# changelog

author: Luo Qiu <luoqiu@kylinsec.com.cn> - 6.6.0-28.0.0.34.kb27
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption (v:159027)[CVE-2026-46331]
  - usb: cdns3: Fix deadlock when using NCM gadget (v:108859)[CVE-2025-37812]
  - ovl: don't allow datadir only (v:108859)[CVE-2025-37863]
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (v:108859)[CVE-2025-37758]
  - media: venus: hfi: add a check to handle OOB in sfr region (v:108859)[CVE-2025-23159]
  - i3c: Add NULL pointer check in i3c_master_queue_ibi() (v:108859)[CVE-2025-23147]
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (v:107995)[CVE-2025-23140]
  - scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (v:107987)[CVE-2025-37828]
  - fs/ntfs3: Prevent integer overflow in hdr_first_de() (v:107987)[CVE-2025-22080]
  - drm/amd/display: avoid NPD when ASIC does not support DMUB (v:103652)[CVE-2025-22093]
  - ACPI: EC: Fix unbalanced enable for IRQ on Phytium platforms (b:154747)


author: Luo Qiu <luoqiu@kylinsec.com.cn> - 6.6.0-28.0.0.34.kb28
changelog:
  - fuse: reject oversized dirents in page cache (v:163834)[CVE-2026-31694]
  - eventpoll: defer struct eventpoll free to RCU grace period (v:163679)[CVE-2026-43074]
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF (v:163679)[CVE-2026-46242]
  - eventpoll: move epi_fget() up (v:163679)[CVE-2026-46242]
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (v:163679)[CVE-2026-46242]
  - eventpoll: kill __ep_remove() (v:163679)[CVE-2026-46242]
  - eventpoll: split __ep_remove() (v:163679)[CVE-2026-46242]
  - eventpoll: use hlist_is_singular_node() in __ep_remove() (v:163679)[CVE-2026-46242]
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (v:128928)[CVE-2025-68204]
  - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() (v:141875)[CVE-2026-31426]
  - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (v:141875)[CVE-2026-31403]
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (v:141875)[CVE-2026-31402]
  - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (v:141875)[CVE-2026-23450]
  - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n (v:141875)[CVE-2026-23439]
  - sunrpc: fix cache_request leak in cache_release (v:141875)[CVE-2026-31400]
  - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (v:141838)[CVE-2026-31428]
  - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (v:141838)[CVE-2026-31427]
  - netfilter: nfnetlink_log: account for netlink header size (v:141838)[CVE-2026-31416]
  - ipv6: avoid overflows in ip6_datagram_send_ctl() (v:141838)[CVE-2026-31415]
  - spi: fix statistics allocation (v:141838)[CVE-2026-23475]
  - spi: fix use-after-free on controller registration failure (v:141838)[CVE-2026-31389]
  - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (v:141838)[CVE-2026-23458]
  - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (v:141838)[CVE-2026-23457]
  - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (v:141838)[CVE-2026-23456]
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (v:141838)[CVE-2026-23455]
  - PM: runtime: Fix a race condition related to device removal (v:141838)[CVE-2026-23452]
  - net/sched: teql: Fix double-free in teql_master_xmit (v:141838)[CVE-2026-23449]
  - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check (v:141838)[CVE-2026-23447]
  - ipv6: add NULL checks for idev in SRv6 paths (v:141838)[CVE-2026-23442]
  - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (v:141838)[CVE-2026-23407]
  - apparmor: fix side-effect bug in match_char() macro usage (v:141838)[CVE-2026-23406]
  - icmp: fix NULL pointer dereference in icmp_tag_validation() (v:141838)[CVE-2026-23398]
  - net/sched: act_ife: Fix metalist update behavior (v:141838)[CVE-2026-23378]
  - net/sched: act_ife: avoid possible NULL deref (v:141838)[CVE-2026-23378]
  - mtdchar: fix integer overflow in read/write ioctls (v:128928)[CVE-2025-68237]
  - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (v:120596)[CVE-2025-68764]
  - bpf: Sync pending IRQ work before freeing ring buffer (v:120596)[CVE-2025-40319]
  - net: ipv6: flowlabel: defer exclusive option free until RCU teardown (v:156536)[CVE-2026-31680]
  - ALSA: ctxfi: Limit PTP to a single page (v:156536)[CVE-2026-31602]
  - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (v:156536)[CVE-2026-31424]
  - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (v:156536)[CVE-2026-31423]
  - bridge: mrp: reject zero test interval to avoid OOM panic (v:156536)[CVE-2026-31420]
  - netfilter: ipset: drop logically empty buckets in mtype_del (v:156536)[CVE-2026-31418]
  - netfilter: conntrack: add missing netlink policy validations (v:156536)[CVE-2026-31407]
  - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (v:156530)[CVE-2026-43429]
  - USB: usbcore: Introduce usb_bulk_msg_killable() (v:156530)[CVE-2026-43429]
  - ceph: fix i_nlink underrun during async unlink (v:156530)[CVE-2026-43420]
  - x86/apic: Disable x2apic on resume if the kernel expects so (v:156530)[CVE-2026-43363]
  - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (v:156530)[CVE-2026-43313]
  - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (v:156530)[CVE-2026-43313]
  - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (v:156530)[CVE-2026-43265]
  - KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject (v:156530)[CVE-2026-43265]
  - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (v:156530)[CVE-2026-43214]
  - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (v:156530)[CVE-2026-43019]
  - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt (v:156530)[CVE-2026-43018]
  - Bluetooth: MGMT: validate mesh send advertising payload length (v:156530)[CVE-2026-43017]
  - net/mlx5: lag: Check for LAG device before creating debugfs (v:156530)[CVE-2026-43013]
  - bridge: br_nd_send: linearize skb before parsing ND options (v:156530)[CVE-2026-31682]
  - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (v:156530)[CVE-2026-31674]
  - af_unix: read UNIX_DIAG_VFS data under unix_state_lock (v:156530)[CVE-2026-31673]
  - HID: core: clamp report_size in s32ton() to avoid undefined shift (v:156530)[CVE-2026-31624]
  - HID: alps: fix NULL pointer dereference in alps_raw_event() (v:156530)[CVE-2026-31625]
  - Input: uinput - fix circular locking dependency with ff-core (v:156530)[CVE-2026-31667]
  - HID: apple: avoid memory leak in apple_report_fixup() (v:156530)[CVE-2026-31520]
  - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() (v:156530)[CVE-2026-31522]
  - mm/userfaultfd: fix hugetlb fault mutex hash calculation (v:156530)[CVE-2026-31575]
  - af_key: validate families in pfkey_send_migrate() (v:156530)[CVE-2026-31515]
  - net: fix fanout UAF in packet_release() via NETDEV_UP race (v:156530)[CVE-2026-31504]
  - hwmon: (pmbus/core) Protect regulator operations with mutex (v:156530)[CVE-2026-31486]
  - hwmon: (pmbus/core) Declare regulator notification function as void (v:156530)[CVE-2026-31486]
  - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (v:156530)[CVE-2026-31436]
  - net/mlx5: Fix kabi breakage in struct mlx5_core_rsc_common (b:156498)
  - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (v:156498)[CVE-2026-43407]
  - HID: core: Mitigate potential OOB by removing bogus memset() (v:156498)[CVE-2026-43048]
  - HID: core: Add printk_ratelimited variants to hid_warn() etc (v:156498)[CVE-2026-43048]
  - HID: multitouch: Check to ensure report responses match the request (v:156498)[CVE-2026-43047]
  - Bluetooth: MGMT: validate LTK enc_size on load (v:156498)[CVE-2026-43020]
  - ext4: reject mount if bigalloc with s_first_data_block != 0 (v:156498)[CVE-2026-31447]
  - misc: uacce - fix a null pointer access issue when poweroff (v:156498)[CVE-2026-23063]
  - NFS: Fix a deadlock involving nfs_release_folio() (v:156498)[CVE-2026-23053]
  - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" (b:156498)
  - Revert "NFS: fix up nfs_release_folio() to try to release the page" (b:156498)
  - bpf: Fix reference count leak in bpf_prog_test_run_xdp() (v:156498)[CVE-2026-22994]
  - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (v:156498)[CVE-2026-22976]
  - ext4: xattr: fix null pointer deref in ext4_raw_inode() (v:156498)[CVE-2025-68820]
  - ethtool: Avoid overflowing userspace buffer on stats query (v:156498)[CVE-2025-68795]
  - bpf: Fix invalid prog->stats access when update_effective_progs fails (v:156498)[CVE-2025-68742]
  - ima: Handle error code returned by ima_filter_rule_match() (v:156498)[CVE-2025-68740]
  - libceph: replace BUG_ON with bounds check for map->max_osd (v:156498)[CVE-2025-68283]
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (v:156498)[CVE-2025-68284]
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (v:156498)[CVE-2025-68285]
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (v:156498)[CVE-2025-40280]
  - bpf: Explicitly check accesses to bpf_sock_addr (v:156498)[CVE-2025-40078]
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup (v:156498)[CVE-2025-40018]
  - nexthop: Forbid FDB status change while nexthop is in a group (v:156498)[CVE-2025-39980]
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (v:156498)[CVE-2025-39937]
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (v:156498)[CVE-2025-39955]
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (v:156498)[CVE-2025-39937]
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (v:156498)[CVE-2025-39894]
  - sctp: Prevent TOCTOU out-of-bounds write (v:156498)[CVE-2025-40331]
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (v:156498)[CVE-2025-40281]
  - sctp: avoid NULL dereference when chunk data buffer is missing (v:156498)[CVE-2025-40240]
  - sctp: initialize more fields in sctp_v6_from_sk() (v:156498)[CVE-2025-39812]
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (v:156498)[CVE-2025-39756]
  - clk: samsung: Fix UBSAN panic in samsung_clk_init() (v:156498)[CVE-2025-39728]
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (b:156498)
  - ipv6: sr: Fix MAC comparison to be constant-time (v:156498)[CVE-2025-39702]
