a-bunch-of-div-by-zeroes.patch
         backport-journal-use-EBADMSG-for-invalid-data-in-file-mmap.patch
         backport-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch
         backport-journal-file-do-not-trigger-assertion-on-removed-or.patch
         fix coredump generation when systemd-resolved and systemd-networkd service is started then uninstalled
         fix CVE-2026-4105,CVE-2026-29111,CVE-2026-40226,CVE-2026-40225


author: shechenglong<shechenglong@xfusion.com> - 2.1.0-1.u2
changelog:
  - Type:requirement
  - CVE:
  - DESC:simplify help -h output keep only standard slice and key properties


author: langfei<langfei@huawei.com> - 4.5-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Resolve stap-exporter.service chenge to disable when upgraded systemtap-stap-exporter package


author: langfei<langfei@huawei.com> - 4.5-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix some test cases fail to be executed, Resolve the sc2168 warning detected by the shellcheck tool.


author: liuchao <liuchao173@huawei.com> - 5.0-1
changelog:
  - Upgrade to 5.0:
    - Performance improvements in uprobe registration and module startup.
    - More probe point process details are printed in "-L" list mode with more "-v".
    - For the case where newer kernels may break systemtap runtime APIs, better pass-4 failure diagnostics are printed.
    - Tapset function print_ubacktrace_fileline() now understands DWARF5.
    - The target(s) of process probes may be specified by path name globs,  as located selected debuginfod servers.
    - The kernel-user message transport system added framing codes, making the transport more reliable, but becoming incompatible across pre-5.0 versions. Use matching versions of stap and staprun.
    - The testsuite Makefile has been simplified to remove concurrency, so "parallel" and "resume" modes are gone.
    - New runtime macro STP_TIMING_NSECS is now supported for reporting probe timing stats in nsecs instead of cycles.  This may become default later.
    - Add new runtime macro STP_FORCE_STDOUT_TTY to override STP_STDOUT_NOT_ATTY.


author: yangzhuangzhuang <yangzhuangzhuang1@huawei.com>- 0.6-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:The "cc:No such file or directroy" error message is displayed during compilation.Therefore,add buildrequires gcc.
         The macro unitdir is used.Therefore,add buildrequires systemd


author: jinlun <jinlun@huawei.com> - 4.0.1-1
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:update version to 4.0.1
    - Fix CVE-2023-22745
    - TPM version 1.59 support
    - libmu soname from 0:0:0 to 0:1:0.
    - tss2-sys soname from 1:0:0 to 1:1:0
    - FAPI ignores vendor properties on Fapi_GetInfo
    - FAPI Event Logging JSON format
    - Dead struct TPMS_ALGORITHM_DESCRIPTION
    - Dead field intelPttProperty from TPMU_CAPABLITIES
    - Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
    - Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal


author: chench <chench@hygon.cn> - 4.0.1-5
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:add SM4 algorithm support
    - Add support for udev to create tcm devices
    - add ecc encrypt/decrypt support
    - add bootstrap file from upstream


author: liuchao <liuchao173@huawei.com> - 2.21.0-1
changelog:
  - upgrade to 2.21.0:
    - api: fixed stop method not to require any parameter
    - plugin_scheduler: fix perf fd leaks
    - allow skipping rollback when restarting TuneD or switching profile
    - function_calc_isolated_cores: no errors for offline CPUs
    - sap-hana: new profile sap-hana-kvm-guest
    - serialized SIGHUP handler to prevent possible bootcmdline corruption
    - fixed possible traceback on SIGHUP
    - updated manual pages to be consistent
    - tuned-adm: better error message for unauthorized switch_profile
    - plugin_sysctl: report reapplied sysctls only on different values
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - plugin_cpu: added support for intel_pstate scaling driver
    - plugin_scheduler: do not leak FDs from the perf
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - throughput-performance: set net.core.somaxconn to at least 2048
    - API: added support for moving devices between instances
    - added support for the API access through the Unix Domain Socket
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - do not exit on duplicate config lines