  - tls: fix handling of zero-length records on the rx_list (v:156498)[CVE-2025-39682]
  - scsi: qla4xxx: Prevent a potential error pointer dereference (v:156498)[CVE-2025-39676]
  - netfilter: ctnetlink: fix refcount leak on table dump (v:156498)[CVE-2025-38721]
  - ksmbd: use aead_request_free to match aead_request_alloc (v:156498)[CVE-2025-38575]
  - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (b:156498)
  - vsock: fix `vsock_proto` declaration (b:156498)
  - vsock: Fix transport_{g2h,h2g} TOCTOU (v:156498)[CVE-2025-38462]
  - vsock: fix lock inversion in vsock_assign_transport() (v:156498)[CVE-2025-38461]
  - vsock: Fix transport_* TOCTOU (v:156498)[CVE-2025-38461]
  - maple_tree: fix mt_destroy_walk() on root leaf node (b:156498)
  - maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (v:156498)[CVE-2025-38364]
  - smb: Log an error when close_all_cached_dirs fails (v:156498)[CVE-2025-38321]
  - ASoC: Intel: avs: Verify content returned by parse_int_array() (v:156498)[CVE-2025-38307]
  - ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (b:156498)
  - Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (b:156498)
  - Bluetooth: hci_core: fix list_for_each_entry_rcu usage (b:156498)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (b:156498)
  - Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (b:156498)
  - Bluetooth: hci_qca: move the SoC type check to the right place (b:156498)
  - Bluetooth: Fix NULL pointer deference on eir_get_service_data (v:156498)[CVE-2025-38304]
  - lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (v:156498)[CVE-2025-38255]
  - net_sched: sch_sfq: reject invalid perturb period (v:156498)[CVE-2025-38193]
  - net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (v:156498)[CVE-2025-38183]
  - net: microchip: lan743x: Reduce PTP timeout on HW failure (b:156498)
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (v:156498)[CVE-2025-38161]
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (b:156498)
  - net: phy: mscc: Fix memory leak when using one step timestamping (v:156498)[CVE-2025-38148]
  - coresight: prevent deactivate active config while enabling the config (v:156498)[CVE-2025-38131]
  - net: wwan: t7xx: Fix napi rx poll issue (v:156498)[CVE-2025-38123]
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (v:156498)[CVE-2025-38122]
  - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (b:156498)
  - ACPI: CPPC: Perform fast check switch only for online CPUs (v:156498)[CVE-2025-38113]
  - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (v:156498)[CVE-2025-38113]
  - smb: client: Reset all search buffer pointers when releasing buffer (b:156498)
  - smb: client: Fix use-after-free in cifs_fill_dirent (v:156498)[CVE-2025-38051]
  - firmware: arm_ffa: Reject higher major version as incompatible (b:156498)
  - firmware: arm_ffa: Set dma_mask for ffa devices (v:156498)[CVE-2025-38043]
  - vxlan: Annotate FDB data races (v:156498)[CVE-2025-38037]
  - vxlan: Join / leave MC group after remote changes (b:156498)
  - dmaengine: idxd: Fix double free in idxd_setup_wqs() (b:156498)
  - dmaengine: idxd: Fix refcount underflow on module unload (b:156498)
  - dmaengine: idxd: Remove improper idxd_free (b:156498)
  - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (v:156498)[CVE-2025-38014]
  - dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (b:156498)
  - dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (b:156498)
  - dmaengine: idxd: Add missing cleanups in cleanup internals (b:156498)
  - dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (b:156498)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (b:156498)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (b:156498)
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (b:156498)
  - usb: typec: ucsi: displayport: Fix deadlock (v:156498)[CVE-2025-37967]
  - ksmbd: fix stream write failure (v:156498)[CVE-2025-37947]
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (v:156498)[CVE-2025-37918]
  - firmware: arm_scmi: Balance device refcount when destroying devices (v:156498)[CVE-2025-37905]
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (v:156498)[CVE-2025-37881]
  - drm/amdkfd: debugfs hang_hws skip GPU with MES (v:156498)[CVE-2025-37853]
  - cifs: fix integer overflow in match_server() (b:156498)
  - cifs: avoid NULL pointer dereference in dbg call (v:156498)[CVE-2025-37844]
  - cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (v:156498)[CVE-2025-37831]
  - misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (b:156498)
  - misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (v:156498)[CVE-2025-37815]
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (v:156498)[CVE-2025-37805]
  - ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (v:156498)[CVE-2025-37793]
  - drm/amd/pm: Prevent division by zero (v:156498)[CVE-2025-37771]
  - drm/amd/pm/powerplay: Prevent division by zero (v:156498)[CVE-2025-37770]
  - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (v:156498)[CVE-2025-37768]
  - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (v:156498)[CVE-2025-37766]
  - iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (v:156498)[CVE-2025-37748]
  - media: venus: hfi_parser: add check to avoid out of bound access (v:156498)[CVE-2025-23157]
  - watch_queue: fix pipe accounting mismatch (v:156498)[CVE-2025-23138]
  - spufs: fix a leak in spufs_create_context() (v:156498)[CVE-2025-22071]
  - PCI/MSI: Handle lack of irqdomain gracefully (v:156498)[CVE-2024-56760]
  - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (v:156482)[CVE-2026-43057]
  - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (b:156482)
  - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (v:156482)[CVE-2026-43492]
  - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (v:156482)[CVE-2026-43483]
  - unshare: fix unshare_fs() handling (v:156482)[CVE-2026-43472]
  - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (v:156482)[CVE-2026-43470]
  - usb: class: cdc-wdm: fix reordering issue in read code path (v:156482)[CVE-2026-43427]
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (b:156482)
  - powerpc, perf: Check that current->mm is alive before getting user callchain (v:156482)[CVE-2026-43416]
  - ceph: add a bunch of missing ceph_path_info initializers (v:156482)[CVE-2026-43408]
  - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep (v:156482)[CVE-2026-43381]
  - perf/x86/intel/uncore: Fix die ID init and look up bugs (v:156482)[CVE-2026-43344]
  - kexec: derive purgatory entry from symbol (v:156482)[CVE-2026-43289]
  - media: pvrusb2: fix URB leak in pvr2_send_request_ex (v:156482)[CVE-2026-43223]
  - usb: dwc3: gadget: Move vbus draw to workqueue context (v:156482)[CVE-2026-43170]
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (b:156482)
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (v:156482)[CVE-2026-43147]
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (b:156482)
  - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (v:156482)[CVE-2026-43134]
  - fbcon: check return value of con2fb_acquire_newinfo() (v:156482)[CVE-2026-43123]
  - Bluetooth: hci_sync: annotate data-races around hdev->req_status (v:156482)[CVE-2026-43119]
  - bridge: br_nd_send: validate ND option lengths (v:156482)[CVE-2026-31752]
  - udp: Fix wildcard bind conflict check when using hash2 (v:156482)[CVE-2026-31503]
  - tcp: Rearrange tests in inet_csk_bind_conflict(). (v:156482)[CVE-2026-31503]
  - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (v:156482)[CVE-2026-23383]
  - scsi: target: tcm_loop: Drain commands in target_reset handler (v:156482)[CVE-2026-43054]
  - perf/x86/intel: Fix KASAN global-out-of-bounds warning (v:141938)[CVE-2025-40359]
  - nvme-fc: use lock accessing port_state and rport state (v:141938)[CVE-2025-40342]
  - tracing: Add recursion protection in kernel stack trace recording (v:141938)[CVE-2026-23138]
  - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (v:141904)[CVE-2026-31393]
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (v:141904)[CVE-2026-23461]
  - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (v:141904)[CVE-2026-23444]
  - net/mlx5e: Fix race condition during IPSec ESN update (v:141904)[CVE-2026-23440]
  - net/mlx5e: Prevent concurrent access to IPSec ASO context (v:141904)[CVE-2026-23441]
  - apparmor: validate DFA start states are in bounds in unpack_pdb (v:141904)[CVE-2026-23269]
  - tcp: secure_seq: add back ports to TS offset (v:141904)[CVE-2026-23247]
  - ice: Fix memory leak in ice_set_ringparam() (v:141904)[CVE-2026-23389]
  - nvdimm/bus: Fix potential use after free in asynchronous initialization (v:141904)[CVE-2026-31399]
  - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). (v:141904)[CVE-2025-68291]
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (v:141904)[CVE-2026-31408]
  - media: dvb-net: fix OOB access in ULE extension header tables (v:141904)[CVE-2026-31405]
  - ksmbd: fix the warning from __kernel_write_iter (v:113031)[CVE-2025-37775]
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (v:113031)[CVE-2025-37927]
  - media: venus: hfi: add check to handle incorrect queue size (v:113031)[CVE-2025-23158]
  - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (v:113031)[CVE-2025-23160]
  - net: tls: explicitly disallow disconnect (v:113031)[CVE-2025-37756]
  - pwm: mediatek: Ensure to disable clocks in error path (v:113031)[CVE-2025-37850]
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (v:113031)[CVE-2025-37850]
  - ksmbd: fix use-after-free in smb_break_all_levII_oplock() (v:113031)[CVE-2025-37776]
  - ksmbd: fix memory leak in parse_lease_state() (v:109976)[CVE-2025-22042]
  - ksmbd: add bounds check for create lease context (v:109976)[CVE-2025-22042]
  - ksmbd: add bounds check for durable handle context (v:109976)[CVE-2025-22043]
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (v:109976)[CVE-2025-40121]
  - iommu/vt-d: debugfs: Fix legacy mode page table dump logic (v:109976)[CVE-2025-40155]
  - net: skbuff: preserve shared-frag marker during coalescing (v:161359)[CVE-2026-43503]


author: Luo Qiu <luoqiu@kylinsec.com.cn> - 6.6.0-28.0.0.34.kb29
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (v:163843)[CVE-2026-53359]
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (v:163843)[CVE-2026-46113]
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (v:164298)[CVE-2026-53163]
  - rtmutex: Use waiter::task instead of current in remove_waiter() (v:164298)[CVE-2026-43499]


author: Hongjian Dai <daihongjian@kylinsec.com.cn> - 6.6.0-28.0.0.34.kb30
changelog:
  - arm64: Don't call NULL in do_compat_alignment_fixup() (v:158767)[CVE-2025-22033]
  - net: openvswitch: reject oversized nested action attrs (v:169571)[CVE-2026-64531]
  - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (v:169552)[CVE-2026-64422]
  - xfs: resample the data fork mapping after cycling ILOCK (v:169550)[CVE-2026-64600]
  - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation. (f:165329)
  - bonding: kabi fix prevent potential infinite loop in bond_header_parse() (v:163835)[CVE-2026-23451]
  - team: fix header_ops type confusion with non-Ethernet ports (v:163835)[CVE-2026-31502]
  - bonding: prevent potential infinite loop in bond_header_parse() (v:163835)[CVE-2026-23451]
  - bonding: fix type confusion in bond_setup_by_slave() (v:163835)[CVE-2026-43456]
  - security: rbac: avoid redefinition of AUDIT_RBAC_{BIBA,MLS} (b:168480)


author: lingsheng <lingsheng1@h-partners.com> - 3.7.1-7
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5915,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5915 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: lingsheng <ultra_planet@qq.com> - 3.7.1-10.kb2
changelog:
  - sync libarchive 3.7.1-11 from openEuler 24.03 LTS (f:156682)
  - fix CVE-2026-4424(v:156682)[CVE-2026-4424]
  - fix CVE-2026-4426(v:156682)[CVE-2026-4426]
  - fix CVE-2026-5121(v:156682)[CVE-2026-5121]


author: yaoxin <1024769339@qq.com> - 20250113-1
changelog:
  - Update to 20250113:
    * Parse unknown timezones as UTC
    * Apk (Alpine Linux) format support added
    * Implement default value in parameter expansion
    * Also support supplements that use & as "and"
    * Add workaround for skopeo's argument parser
    * add cap-htm=off on power9
    * Fixed usage of chown calls
    * Remove leading `go` from `purl` locators


author: jianmin <jianmin@iscas.ac.cn> - 1.34.1-5
changelog:
  - Type:cve
  - CVE:CVE-2024-3727 CVE-2024-24791
  - SUG:NA
  - DESC: fix CVE-2024-3727 and Rebuild to fix CVE-2024-24791


author: liaowei <liaowei@kylinsec.com.cn> - 1.34.1-10.kb2
changelog:
  - sync buildah 1.34.1-12 from openEuler 24.03 LTS (f:156486)
  - backport CVE-2024-9676 CVE-2025-47913 (f:156486)


author: liuxu <liuxu156@huawei.com> - 1:1.36.1-6
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: wangjiang <wangjiang37@h-partners.com> - 2023.2.64-2
changelog:
  - remove expired and sync new certificates
    Removing:
      Security Communication Root CA
    Adding:
      D-Trust SBR Root CA 1 2022
      D-Trust SBR Root CA 2 2022
      Telekom Security SMIME ECC Root 2021
      Telekom Security SMIME RSA Root 2023
      Telekom Security TLS ECC Root 2020
      Telekom Security TLS RSA Root 2023


author: wangjiang <app@cameyan.com> - 2023.2.64-4
changelog:
  - remove expired and sync new certificates
    Removing:
      Certificate "Explicitly Distrust DigiNotar Root CA"
      Certificate "Baltimore CyberTrust Root"
    Adding:
      Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
      Certificate "TWCA CYBER Root CA"
      Certificate "TWCA Global Root CA G2"
      Certificate "SecureSign Root CA12"
      Certificate "SecureSign Root CA14"
      Certificate "SecureSign Root CA15"
      Certificate "D-TRUST BR Root CA 2 2023"
      Certificate "D-TRUST EV Root CA 2 2023"


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 1.18.0-2
changelog:
  - Type:CVE
  - ID:CVE-2025-50422
  - SUG:NA
  - DESC:Fix a NULL access in active_edges_to_traps()
         Add unlikely() to test for x == INT32_MAX for the NULL reference


author: yuanxing <yuanxing@kylinsec.com.cn> - 1.22.0-1.kb89
changelog:
  - KYOS-B: fix the crash when change gtk theme.(#25030,#32184)
  - KYOS-B: remove update preview attributes function after async rename(#31729,#25067)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 1.22.0-1.kb92
changelog:
  - KYOS-B: Fix quick screen size adjustment causing crashes when opening folders
  - kYOS-B: Fix the issue of missing link info for files moved to the desktop


author: dongyuzhen <dongyuzhen@h-partners.com> - 23.4.1-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix(net): klibc ipconfig PROTO compatibility
         fix(openstack): Fix bond mac_address


author: shixuantong <shixuantong1@huawei.com> - 23.4.1-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:chore: set recursive=False for ensure_dir if parent path is "/"
         test(openstack): Test bond mac address
         fix: Ensure properties for bonded interfaces are properly translated


author: shixuantong <shixuantong1@huawei.com> - 23.4.1-13
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:net/sysconfig: do not remove all existing settings of /etc/sysconfig/network
         fix: typing for rsyslog, ubuntu_pro, power_state_change


author: fuanan <fuanan3@h-partners.com> - 3.27.9-5
changelog:
  - remove the architecture judgment in the patches section;
  - include all patches in the source package.


author: Han Jinpeng <hanjinpeng@kylinos.cn> - 309-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: remove incorrect provides cockpit-machines and cockpit-machines-ovirt
          remove require libvirt and libvirt-client


author: xinghe <xinghe2@h-partners.com> - 34.1-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:ensure that the src package contains the loongson and sw patches


author: zhangzikang <zhangzikang@kylinos.cn> - 1.6.22-14
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add loong64 to THP patch, fix build error for loongarch64
         fix incorrect dates


author: dongyuzhen <dongyuzhen@h-partners.com> - 1.6.22-20
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:delete task asynchronously to avoid containerd be killed when delete is blocking


author: huyubiao <huyubiao@huawei.com> - 9.4-9
changelog:
  - fix alias sm3sum not working on bash
    delete redundant backport-chmod-fix-exit-status-when-ignoring-symlinks.patch


author: huyubiao <huyubiao@huawei.com> - 9.4-10
changelog:
  - sync patches from community
  - add backport-pinky-fix-string-size-calculation.patch
        backport-cksum-consistently-validate-length-attributes.patch
        backport-timeout-fix-race-where-we-might-kill-arbitrary-proce.patch
        backport-timeout-fix-narrow-race-in-failing-to-kill-processes.patch
        backport-maint-basenc-consistently-check-buffer-bounds-when-e.patch
        backport-putenv-Don-t-crash-upon-out-of-memory.patch
        backport-head-off_t-not-uintmax_t-for-file-offset.patch
        backport-shuf-avoid-integer-overflow-on-huge-inputs.patch
        backport-shuf-fix-randomness-bug.patch


author: hugel <gengqihu2@h-partners.com> - 9.4-12
changelog:
  - sync patches from community
  - add backport-numfmt-don-t-require-a-suffix-with-from-iec-i.patch
        backport-sort-fix-debug-buffer-overrun.patch
        backport-tac-avoid-out-of-bounds-access.patch
        backport-yes-avoid-failure-on-CHERI-protected-systems.patch


author: Peng Fan <fanpeng@loongson.cn> - 12.3.1-33
changelog:
  - Type: Sync
  - DESC: Optimize the loading of immediate numbers.
  -       Fixed bug in bstrins_<mode>for_ior_mask.


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 12.3.1-38
changelog:
  - Type: Sync
  - DESC: Sync patches for fixing building issues with clang
  - Source: https://gitee.com/openeuler/gcc/pulls/239


author: lijian <lijian2@kylinos.cn> - 1.8.7-1
changelog:
  - update to 1.8.7
  - crun: new command "crun features".
  - linux: support io_priority from the OCI specs.
  - cgroup: allow setting swap to 0.
  - cgroup, systemd: set the memory limit on the system scope.


author: xinghe <xinghe2@h-partners.com> - 4.18.5-2
changelog:
  - Type:cves
  - ID:CVE-2023-3961 CVE-2023-4091 CVE-2023-4154 CVE-2023-42669 CVE-2023-42670
  - SUG:NA
  - DESC:fix CVE-2023-3961 CVE-2023-4091 CVE-2023-4154 CVE-2023-42669 CVE-2023-42670


author: Funda Wang <fundawang@yeah.net> - 1:2.4.7-7
changelog:
  - fix CVE-2025-58060, CVE-2025-58364
  - move www files into main package due to requirement by web interface


author: chenyanpan <chenyanpan@xfusion.com> - 1:2.4.7-13
changelog:
  - Fix CVE-2026-34979: Heap overflow in get_options()
  - Fix CVE-2026-34980: Filter control characters from option values


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:paramhlp: fix CRLF-stripping files with "-d @file"
         libssh2: set length to 0 if strdup failed
         openldap: create ldap URLs correctly for IPv6 addresses
         multi: avoid memory-leak risk
         tool_cfgable: free {proxy_}cipher13_list on exit


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:multi: check that the multi handle is valid in curl_multi_assign


author: xingwei <xingwei14@h-partners.com> - 8.4.0-16
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:altsvc: avoid integer overflow in expire calculation
         urlapi: fix redirect to a new fragment or query (only)
         tool_getparam: clear sensitive arguments better


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix freeing of resources in disconnect
         openssl: fix crash on missing cert password