author: ZhaoYu Jiang <jiangzhaoyu@kylinos.cn> - 2.24.1-1
changelog:
  - Upgrade to 2.24.1:
    - fixed privileged execution of arbitrary scripts by active local user. (CVE-2024-52336)
    - added sanity checks for API methods parameters. (CVE-2024-52337)
    - tuned-ppd: fixed controller init to correctly set_on_battery


author: tianmuyang <tianmuyang@huawei.com> - 2.24.1-4
changelog:
  - profiles: add programmable scheduling based on eBPF
  - package:  change package tuned to architecture-dependent


author: langfei<langfei@huawei.com> - 2022g-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix Palestine predictions for 2072 through 2075; Ittoqqortoormiit (America/Scoresbysund) zone change.


author: langfei <langfei@huawei.com> - 2024a-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Aysén Region moves from -04/-03 to -03; new zone;
  -	Improve recent commentary for Chilean decrees;
  -	No need for America/Coyhaique in zonenow.tab.


author: houhongxun <houhongxun@kylinos.cn> - 3.1.0-12
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: add 0001-ukui-panel-fix-incorrect-usage-of-deallocation-func.patch


author: douyan<douyan@kylinos.cn> - 3.1.2-6
changelog:
  - Type: bugfix
  - ID  : NA
  - SUG : NA
  - DESC: add patch03: ukui-power-manager-3.1.2-disable-computer-sleep.patch


author: huayadong <huayadong@kylinos.cn> - 3.1.0-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add patch2:ukui-session-manager-3.1.0-kylin-fix-ukui-kwin-x11-coredump.patch


author: peijiankang <peijiankang@kylinos.cn> - 3.1.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add patch3:add-switchuser-no-limits-ukui-session.patch
         rm disable-Suspend-and-Sleep-of-ukui-session-manager.patch


author: huayadong <huayadong@kylinos.cn> - 3.1.2-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add Patch4:ukui-settings-daemon-3.1.2-kylin-fix-coredump.patch


author: wulinfeng <wulinfeng@xfusion.com> - 1.0.0-79.u40
changelog:
  - Type:bugfix
  - CVE:
  - DESC: fix the issue of residual packets existing after the network card is powered off


author: liuchao <liuchao173@huawei.com> - 1.90.2-1
changelog:
  - Update to 1.90.2:
    - Fix wireless devices not disappearing from Settings when disconnected
    - Require a newer libgudev to avoid bugs related to newline stripping when reading sysfs attributes
    - Add installed-tests files for use with gnome-desktop-testing
    - Fix integration test to work with system installed upower binary and under jhbuild
    - Detect headsets with kernel batteries such as Logitech and Steelseries headsets, and make them automatically disappear if the headset is turned off (if the kernel driver supports the wireless_status attribute)
    - Hide duplicate Logitech Bluetooth devices (Bolt-compatible devices connected through Bluetooth would show as 2 batteries)
    - Hide duplicate Logitech wireless devices when they get connected through USB as well
    - Fix Bluetooth device names not synchronising, and use user-chosen names when available
    - Handle the "present" sysfs attribute changing
    - Fix iDevices not appearing
    - Fix reading capacity_level with newer libgudev
    - Fix OpenBSD backend
    - Refactor internal battery handling into separate classes
    - Guess charging/discharging state based on energy rate (#196)
    - Fix polling after resume (#198)
    - Fix battery state guessing (#146)
    - Reload history when battery ID changes
    - Test fixes
    - Move state guessing into DisplayDevice
    - Always use 90% threshold to consider a battery full
    - Various test improvements
    - Fix mice showing up as keyboards (#189)
    - Allow unit test inspector to fail (#187)
    - Fix test cases when daemon shuts down too slowly (#188)
    - Remove broken wakeup DBus API
    - Tag UPS hid devices using hwdb and update list from upstream
    - Only permit Refresh method when in debug mode
    - Refactor device polling
    - Refactor udev device discovery and sibling detection
    - Improved testing and CI
    - Handle SIGTERM to trigger a clean shutdown
    - Improve polling of batteries after line-power "online" status change
    - Multiple wacom tablet detection fixes
    - Fix updates after a BT hid power supply moves in sysfs
    - Fix enumeration of "Whats Up!" devices on startup
    - Accept USB power supplies without warning
    - Allow building without gtk-doc