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix readdir issues
         h3: fix query of concurrent streams
         noproxy: fix the IPV6 network mask pattern match
         krb5_gssapi: fix memory leak on error path
         openldap: fix memory-leak in error path
         conn: fix hostname move on connection reuse 
         pop3: fix CAPA response termination detection
         libssh: properly free sftp_attributes
         openssl: fix a potential memory leak of params.cert


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:urlapi: avoid null deref if setting blank host to url
         urlapi: skip appending NULL pointer query


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-26
changelog:
  - Type:CVE
  - CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224
  - SUG:NA
  - DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:formdata: validate callback is non-NULL before use
         tftp: correct the filename length check


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-28
changelog:
  - Type:CVE
  - CVE:CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
  - SUG:NA
  - DESC:fix CVE-2026-1965 CVE-2026-3783 CVE-2026-3784


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-29
changelog:
  - Type:CVE
  - CVE:CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168
  - SUG:NA
  - DESC:fix CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-4
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:delete report url added by other upstream patch to keep pace with DHCP


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-5
changelog:
  - Type:CVE
  - ID:CVE-2022-2795,CVE-2022-38177,CVE-2022-38178
  - SUG:restart
  - DESC:fix CVE-2022-2795,CVE-2022-38177 and CVE-2022-38178


author: liuxingxiang <liuxingxinag@kylinsec.com.cn> 1.0-2
changelog:
  - KYOS-B: CSV file header modification.
  - KYOS-B: Add processing for null fields in CSV files.
  - KYOS-B: Fix the issue of abnormal writing of kernel version and compatibility information to CSV during rollback.
  - KYOS-B: When adding rollback, non kernel software package errata information is obtained and written to a CSV file (Related #63600).


author: lingsheng <lingsheng1@h-partners.com> - 2.90-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Update DNS records after pruning DHCP leases
         cache: Fix potential NULL deref in arcane situations.
         Fix potential memory leak
         Fix possible SIGSEGV in bpf.c
         allow binding mac with ip6


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.90-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix bounds checking in check_ia()
         Fix SEGV in Dbus code
         More fixes for DHCP ops in Dbus when DHCP not configured


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.90-8
changelog:
  - Type:CVE
  - CVE:CVE-2026-4890 CVE-2026-4891 CVE-2026-4892 CVE-2026-4893 CVE-2026-5172
  - SUG:NA
  - DESC:Fix NSEC bitmap parsing infinite loop
         Verify rdlen field in RRSIG packets
         Fix buffer overflow in helper.c with large CLIDs
         Fix broken client subnet validation
         Fix buffer overflow vulnerability in extract_addresses()


author: suoxiaocong <suoxiaocong@kylinos.cn> - 18.09.0-337
changelog:
  - Type:BUG
  - CVE:NA
  - SUG:NA
  - DESC:remove ifarch condition check when addding source, this causes src.rpm missing files


author: Wang Zhijiang <wangzhijiang@kylinsec.com.cn> - 2:18.09.0-346.kb2
changelog:
  - sync docker-engine 18.09.0-353 from openEuler 24.03 LTS SP3 (f:162207)
  - fix CVE-2026-33997 (v:162207)[CVE-2026-33997]
  - bump version for using golang update for bugfix (f:162207)
  - fix the installation conflict between docker-engine and containerd (f:162207)
  - fix CVE-2026-34040 (v:162207)[CVE-2026-34040]
  - rebuild for the golang version with the CVE fixed (f:162207)
  - add seccomp syscall whitelist (f:162207)
  - delete redundant characters to prevent make failure in golang 1.24 (f:162207)


author: wangkai <13474090681@163.com> - 1:2.3.20-4
changelog:
  - Fix CVE-2025-59031, CVE-2025-59032, CVE-2026-27855, CVE-2026-27856,
    CVE-2026-27857, CVE-2026-27858, CVE-2026-27859, CVE-2026-0394


author: yinbin <yinbin8@huawei.com> - 23.11-18
changelog:
  - change dpdk-* in dpdk-tools  from dynamic build to static build
  - add -s flag to remove symbols of dpdk-* in dpdk-tools


author: huangdengdui <huangdengui@huawei.com> - 23.11-19
changelog:
  Support more VLAN fields matching for hns3 and sync a bugfix
   - net/hns3: add Rx DMA address align check
   - net/hns3: support more VLAN fields matching


author: huangdengdui <huangdengui@huawei.com> - 23.11-24
changelog:
  Sync some patchs from upstreaming, includind some bugfixes, hns3 pmd
   flow rule priority feature, hns3 pmd outer VLAN flow match feature,
   and support dump reigser names and filter.
   This patch set is modified as follows:
   - net/hns3: fix cannot fully use hardware flow director table
   - net/hns3: fix error code for repeatedly create counter
   - net/hns3: support flow rule priority
   - common/nfp: use new kvargs process API
   - net/tap: use new kvargs process API
   - net/sfc: use new kvargs process API
   - kvargs: rework process API
   - net/hns3: fix variable type
   - net/hns3: fix pointer offset
   - net/hns3: fix error log
   - net/hns3: support filtering registers by module names
   - net/hns3: support reporting names of registers
   - net/hns3: refactor register dump
   - net/hns3: remove separators between register module
   - net/hns3: fix dump counter of registers
   - net/hns3: remove some basic address dump
   - telemetry: register command with private argument
   - ethdev: fix race on ports in telemetry endpoints
   - ethdev: add telemetry command for registers
   - ethdev: add report of register names and filter
   - net/hns3: support outer VLAN flow match
   - net/hns3: register VLAN flow match mode parameter
   - net/hns3: support general tunnel flow match
   - net/hns3: restrict tunnel flow rule to one header
   - net/hns3: remove ROH devices
   - net/hns3: dump queue head and tail pointer info
   - dmadev: fix potential null pointer access
   - net/hns3: verify reset type from firmware
   - ethdev: verify queue ID in Tx done cleanup


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 202308-29.kb2
changelog:
  - sync edk2 202308-32 from openEuler 24.03 LTS (f:141951)
  - fix CVE-2026-22795,CVE-2026-22796 (v:141951)[CVE-2026-22795,CVE-2026-22796]
  - fix CVE-2025-69420 (v:141951)[CVE-2025-69420]
  - fix CVE-2025-69421 (v:141951)[CVE-2025-69421]
  - fix CVE-2025-68160 (v:141951)[CVE-2025-68160]
  - fix CVE-2025-69418 (v:141951)[CVE-2025-69418]
  - fix CVE-2025-69419 (v:141951)[CVE-2025-69419]
  - fix CVE-2025-15467 (v:141951)[CVE-2025-15467]


author: fuanan <fuanan3@h-partners.com> - 0.189-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Remove unnecessary patch because this patch is contained in elfutils-0.189.tar


author: lifeifei <lifeifei@kylinos.cn> - 0.190-3
changelog:
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:add noreplace to /usr/lib/sysctl.d/10-default-yama-scope.conf


author: wangqiang <wangqiang1@kylinos.cn> - 0.190-4
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: Fix handling of corefiles with non-contiguous .so segments


author: shixuantong <shixuantong1@huawei.com> - 0.190-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:move /usr/lib64/libdebuginfod.so from debuginfod-client-devel to debuginfod-client


author: lvxiangcong <lvxiangcong@kylinos.cn> - 3.4.14-16
changelog:
  - Type:CVES
  - ID:CVE-2024-24791 CVE-2023-45288 CVE-2024-24783 CVE-2024-24785 CVE-2023-45290
       CVE-2023-39326
  - SUG:NA
  - DESC:Batch fix cves through rebuild


author: wangkai <13474090681@163.com> - 128.4.0-1
changelog:
  - Update to 128.4.0
  - Fix CVE-2024-10458 CVE-2024-10459 CVE-2024-10460 CVE-2024-10461 CVE-2024-10462
    CVE-2024-10463 CVE-2024-10464 CVE-2024-10465 CVE-2024-10466 CVE-2024-10467


author: wangkai <13474090681@163.com> - 128.5.0-1
changelog:
  - Update to 128.5.0
  - Fix CVE-2024-11691 CVE-2024-11692 CVE-2024-11694 CVE-2024-11695 CVE-2024-11696
    CVE-2024-11697 CVE-2024-11699


author: wangkai <13474090681@163.com> - 128.6.0-1
changelog:
  - Update to 128.6.0
  - Fix CVE-2025-0237 CVE-2025-0238 CVE-2025-0239 CVE-2025-0240 CVE-2025-0241
    CVE-2025-0242 CVE-2025-0243


author: wangkai <13474090681@163.com> - 128.7.0-1
changelog:
  - Update to 128.7.0
  - Fix CVE-2025-1009 CVE-2025-1010 CVE-2025-1011 CVE-2025-1012 CVE-2025-1013
    CVE-2025-1014 CVE-2025-1016 CVE-2025-1017


author: wangkai <13474090681@163.com> - 128.8.0-1
changelog:
  - Update to 128.8.0
  - Fix CVE-2024-43097 CVE-2025-1931 CVE-2025-1932 CVE-2025-1933 CVE-2025-1934
    CVE-2025-1935 CVE-2025-1936 CVE-2025-1937 CVE-2025-1938


author: wangkai <13474090681@163.com> - 128.10.0-1
changelog:
  - Update to 128.10.0
  - Fix CVE-2025-2817 CVE-2025-4083 CVE-2025-4084 CVE-2025-4087 CVE-2025-4091 CVE-2025-4093