author: zhanghongtao <zhanghongtao22@huawei.com> - 017-1
changelog:
  - update package to usbutils-017
  - lsusb: add fallback names for 'lsusb -v' output
  - Honor system libdir and includedir
  - usbutils: lsusb-t: print entries for devices with no interfaces
  - lsusb -t: sort in bus order, not reverse order
  - susb-t: if a driver is not bound to an interface, report "[none]"
  - Generate usbutils.pc pkgconfig file
  - usbreset: Allow idProduct and idVendor to be 0
  - susb: Add function that sorts the output by device ID.
  - lsusb: Additional sorting by bus number.
  - lsusb: This is a more compact implementation of the device list sort implemented within this pull request. The output remains the same as the one demonstrated in the previous commit.


author: liuchao <liuchao173@huawei.com> - 0.14.0-1
changelog:
  - upgrade to 0.14.0:
    - Fix: urcu-bp: only teardown call-rcu worker in destructor
    - Fix: rculfhash: urcu_die() takes positive error value
    - Fix: call_rcu: teardown default call_rcu worker on application exit
    - Fix: join worker thread in call_rcu_data_free
    - Docs: clarify grace period polling API
    - Document grace period polling in rcu-api.md
    - Implement poll rcu stress test in rcutorture
    - urcu-memb,mb,signal: Implement grace period polling
    - Fix: auto-resize hash table destroy deadlock
    - Fix building on MSYS2
    - rculfhash: Include rculfhash-internal.h from local directory
    - Remove "Darwin" from "should also work on list"
    - Merge branch 'adah1972-improve-md'
    - Add semicolons at the end of function prototypes
    - Wrap a file name in backticks
    - Wrap command-line options in backticks
    - Fix a wrong format
    - Wrap URLs in angle brackets
    - Fix Markdown issues
    - Fix: Always check pthread_create for failures
    - Disable signals in URCU background threads
    - Fix: futex.h: include headers outside extern C
    - Fix: add missing unused attribute to _rcu_dereference
    - Fix: change method used by _rcu_dereference to strip type constness
    - Fix: remove type constness in URCU_FORCE_CAST's C++ version
    - Move extern "C" down in include/urcu/urcu-bp.h
    - fix: ifdef linux specific cpu count compat
    - Add unit tests for possible_cpus_array_len
    - fix: sysconf(_SC_NPROCESSORS_CONF) can be less than max cpu id
    - Fix: revise obsolete command in README.md
    - Fix: workqueue: remove unused variable "ret"
    - Fix: urcu-qsbr: futex wait: handle spurious futex wakeups
    - Fix: urcu: futex wait: handle spurious futex wakeups
    - Fix: urcu-wait: futex wait: handle spurious futex wakeups
    - Fix: defer_rcu: futex wait: handle spurious futex wakeups
    - Fix: call_rcu: futex wait: handle spurious futex wakeups
    - Fix: workqueue: futex wait: handle spurious futex wakeups
    - Fix: Use %lu rather than %ld to print count
    - Update ABI definition files
    - Bump version current and age
    - alpha: allocate membarrier system call number
    - Bump version to 0.14.0-pre
    - Improved test framework
    - rculfhash: introduce cds_lfht_node_init_deleted
    - Fix: changelog: v0.13.0 was released in 2021
    - cleanup: i386 arch detection
    - fix: properly detect 'cmpxchg' on x86-32
    - fix: use urcu-tls compat with c++ compiler
    - Fix typo
    - fix: remove autoconf features default value in help message
    - fix: add missing pkgconfig file for memb flavour lib
    - Cleanup: Tests: Remove useless pre-C99 compatibility code from tap.h
    - Document C99 and C++11 requirement in README.md
    - Always use '__thread' for Thread local storage except on MSVC
    - Fix: powerpc32: transparent unions alter calling convention
    - fix: don't use C++ thread_local on MacOs
    - wfcqueue API: implement overloaded wrappers with templates
    - wfcqueue: combine C++ API cds_wfcq_head_cast with overloading
    - wfstack C++ API: implement overloaded wrappers with templates
    - lfstack C++ API: implement overloaded wrappers with templates
    - wfstack: combine C++ API cds_wfs_stack_cast with overloading
    - lfstack: combine C++ API cds_lfs_stack_cast with overloading
    - fix: test_build tap plan
    - Test C++ build of list head init
    - Fix order of initializers in CDS_LIST_HEAD_INIT
    - unit tests: test wfcqueue, wfstack, lfstack empty check functions in C++
    - wfcqueue: implement C++ API based on function overloading
    - wfstack: implement C++ API based on function overloading
    - lfstack: implement C++ API based on function overloading
    - Fix tap.h: remove extra semicolon in pass/fail macros
    - Add C++ build tests
    - Build and run regression and unit tests as C++ programs
    - Add --enable-Werror configure switch
    - Add `urcu_posix_assert()` as `assert()` replacement
    - Rename `urcu_assert()` to `urcu_assert_debug()`
    - cleanup: spelling fixes in comments
    - Make temporary variable in _rcu_dereference non-const
    - (tls-ie2) Fix: x86 and s390: uatomic __hp() macro C++ support
    - Fix: x86 and s390: uatomic __hp() macro clang support
    - Fix: x86 and s390 uatomic: __hp() macro warning with gcc 11


author: yueyuankun <yueyuankun@kylinos.cn> - 0.14.0-3
changelog:
  - Type: compile
  - ID: NA
  - SUG: NA
  - DESC: Fix compilation errors in loongarch architecture
          Replace setup with autosetup


author: mapengyuan <mapengyuan@xfusion.com> - 2:9.0.2092-32.u1
changelog:
  - Type:CVE
  - CVE:CVE-2026-25749,CVE-2026-26269,CVE-2026-28417,CVE-2026-28418,CVE-2026-28419,CVE-2026-28420,CVE-2026-28421,CVE-2026-28422,CVE-2026-33412,CVE-2026-34982,CVE-2026-39881,CVE-2026-35177,CVE-2026-41411
  - DESC:fix CVE-2026-25749,CVE-2026-26269,CVE-2026-28417,CVE-2026-28418,CVE-2026-28419,CVE-2026-28420,CVE-2026-28421,CVE-2026-28422,CVE-2026-33412,CVE-2026-34982,CVE-2026-39881,CVE-2026-35177,CVE-2026-41411


author: mapengyuan <mapengyuan@xfusion.com> - 2:9.0.2092-33.u2
changelog:
  - Type:CVE
  - CVE:CVE-2026-42307,CVE-2026-44656,CVE-2026-45130
  - DESC:Fix CVE-2026-42307,CVE-2026-44656,CVE-2026-45130


author: changhan <changhan@xfusion.com> - 2:9.0.2092-36.u5
changelog:
  - Type:CVE
  - CVE:CVE-2026-47167,CVE-2026-52859,CVE-2026-47162,CVE-2026-52858,CVE-2026-52860
  - DESC:Fix CVE-2026-47167,CVE-2026-52859,CVE-2026-47162,CVE-2026-52858,CVE-2026-52860


author: yanjianqing <yanjianqing@kylinos.cn> - 4.1.0-7
changelog:
  - tests: testdriver: Add filesystem socket example
  - cli: Drop unnecessary --disk prop aliases
  - fsdetails: Fix an error with source.socket of virtiofs
  - tests: cli: Fix test output after previous commit
  - cli: --disk: Add driver.metadata_cache options


author: yanjianqing <yanjianqing@kylinos.cn> - 4.1.0-8
changelog:
  - diskbackend: Drop support for sheepdog
  - cli: support --boot loader.stateless=
  - virt-install: Reuse cli.fail_conflicting
  - virt-install: --unattended and --cloud-init conflict
  - cloner: Sync and system uuid
  - virt-install: --help required options are wrong
  - cli: --cpu: Add maxphysaddr.{mode,bits} options
  - tests: Add a compat check for linux2020 in amd-sev test case
  - virtinstall: fix regression with --boot and no install method
  - virtinstall: split no_install conditional apart to track code coverage


author: yangzhuangzhuang<yangzhuangzhuang1@huawei.com> - 0.3.12-3
changelog:
  - The "no acceptable C compiler found" error message is displayed during compilation.Therefore,add buildrequires gcc.