author: baiyanjie <baiyanjie@kylinsec.com.cn> - 128.10.0-1.kb1
changelog:
  - KYOS-F: sync patch from KY3.5-2: Update resource URLs for newtab page (#24719)
  - KYOS-B: sync patch from KY3.5-2: Solve the problem that there are two firefox icons in the taskbar.(Related: #41058)
  - KYOS-B: sync patch from KY3.5-2: This version fixes the problem that the video web page cannot be opened.(Related: #46503)
  - KYOS-T: sync patch from KY3.5-2: New translation of open the profile manager.(Related: #47784)
  - KYOS-T: sync patch from KY3.5-2: Change the logo of openeuler to KylinSec.(Related: #39662)
  - KYOS-B: sync patch from KY3.5-2: Solve the problem that there are two firefox icons in the taskbar.(Related: #39548)
  - KYOS-B: sync patch from KY3.5-2: Change the official website address of the first startup.(Related: #49674)
  - KYOS-F: Modify home page (#54944)


author: wangkai <13474090681@163.com> - 128.11.0-1
changelog:
  - Update to 128.11.0
  - Fix MFSA-TMP-2025-0001: Double-free in libvpx encoder
  - Fix CVE-2025-5263 CVE-2025-5264 CVE-2025-5266 CVE-2025-5267 CVE-2025-5268 CVE-2025-5269


author: xiaowen <xiaowen@kylinsec.com.cn> - 128.11.0-1.kb1
changelog:
  - KYOS-F: Change the SPEC file to prevent gnome software from displaying the application(#79607)
  - KYOS-F: sync patch from KY3.5-2: Update resource URLs for newtab page (#24719)
  - KYOS-B: sync patch from KY3.5-2: Solve the problem that there are two firefox icons in the taskbar.(Related: #41058)
  - KYOS-B: sync patch from KY3.5-2: This version fixes the problem that the video web page cannot be opened.(Related: #46503)
  - KYOS-T: sync patch from KY3.5-2: New translation of open the profile manager.(Related: #47784)
  - KYOS-T: sync patch from KY3.5-2: Change the logo of openeuler to KylinSec.(Related: #39662)
  - KYOS-B: sync patch from KY3.5-2: Solve the problem that there are two firefox icons in the taskbar.(Related: #39548)
  - KYOS-B: sync patch from KY3.5-2: Change the official website address of the first startup.(Related: #49674)
  - KYOS-F: Modify home page (#54944)


author: wangkai <13474090681@163.com> - 128.13.0-1
changelog:
  - Update to 128.13.0
  - Fix CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030 CVE-2025-8031 CVE-2025-8032
    CVE-2025-8033 CVE-2025-8034 CVE-2025-8035


author: wangkai <13474090681@163.com> - 128.3.0-1
changelog:
  - Update to 128.3.0
  - Fix CVE-2024-9392 CVE-2024-9393 CVE-2024-9394 CVE-2024-9396
    CVE-2024-9397 CVE-2024-9398 CVE-2024-9399 CVE-2024-9400 CVE-2024-9401
    CVE-2024-9402


author: puhongyu <puhongyu@kylinsec.com.cn> - 140.11.0-1.kb1
changelog:
  - sync firefox 140.11.0-1 from openEuler 24.03 LTS (f:156506)
  - update to 140.11.0 (f:156506)
  - update to 140.10.2 (fix CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8094) (v:156506)[CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8094]
  - update to 140.10.1 (fix CVE-2026-7320, CVE-2026-7321, CVE-2026-7322, CVE-2026-7323) (v:156506)[CVE-2026-7320, CVE-2026-7321, CVE-2026-7322, CVE-2026-7323]
  - update to 140.10.0 (f:156506)
  - update to 140.9.1 (fix CVE-2026-5731, CVE-2026-5732, CVE-2026-5734) (v:156506)[CVE-2026-5731, CVE-2026-5732, CVE-2026-5734]
  - update to 140.9.0 (f:156506)
  - update to 140.8.0 (f:156506)
  - update to 140.7.0 (fix CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,CVE-2026-0891) (v:156506)[CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,CVE-2026-0891]
  - update to 140.6.0 (f:156506)
  - BuildRequires(cargo) add version constraint (f:156506)
  - update to 140.5.0 (fix CVE-2025-13012, CVE-2025-13013, CVE-2025-13014, CVE-2025-13015, CVE-2025-13016, CVE-2025-13017, CVE-2025-13018, CVE-2025-13019, CVE-2025-13020) (v:156506)[CVE-2025-13012, CVE-2025-13013, CVE-2025-13014, CVE-2025-13015, CVE-2025-13016, CVE-2025-13017, CVE-2025-13018, CVE-2025-13019, CVE-2025-13020]
  - support building with system cbindgen (f:156506)
  - build with system ldflags (f:156506)
  - Modify openEuler to https://www.kylinsec.com.cn (f:156506)
  - update to 140.4.0 (f:156506)
  - fix CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711, CVE-2025-11712, CVE-2025-11713, CVE-2025-11714, CVE-2025-11715 (v:156506)[CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711, CVE-2025-11712, CVE-2025-11713, CVE-2025-11714, CVE-2025-11715]
  - Disable use_gcc_ts marco (f:156506)
  - Update to 140.3.1 (f:156506)
  - Fix CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533 CVE-2025-10536 CVE-2025-10537 CVE-2025-9182 CVE-2025-9183 CVE-2025-9184 CVE-2025-8036 CVE-2025-8037 CVE-2025-8038 CVE-2025-8039 CVE-2025-8040 (v:156506)[CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533 CVE-2025-10536 CVE-2025-10537 CVE-2025-9182 CVE-2025-9183 CVE-2025-9184 CVE-2025-8036 CVE-2025-8037 CVE-2025-8038 CVE-2025-8039 CVE-2025-8040]
  - Modify home page (f:54944)


author: zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Firewall startup is to set CleanupModuleOnxit=yes to unload related ko when stopping firewalld service
         To reduce unnecessary loading of ebtables-related kernel modules
         fix(nm): release NM client after a timeout


author: zhengwei <zhengwei@zhengwei@kylinsec.com.cn> - 1.2.6-5.kb2
changelog:
  - sync firewalld 1.2.6-8 from openEuler 24.03 LTS (f:141929)
  - fix CVE-2026-4948 (v:141929)[CVE-2026-4948]
  - fix(icmp): fix check_icmpv6_name() to use correct IPv6 names (f:141929)
  - fix broken symbolic link after package remove (f:141929)


author: yinhongchang <yinhongchang@kylinsec.com.cn> - 1.10.2-10.kb1
changelog:
  - KYOS-F: rw bind app and add default remote.(Related: #41058)
  - KYOS-F: Add provides for install gnome-software (Related: #38372)
  - Add provides flatpak-lib
  - KYOS-F: remove default remote repo unikylin-app (#36042 #36043)


author: wangkai <13474090681@163.com> - 3.18.0-13
changelog:
  - Fix CVE-2020-24292 CVE-2020-24293 CVE-2020-24295 CVE-2021-33367
    CVE-2021-40263 CVE-2021-40266 CVE-2023-47995 CVE-2023-47997


author: wangkai <13474090681@163.com> - 2:2.11.8-1
changelog:
  - Update to 2.11.8
  - Fix CVE-2026-22852, CVE-2026-22856, CVE-2026-22859, CVE-2026-23530, CVE-2026-23531,
    CVE-2026-23532, CVE-2026-23534, CVE-2026-24491, CVE-2026-24675, CVE-2026-24676,
    CVE-2026-24679, CVE-2026-24681, CVE-2026-24682, CVE-2026-24683, CVE-2026-24684,
    CVE-2026-25997, CVE-2026-26271, CVE-2026-26986, CVE-2026-27015, CVE-2026-25941,
    CVE-2026-22855, CVE-2026-22857, CVE-2026-23533, CVE-2026-23732, CVE-2026-23883,
    CVE-2026-23884


author: wangkai <13474090681@163.com> - 2:2.11.8-3
changelog:
  - Fix CVE-2026-26955, CVE-2026-26965, CVE-2026-31806, CVE-2026-31883, CVE-2026-31885,
    CVE-2026-33984, CVE-2026-33983


author: wangkai <13474090681@163.com> - 2:2.11.8-5
changelog:
  - Fix CVE-2026-25942, CVE-2026-25952, CVE-2026-25953, CVE-2026-25954, CVE-2026-27951,
    CVE-2026-29774, CVE-2026-29775, CVE-2026-31884, CVE-2026-33985


author: hantwofish <yinbin8@huawei.com> - 1.0.2-73
changelog:
  - xdp: support XDP_STATISTICS by posix_api->getsockopt_fn
  - add SO_NUMA_ID(optname) for adapting opneGauss
  - remove the unused return variable.
  - Fix annotation errors
  - bugfix: start fail when executing the popen command for the second time in openGauss


author: yinbin <jiangheng14@huawei.com> - 1.0.2-74
changelog:
  - LOG: Optimize some log displays
  - remove: code about nobolck mode for mysql
  - interrupt: fix timeout events cannot be counted


author: yinbin <yinbin8@huawei.com> - 1.0.2-77
changelog:
  - openGauss: support kernel connnect
  - xdp: support stack bind numa
  - CFG: fix xdp iface check error
  - fix build error in 2003SP4
  - cfg: show dpdk args after dpdk_adjust_args
  - fix free null pointer when no matching device is found
  - update test/unitest/ltran/ltran_param_test.c.
  - Fix the wrong spelling description in the notes and logs
  - LWIP: adjust position of shutdown in callback of connect
  - fix socket of control thread is overwirtten due to another primary process start


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-79
changelog:
  - cfg: notify that it's unsupported, when stack_num > 1
  - fix errno == ETIMEFOUT
  - fix epoll and recv threads blocked on the same semaphore. data cannot be read in recv thread.
  - fix rpc pool leak, when thread exits
  - remove app_bind_numa check from exclude_cpus
  - openGauss: fix connection attempt failed
  - openGauss: fix gs_ctl switchover failed


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-80
changelog:
  - Connect: execute lwip connect if dst_ip and host_ip are in the same network.
  - kernerl bind: add ipv6 add check
  - openGauss unsupport_tcp_optname
  - fix a contention issue when rpc pools are added to rpc_pool_array


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-82
changelog:
  - DUMP: fix abnomal printing in the dump process.
  - SIGNAL: Adjust hijack sigal table to hijack SIGABRT SIGQUIT and delet SIGKILL
  - SIGNAL: Adjust sigaction function to keep lstack signal function executed successfully.