author: yaowei <neil.yao@xfusion.com> - 1.0.1-u1
changelog:
  - Type:requirement
  - CVE:
  - DESC:Refactor, restructure Wings AI inference framework into decoupled architecture. Move original integrated version code to integrated_version directory


author: yaowei <neil.yao@xfusion.com> - 1.0.1-u2
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Optimize the code directory structure by removing build-time directories. Remove integrated inference engine version.


author: John W. Linville <linville@redhat.com> - 2019.06.03-5
changelog:
  - Remove patch preventing install of regulatory.bin.5 man page
  - Include regulatory.bin.5 man page in distributed files


author: guowenjia <guowenjia@xfusion.com> - 1.0.0-1.u3
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Change Googletest to upload a local file instead of downloading from a network address.


author: yaowei <neil.yao@xfusion.com> - 1.0.0-1.u17
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Strengthens overall robustness by adding stricter validation and safer error-handling paths.


author: baoyonglei <baoyonglei@xfusion.com> - 1.0-1.u6
changelog:
  - Type:requirement
  - CVE:
  - DESC:modify for clean code and change libuvp_compute.py to xVirt_compute.py


author: shechenglong <shechenglong@xfusion.com> - 1.3.0-1.u16
changelog:
  - Type:bugfix
  - CVE:
  - DESC:vmca fix non-atomic global_cpu_map.json persistence; write via
    tempfile+os.replace so concurrent readers never observe a truncated or
    half-written JSON, and tolerate corrupted maps in load() with a warning
    fallback to an empty map


author: shechenglong <shechenglong@xfusion.com> - 1.3.0-1.u17
changelog:
  - Type:bugfix
  - CVE:
  - DESC:vmca clean up `discover`/`status` output and refine `discover --vm`
    error messages for non-existent or non-running VMs


author: shechenglong <shechenglong@xfusion.com> - 1.3.0-1.u18
changelog:
  - Type:bugfix
  - CVE:
  - DESC:vmca route PIN/UNPIN events to syslog via logger and drop the
    /var/log/vmca/events.log file together with the `vmca log` subcommand


author: shechenglong <shechenglong@xfusion.com> - 1.3.0-1.u19
changelog:
  - Type:bugfix
  - CVE:
  - DESC:vmca restore range pinning when the guest agent restarts or the VM
    reboots; guest sends a session-reset notification on startup/shutdown,
    host also subscribes to libvirt domain REBOOT events as fallback


author: shechenglong <shechenglong@xfusion.com> - 1.3.0-1.u20
changelog:
  - Type:bugfix
  - CVE:
  - DESC:set vmca shmem mode to 740 and make vmca-guest auto-enable with ivshmem wait


author: shechenglong <shechenglong@xfusion.com> - 1.3.0-1.u23
changelog:
  - Type:bugfix
  - CVE:
  - DESC:fix vmca cleancode warnings for duplicate exception catches and unchecked return values


author: shechenglong <shechenglong@xfusion.com> - 1.3.0-1.u25
changelog:
  - Type:bugfix
  - CVE:
  - DESC:make vmca discover register only newly discovered compliant VMs without overwriting existing VM pin state


author: mahailiang <mahailiang@uniontech.com> - 1.1.3-6
changelog:
  - xdg-email: Support for Deepin
  - Restore matching of older deepin names
  - Add new case for Deepin while detecting DE