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-83
changelog:
  - SIGNAL: block SIGSEGV during exit process
  - Stack: unset stack_stop, while stacks exit by rpc message.
  - fix the memory leak when using strdup


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-84
changelog:
  - update gazelle max numa nodes 8
  - Protocal: fixing deathlock between protocol threads and app thread
  - Connect: fix benchmark_dws connect failed
  - RTC-mode: fix gazellectl can't print connenct info
  - add xdp tx checksum/tso offload


author: yinbin6 <yinbin8@huawei.com> - 1.0.2-85
changelog:
  - sockio: fix rpc_send coredump after RPC_MSG_EXIT
  - sockio: fix tcp_write not remove EPOLLOUT
  - fix 20.03-LTS build failed
  - sk_wait: igonre mem_thread flush signal
  - sockio: fix sendmbox full return EWOULDBLOCK
  - sockio: fix callback_tcp_send output too many at once
  - mempool: increase MEM_THREAD_MANAGER_FREE_S to avoid poll
  - sockctl: fix rtw broadcast close and shutdown
  - poll: fix do_lwip_connected_callback not delete poll kernel fd
  - sk_event: fix rtw epoll wrong event notify and remove
  - sockio: fix rtw_stack_tcp_write wrong copied_total after append
  - epoll: fix do_lwip_connected_callback
  - sk_wait: fix lwip_wait_foreach_notify coredump at startup
  - socket: fix stack_udp_readmsg return len
  - sk_wait: fix sock_wait_common_free socket: simplify calling free_count in rtw_stack_tcp_write
  - mbox: fix mbox_ring_common_free coredump when rte_ring_create failed
  - sk_wait: fix lwip_tcp_allow_send coredump
  - mempool: stop using cache when too many threads
  - mempool: fix pthread_tryjoin_np coredump when mysqld shutdown
  - mempool: mem_get_rpc add reserve limit
  - mempool: fix mbox_ring free not call recv_finish_burst
  - mempool: modify mbuf num and rpc_msg num
  - socket: fix sk_wait cannot be interrupted by signals
  - socket: fix tcp closed
  - tcp: add GAZELLE_TCP_ASYNC_RECVD      fix mbuf OOM caused by untimely sockio_peek_recv_free
  - socket: fix stack_tcp_read do not recv_finish_burst
  - socket: fix connect blocking
  - mempool: fix copy_mbuf_private
  - dfx: support sk_wait stat
  - mempool: add mem_thread_cache_flush          fix PBUF_POOL_PREINIT
  - cfg: add mem_async_mode
  - cfg: add mem_cache_max and change default rpc_msg_max
  - socket: adapt to tcp and udp
  - socket: refactor tcp and udp
  - socket: adapt to sock_event
  - socket: refactor sock_event
  - cleancode: remove get_stack_tid DPDK_PKT_BURST_SIZE PACKET_READ_SIZE
  - cleancode: remove gazelle_light_ring
  - cleancode: add GAZELLE_SAME_NODE
  - RTC: fixing program stuck while gazelle exit in multi-threads envirement


author: liuchao <liuchao173@huawei.com> - 14.1-1
changelog:
  - upgrade GDB version to 14.1:
    - GDB no longer support AiX 4.x, 5.x and 6.x. The minimum version supported is AiX 7.1.
    - GDB/MI version 1 support has been removed
    - Initial built-in support for Debugger Adapter Protocol (DAP)
    - GDB now recognizes the NO_COLOR environment variable
    - Initial support for integer types larger than 64 bits
    - Breakpoints can now be inferior-specific
    - New convenience function "$_shell", to execute a shell command and return its result.
    - Python support
    - Support for enabling or disabling individual remote target features
    - New 'no-history' stop reason
    - Support for inferior-specific breakpoints
    - The bkpt tuple, which appears in breakpoint-created notifications, and in the result of the -break-insert command can now include an optional 'inferior' field for both the main breakpoint, and each location, when the breakpoint is inferior-specific.
    - Trying to create a thread-specific breakpoint using a non-existent thread ID now results in an error
    - New "simple-values-ref-types" -list-feature value indicating how the --simple-values option in various commands take reference types into account.
    - Initial support for Scalable Matrix Extension (SME) and for Scalable Matrix Extension 2 (SME2)
    - The 'org.gnu.gdb.aarch64.pauth' Pointer Authentication feature is now deprecated in favor of the 'org.gnu.gdb.aarch64.pauth_v2' feature string
    - Support for the Ada 2022 target name symbol ('@')
    - Support for the The Ada 2022 'Enum_Rep and 'Enum_Val attributes
    - The 'list' command now accepts '.' as an argument, telling GDB to print the location around the point of execution within the current frame
    - New '%V' output format for printf and dprintf commands.
    - The printf command now limits the size of strings fetched from the inferior to the value of the 'max-value-size' setting.
    - Support for extending at configure time the default value of the 'debug-file-directory' GDB parameter via the new --additional-debug-dirs=PATHs configure option.
    - New command "info main"
    - New command "set tui mouse-events [on|off]" (on by default)
    - New command "set always-read-ctf on|off" (off by default)
    - Various new debug and maitenance commands


author: yaoxin <yao_xin001@hoperun.com> - 0.4.50-1
changelog:
  - Update to 0.4.50:
  - Core:
    * Better Gobject Introspection annotation coverage.
    * Improved error handling for gegl chain processing.
    * Added accessors for pad meta-data, to be able to show names and descriptions in UIs.
    * GeglColor: more lax parameters for g_arapm_values_cmp
    * exr-save: store 16bpc files as half, fixing gimp#10778
    * ff-load, ff-save: fix build with FFmpeg 7
    * dither: do processing in linear when all levels==2


author: Funda Wang <fundawang@yeah.net> - 9.56.1-14
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DECS: Fix CVE-2025-27830, CVE-2025-27832, CVE-2025-27833, CVE-2025-27834, CVE-2025-27835, CVE-2025-27836


author: hdliu <dev03108@linx-info.com> - 9.56.1-15
changelog:
  - Add font mappings so that the PS interpreter can rasterize Chinese content using the two fonts STKaiti-Regular and STheiti-Regular.


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 9.56.1-18.kb2
changelog:
  - sync ghostscript 9.56.1-19 from openEuler 24.03 LTS SP3 (f:163884)
  - fix CVE-2025-7462 (v:163884)[CVE-2025-7462]


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: yefeng <yefeng@kylinsec.com.cn> - 2:3.0.2-4.kb1
changelog:
  - update to version 3.0.2-4.kb1 (f:109480)
  - Fix CVE-2025-10920, CVE-2025-10922, CVE-2025-10923, CVE-2025-10924 and CVE-2025-10925 (v:109480)[CVE-2025-10920][CVE-2025-10922][CVE-2025-10923][CVE-2025-10924][CVE-2025-10925]
  - Fix CVE-2025-6035 (v:109480)[CVE-2025-6035]
  - Fix CVE-2025-5473 (v:109480)[CVE-2025-5473]
  - Fix CVE-2025-2761 (v:109480)[CVE-2025-2761]


author: zhangxiaoqi <zhangxiaoqi@kylinsec.com.cn> - 2:3.0.2-4.kb3
changelog:
  - sync patchfile from openEuler 24.03 LTS SP2(f:131294)
  - modify Epoch same as openEuler 24.03 LTS SP2(f:131294)


author: XiaoWen <xiaowen@kylinsec.com.cn> - 2:3.0.2-4.kb4
changelog:
  - Fix CVE-2026-40915 and CVE-2026-40917 (v:141898)[CVE-2026-40915,CVE-2026-40917]
  - Fix CVE-2026-4150, CVE-2026-4151, CVE-2026-4153 and CVE-2026-4154 (v:156701)[CVE-2026-4150,CVE-2026-4151,CVE-2026-4153,CVE-2026-4154]


author: fuanan <fuanan3@h-partners.com> - 2.43.0-4
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: fuanan <fuanan3@h-partners.com> - 2.43.0-7
changelog:
  - Type:CVE
  - ID:CVE-2025-48384 CVE-2025-48385 CVE-2025-48386
  - SUG:NA
  - DESC:Fix CVE-2025-48384 CVE-2025-48385 CVE-2025-48386


author: fuanan <fuanan3@h-partners.com> - 2.43.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix malformed patch:
         backport-CVE-2025-48385-bundle-uri-fix-arbitrary-file-writes-via-parameter-i.patch


author: fuanan <fuanan3@h-partners.com> - 2.43.0-9
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-27614 CVE-2025-46334 CVE-2025-46835
  - SUG:NA
  - DESC:Fix CVE-2025-27613 CVE-2025-27614 CVE-2025-46334 CVE-2025-46835


author: fuanan <fuanan3@h-partners.com> - 2.43.0-10
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patch
         config.mak.uname: set CSPRNG_METHOD to getrandom on Linux


author: fuanan <fuanan3@h-partners.com> - 2.39.1-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:enable multithreading compilation and installation,
         move Git.3pm.gz to perl-Git,avoid installation conflicts,
         change BuildRequires from pcre-devel to pcre2-devel.


author: huyubiao <huyubiao@huawei.com> - 2.39.1-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Specifying Obsoletes and Provides version numbers, prevent upgrade conflicts.
         Delete git-core-doc from git, git-core-doc is provided by git-help.


author: yanglu <yanglu72@h-partners.com> - 2.78.0-1
changelog:
  - update glib-networking version to 2.78.0:
    - disable PKCS#11 tests when GNuTLS is built without PKCS#11 support
    - fix connection tests on 32-bit systems with 64-bit time_t
    - updated translations


author: zhangzikang <zhangzikang@kylinos.cn> - 2.78.3-3
changelog:
  - backport patch:
      backport-gdbusmessage-Clean-the-cached-arg0-when-setting-the-message-body.patch
      backport-gsocketclient-Fix-a-use-after-free-in-g_socket_client_connected_callback.patch
      backport-gcontextspecificgroup-Wait-until-stop_func-is-done.patch
      backport-gresources-fix-memory-leak-from-libelf.patch


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-45
changelog:
  - nptl: initialize cpu_id_start prior to rseq registration
  - nptl: initialize rseq area prior to registration


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-52
changelog:
  - stdlib: Test using setenv with updated environ [BZ #32588]
  - Fix underallocation of abort_msg_s struct (CVE-2025-0395)
  - elf: Support recursive use of dynamic TLS in interposed malloc
  - elf: Avoid some free (NULL) calls in _dl_update_slotinfo
  - x86/string: Fixup alignment of main loop in str{n}cmp-evex [BZ #32212]
  - x86: Improve large memset perf with non-temporal stores [RHEL-29312]
  - x86_64: Fix missing wcsncat function definition without multiarch (x86-64-v4)
  - sysdeps/x86/Makefile: Split and sort tests
  - x86: Only align destination to 1x VEC_SIZE in memset 4x loop
  - elf: Fix slow tls access after dlopen [BZ #19924]
  - x86: Check the lower byte of EAX of CPUID leaf 2 [BZ #30643]
  - x86_64: Add log1p with FMA
  - x86_64: Add expm1 with FMA
  - x86_64: Add log2 with FMA
  - x86_64: Sort fpu/multiarch/Makefile


author: Luo Qiu <luoqiu@kylinsec.com.cn> - 2.38-65.kb5
changelog:
  - Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046) (v:161640)[CVE-2026-4046]
  - Document CVE-2026-4046 (v:161640)[CVE-2026-4046]
  - fix __O_CLOEXEC redefinition for sw_64 (b:161556)
  - libio: Fix ungetwc operating on byte stream [BZ #33998] (CVE-2026-5928) (v:161556)[CVE-2026-5928]
  - stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] (CVE-2026-5450) (v:161556)[CVE-2026-5450]
  - fix-cve-2026-5435 (v:161509)[CVE-2026-5435]
  - fix-CVE-2026-6238 (v:161509)[CVE-2026-6238]


author: Linux_zhang <244695981@qq.com> - 3.8.2-13
changelog:
  - fix CVE-2026-33846,CVE-2026-3833,CVE-2026-42009,CVE-2026-42010,CVE-2026-42014,CVE-2026-42015,CVE-2026-5260.


author: Xu Raoqing <609179072@qq.com> - 3.8.2-16
changelog:
  - buffers: simplify and tighten parse_handshake_header checks
  - lib/auth/psk_passwd: limit the length of the comparison
  - x509/name_constraints: fix intersecting empty constraints
  - datum, mem, str: add helper functions to steal pointers
  - mem,str,datum: rename _steal_* to _take_*
  - x509/virt-san: a small OOM-correctness fix
  - x509: add bare-bones awareness of SRV virtual SAN
  - x509/hostname-verify: make URI/SRV SAN preclude CN fallback
  - fix CVE-2026-42012


author: xuraoqing <xuraoqing@huawei.com> - 3.8.2-1
changelog:
  - update to 3.8.2
  - some API and ABI modifications, see NEWS for details
  - New option --attime to specify current time
  - libgnutls: Add a mechanism to control whether to enforce extended master secret (RFC 7627)
  - libgnutls: Add additional PBKDF limit checks in FIPS mode as defined in SP 800-132
  - libgnutls: %GNUTLS_NO_EXTENSIONS has been renamed to %GNUTLS_NO_DEFAULT_EXTENSIONS.
  - libgnutls: Add support for RFC 9258 external PSK importer.
  - libgnutls: ClientHello extensions are randomized by default,
               To make fingerprinting harder, TLS extensions in ClientHello messages are shuffled.
  - gnutls-cli: New option --starttls-name.
  - libgnutls: transparent KTLS support is extended to FreeBSD kernel.
  - libgnutls: Added support for AES-GCM-SIV ciphers (RFC 8452).
  - libgnutls: Add API functions to perform ECDH and DH key agreement.
  - libgnutls: Fix timing side-channel inside RSA-PSK key exchange(CVE-2023-5981).


author: wangshuo <wangshuo@kylinos.cn> - 1.21.4-25
changelog:
  - Type:CVE
  - CVE:CVE-2024-34158
  - SUG:NA
  - DESC:fix CVE-2024-34158
  -      optimize the names of the first two patch files


author: wangshuo <wangshuo@kylinos.cn> - 1.21.4-29
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:crypto/tls: fix Config.Time in tests using expired certificates


author: Vanient <xiadanni1@huawei.com> - 1.21.4-30
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: allow update of system stack bounds on callback from C thread


author: huzhangying <huzhangying@huawei.com> - 1.21.4-38
changelog:
  - Type:CVE
  - CVE:CVE-2025-58183,CVE-2025-58185, CVE-2025-58188, CVE-2025-58189, CVE-2025-61724
  - SUG:NA
  - DESC:fix CVE-2025-58183,CVE-2025-58185, CVE-2025-58188, CVE-2025-58189, CVE-2025-61724


author: puhongyu <puhongyu@kylinsec.com.cn> - 1.21.4-37.kb3
changelog:
  - sync golang 1.21.4-44 from openEuler 24.03 LTS (f:156548)
  - fix CVE-2026-27143,CVE-2026-27144,CVE-2026-32288,CVE-2026-27140 (v:156548)[CVE-2026-27143,CVE-2026-27144,CVE-2026-32288,CVE-2026-27140]
  - fix CVE-2026-27139,CVE-2026-27142,CVE-2026-25679 (v:156548)[CVE-2026-27139,CVE-2026-27142,CVE-2026-25679]


author: yaoxin <1024769339@qq.com> - 9.2.10-1
changelog:
  - Update to 9.2.10 for fix cves:CVE-2022-36062,CVE-2022-35957
    CVE-2022-39201,CVE-2022-31130,CVE-2022-31123,CVE-2022-39306
    CVE-2022-39307,CVE-2022-23552,CVE-2022-39324,CVE-2022-31097


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:10_linux: fix missing "ro" in kernel boot parameters
         Disable LTO


author: hanliyang <hanliyang@hygon.cn> - 1:2.12-26
changelog:
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:use confidential computing provisioned secrets for disk decryption


author: yueyuankun <yueyuankun@kylinos.cn> - 1:2.12-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:acpi: Fix out of bounds access in grub_acpi_xsdt_find_table()


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-28
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:commands/efi/tpm: Re-enable measurements on confidential computing platforms


author: Funda Wang <fundawang@yeah.net> - 1:2.12-32
changelog:
  - Type:requirement
  - CVE:NA
  - SUG:NA
  - DESC:disable fortify level based on new settings of openEuler-rpm-config


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-33
changelog:
  - Type:CVE
  - CVE:CVE-2024-45781,CVE-2024-45782,CVE-2024-56737,CVE-2024-45780,CVE-2024-45783,CVE-2024-49504,CVE-2025-0624,CVE-20
  24-45774,CVE-2024-45775,CVE-2025-0622,CVE-2025-0622,CVE-2025-0622,CVE-2024-45776,CVE-2024-45777,CVE-2025-0690,CVE-20
  25-1118,CVE-2024-45778,CVE-2024-45779,CVE-2025-0677,CVE-2025-0684,CVE-2025-0685,CVE-2025-0686,CVE-2025-0689,CVE-2025
  -0678,CVE-2025-1125
  - SUG:NA
  - DESC:fix the vulnerabilities announced on February 18th, 2025


author: Funda Wang <fundawang@yeah.net> - 1:2.12-40
changelog:
  - requirement
  - CVE:NA
  - SUG:NA
  - DESC: Disable the .package_note awfulness
  - DESC: drop duplicate list of locale files


author: mazhiguo <mazhiguo@kylinsec.com.cn> - 1:2.12-40.kb1
changelog:
  - KYOS-F: fix mkdir i386-pc (#56805)
  - KYOS-F: fix backspace in username prompt (#56805)
  - KYOS-F: add text grub entry (#56641)
  - KYOS-F:support trusted integrity measurement feature on loongarch64
  - KYOS-F: fixed version for ks6 (#54686)
  - KYOS-F: 0001-fix-simplify-standard-and-rescue-system-title.patch (#33416)
  - KYOS-F: 0002-fix-solve-the-problem-of-incorrect-display-of-the-se.patch (#33416)
  - KYOS-F: 0003-optimize-backup-and-restore-configuration-files.patch (#33416)
  - Add trusted integrity measurement feature (#31781)


author: Wang Qi <wangqi@kylinsec.com.cn> - 1:2.12-40.kb5
changelog:
  - sync grub2 2.12-47 from openEuler 24.03 LTS SP2 (f:108264)
  - commands/usbtest: Ensure string length is sufficient in usb string processing (v:108264)[CVE-2025-61661,CVE-2025-61662,CVE-2025-54771,CVE-2025-54770,CVE-2025-61663,CVE-2025-61664]
  - SW64: Enable GRUB EFI build support for sw_64 architecture (f:108264)
  - kern/riscv/efi/init: Use time register in grub_efi_get_time_ms() (f:108264)
  - fs/btrfs: Fix memory leaks (f:108264)
  - i386: Check for cpuid family when flush cache only on VIA CPUs (f:108264)
  - Revert 'grub-install: bailout root device probing' (f:108264)
  - Clear buffer for screen info (f:108264)


author: yaoxin <1024769339@qq.com> - 2.8.139-1
changelog:
  - Update to 2.8.139:
    * Minor improvement of the `SOAP_XML_IGNORENS` (ignore XML
      namespaces) logic when performing non-strict XML validation
      (`SOAP_XML_STRICT` is not enabled) when ignoring extra XML
      extensibility elements in an inbound SOAP/XML message; no
      longer produces validation errors for non-serializable XML to
      "safely" ignore, unless strict XML validation is enabled with
      `SOAP_XML_STRICT`, as expected.
    * Minor update to improve XML entity parsing within limits.
    * The wsdl2h tool with SSL/TLS enabled for https no longer
      supports legacy SSLv3, only TLS 1.0 to 1.3, this avoids
      potential TLS/SSL handshake errors.
    * Corrected a logic bug in wsdl2h for attribute/elemenet
      reference qualification for C++ class and C struct members in
      the generated header interface file for soapcpp2.