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: Wang Kui <wangkui35@h-partners.com> - 1.20.11-41
changelog:
  - Fix CVE-2025-49176 CVE-2025-49179 CVE-2025-49180 CVE-2025-49737
    CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: wangsihong <wangsihong@xfusion.com> - 1.20.11-42.u2
changelog:
  - Type:CVE
  - CVE:CVE-2022-49737,CVE-2025-49175,CVE-2025-49176,CVE-2025-49178,CVE-2025-49179,CVE-2025-49180,CVE-2025-62229,CVE-2025-62230,CVE-2025-62231
  - DESC:Fix CVE-2022-49737,CVE-2025-49175,CVE-2025-49176,CVE-2025-49178,CVE-2025-49179,CVE-2025-49180,CVE-2025-62229,CVE-2025-62230,CVE-2025-62231


author: mapengyuan <mapengyuan@xfusion.com> - 1.20.11-43.u3
changelog:
  - Type:bugfix
  - CVE:
  - DESC:Fix possible Xorg crashes for ps23xx when using  ast and pe2201 bmc card


author: changhan <changhan@xfusion.com> - 1.20.11-44.u4
changelog:
  - Type:CVE
  - CVE:CVE-2026-33999,CVE-2026-34000,CVE-2026-34001,CVE-2026-34002,CVE-2026-34003
  - DESC:fix CVE-2026-33999,CVE-2026-34000,CVE-2026-34001,CVE-2026-34002,CVE-2026-34003


author: mapengyuan <mapengyuan@xfusion.com> - 1.20.11-45.u5
changelog:
  - Type:CVE
  - CVE:CVE-2026-50256,CVE-2026-50257,CVE-2026-50258,CVE-2026-50259,CVE-2026-50260,CVE-2026-50261,CVE-2026-50262,CVE-2026-50263,CVE-2026-50264
  - DESC:Fix CVE-2026-50256,CVE-2026-50257,CVE-2026-50258,CVE-2026-50259,CVE-2026-50260,CVE-2026-50261,CVE-2026-50262,CVE-2026-50263,CVE-2026-50264


author: changhan <changhan@xfusion.com> - 22.1.2-15.u1
changelog:
  - Type:CVE
  - CVE:CVE-2025-49178,CVE-2025-49179,CVE-2025-49180,CVE-2025-26595,CVE-2026-33999,CVE-2026-34001,CVE-2025-62229,CVE-2026-34002,CVE-2026-34003
  - DESC:fix CVE-2025-49178,CVE-2025-49179,CVE-2025-49180,CVE-2025-26595,CVE-2026-33999,CVE-2026-34001,CVE-2025-62229,CVE-2026-34002,CVE-2026-34003


author: changhan <changhan@xfusion.com> - 22.1.2-15.u2
changelog:
  - Type:CVE
  - CVE:CVE-2026-50256,CVE-2026-50257,CVE-2026-50258,CVE-2026-50259,CVE-2026-50260,CVE-2026-50261,CVE-2026-50262,CVE-2026-50263
  - DESC:fix CVE-2026-50256,CVE-2026-50257,CVE-2026-50258,CVE-2026-50259,CVE-2026-50260,CVE-2026-50261,CVE-2026-50262,CVE-2026-50263


author: wangyong <wangyong2@xfusion.com> - 1.1.0-u1
changelog:
  - Type:requirement
  - CVE:
  - DESC: Implement the four-layer security architecture and xsec-policy-core policy workflow foundation


author: wangyong <wangyong2@xfusion.com> - 1.1.0-u2
changelog:
  - Type:requirement
  - CVE:
  - DESC: Add resource declarations, schema validation, and policy script adapters


author: wangyong <wangyong2@xfusion.com> - 1.1.0-u3
changelog:
  - Type:requirement
  - CVE:
  - DESC: Add session orchestration, state persistence, IPC dispatch, and audit events


author: wangyong <wangyong2@xfusion.com> - 1.1.0-u4
changelog:
  - Type:requirement
  - CVE:
  - DESC: Finalize administrator CLI, shell completion, RPM layout, and resource declaration format


author: wangmeiyang <wangmeiyang@xfusion.com> - 1.1.0-u6
changelog:
  - Type:bugfix
  - CVE:
  - DESC: Fix CLI paging, monitor scheduling, rollback-to-created semantics, error messages, root-only file permissions, and RPM RPATH build checks.