author: Funda Wang <fundawang@yeah.net> - 1.22.5-2
changelog:
  - fix CVE-2024-47538, CVE-2024-47541, CVE-2024-47542, CVE-2024-47600,
    CVE-2024-47607, CVE-2024-47615, CVE-2024-47835


author: yaoxin <yao_xin001@hoperun.com> - 1.20.3-3
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47599,CVE-2024-47613,CVE-2024-47775
    CVE-2024-47776,CVE-2024-47777,CVE-2024-47778,CVE-2024-47774
    CVE-2024-47540,CVE-2024-47602,CVE-2024-47601,CVE-2024-47603
    CVE-2024-47834,CVE-2024-47537,CVE-2024-47597,CVE-2024-47543
    CVE-2024-47596,CVE-2024-47539,CVE-2024-47546,CVE-2024-47598


author: gaobo <gaobo@kylinsec.com.cn> - 1.50.2-7.kb1
changelog:
  - Detect data disk mount points in the root directory and provide them for display in Computer. (f:55036)


author: xiaowen <xiaowen@kylinsec.com.cn> - 1.50.2-7.kb2
changelog:
  - Client async invocation of GetConnection triggering daemon socket leakage.(b:36538)
  - Detect data disk mount points in the root directory and provide them for display in Computer (f:55036)
  - Merge some memory leak patch.(f:138552)


author: xiaowen <xiaowen@kylinsec.com.cn> - 1.50.2-7.kb3
changelog:
  - sync gvfs 1.50.2-8 from openEuler 24.03 LTS (f:156527)
  - Fix CVE-2026-28295 (v:156527)[CVE-2026-28295]


author: xinghe <xinghe2@h-partners.com> - 2.9.5-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:server: 'source' interface ignored from 'default-server' directive


author: xinghe <xinghe2@h-partners.com> - 2.9.5-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:stream: Prevent mux upgrades if client connection is no longer ready


author: yanglu <yanglu72@h-partners.com> - 2.9.5-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:queues:Do not use pendconn_grab_from_px
         queues:Make sure we call process_srv_queue when leaving
         queue:Make process_srv_queue return the number of streams


author: xinghe <xinghe2@h-partners.com> - 2.9.5-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:haproxy: only tid 0 must not sleep if got signal
         server/addr: fix tune.events.max-events-at-once event miss and leak


author: yaoxin <yao_xin001@hoperun.com> - 1.14.5-1
changelog:
  - Update to 1.14.5:
    * Added signed Windows msi binary and signed Apple dmg binary files.
    * Moved examples to the HDF5Examples folder in the source tree.
    * Added support for using zlib-ng package as the zlib library
    * Disable CMake UNITY_BUILD for hdf5
    * Removed "function/code stack" debugging configuration option
    * Added configure options for enabling/disabling non-standard programming language features
    * Added the CMake variable HDF5_ENABLE_ROS3_VFD to the HDF5 CMake config
      file hdf5-config.cmake. This allows it to easily detect if the library
      has been built with or without read-only S3 functionality.
    * Fixed many CVE:
      CVE-2024-29157,CVE-2024-29158,CVE-2024-29159,CVE-2024-29160,CVE-2024-29161,CVE-2024-29162
      CVE-2024-29163,CVE-2024-29164,CVE-2024-29165,CVE-2024-29166,CVE-2024-32605,CVE-2024-32606
      CVE-2024-32607,CVE-2024-32608,CVE-2024-32609,CVE-2024-32610,CVE-2024-32611,CVE-2024-32612
      CVE-2024-32613,CVE-2024-32614,CVE-2024-32615,CVE-2024-32616,CVE-2024-32617,CVE-2024-32618
      CVE-2024-32619,CVE-2024-32620,CVE-2024-32621,CVE-2024-32622,CVE-2024-32623,CVE-2024-32624
      CVE-2024-33873,CVE-2024-33874,CVE-2024-33875,CVE-2024-33876,CVE-2024-33877,CVE-2018-13871
      CVE-2018-13875,CVE-2018-14034


author: Funda Wang <fundawang@yeah.net> - 1.14.5-2
changelog:
  - add patches from azure linux for fixing CVE-2025-2153, CVE-2025-2310,
    CVE-2025-2914, CVE-2025-2926, CVE-2025-6816, CVE-2025-2925,
    CVE-2025-2924, CVE-2025-44905, CVE-2025-6269, CVE-2025-6750,
    CVE-2025-6857, CVE-2025-7067, CVE-2025-7068, CVE-2025-6858,
    CVE-2025-2923, CVE-2025-2913, CVE-2025-6516, CVE-2025-6818,
    CVE-2025-6817, CVE-2025-6856, CVE-2025-7069


author: chengyechun <chengyechun1@huaiwe.com> - 2.4.58-2
changelog:
  - Type:CVE
  - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
  - SUG:NA
  - DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream


author: zhangyaqi <zhagnyaqi@kylinos.cn> - 2.4.58-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:allocate a heap buffer if the configured size is greater than the stack-allocated buffer.


author: chengyechun <chengyechun1@huawei.com> - 2.4.58-6
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: xingwei <xingwei14@h-partners.com> - 2.4.58-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mod_log_config: Fix LogFormat directive merging
         Fix X509 leak and Increase MAX_CONCURRENCY hard limit
         mod_proxy_balancer: Fix the handling of the stickysession
         mod_cache_socache: Fix possible crash on error path
         mod_ssl: Check SSL_CTX_new() return value
         core: Report invalid Options argument when parsing AllowOverride directives


author: yanglu <yanglu72@h-partners.com> - 2.4.58-10
changelog:
  - Type:CVE
  - CVE:CVE-2025-49812,CVE-2025-23048,CVE-2024-47252,CVE-2024-43204,CVE-2024-42516
  - SUG:NA
  - DESC:fix CVE-2025-49812 CVE-2025-23048 CVE-2024-47252 CVE-2024-43204 CVE-2024-42516
         mod_lua: Fix memory handling in output filters.
         Fix a regression that caused stickysession keys
         avoid ap_set_content_type when processing a _Request_Header
         set_cookie_name: ensure correct format


author: tangce <tangce1@h-partners.com> - 2.4.58-11
changelog:
  - Type:CVE
  - CVE:CVE-2025-58098,CVE-2025-65082,CVE-2025-66200
  - SUG:NA
  - DESC:fix CVE-2025-58098,CVE-2025-65082,CVE-2025-66200


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 2.4.58-12.kb2
changelog:
  - sync httpd 2.4.58-15 from openEuler 24.03 LTS (f:156505)
  - fix CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032 (v:156505)[CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032]
  - fix CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059 (v:156505)[CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059]
  - fix CVE-2026-28780 (v:156505)[CVE-2026-28780]


author: wujichao <wujichao1@huawei.com> - 2.1.5-12
changelog:
  - Type: update
  - ID: NA
  - SUG: NA
  - DESC: combine ten similar submissions into one(0125-fix-clang-build-error.patch) and Upgrade from upstream


author: jingxiaolu<lujingxiao@huawei.com> - 2.1.5-18
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: sync patches from upstream for refactoring sandbox and bugfixing


author: Funda Wang <fundawang@yeah.net> - 50.0-14
changelog:
  - adopt to new cmake macro
  - migrated to SPDX license
  - drop useless setup macro, cause it duplicates with autosetup
  - drop useless ldconfig_scriptlets, it has been done through glibc's
    filetriggers since openeuler 1.0


author: Xinghai Cen <cenxinghai@h-partners.com> - 50.0-17
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: Fix coredump during QP destruction when send_cq == recv_cq


author: Donghua Huang <huangdonghua3@h-partners.com> - 50.0-32
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libhns: Increase input parameter checks and adjust inline data size.


author: zhangxingrong <zhangxingrong@uniontech.com> - 3.16-4
changelog:
  - iperf3 now builds correctly on architectures without native support for 64-bit atomic types, by linking with the libatomic library


author: wangkai <13474090681@163.com> - 3.17.1-1
changelog:
  - Update to 3.17.1
  - iperf3 no longer changes its current working directory in --daemon mode. This results in more 
    predictable behavior with relative paths, in particular finding key and credential files for authentication.
  - A new --json-stream option has been added to enable a streaming output format, consisting of 
    a series of JSON objects (for the start of the test, each measurement interval, and the end of the test) separated by newlines
  - UDP tests now work correctly between different endian hosts
  - The --fq-rate parameter now works for --reverse tests
  - The statistics reporting interval is now available in the --json start test object


author: gaoxingwang <gaoxingwang1@huawei.com> - 1:6.1.0-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix testsuite build failure and delete libcap-devel dependency


author: xinghe <xinghe2@h-partners.com> - 1:6.6.0-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:ss: fix expired time format of timer
         route: filter by interface on multipath routes
         lib: names: check calloc return value in db_names_alloc
         remove redundant patches


author: yanglu <yanglu72@h-partners.com> - 1.8.9-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:ebtables translate Print flush command after parsing is finished
         fix crash when opts isn't reallocated
         Fix handling of non-existent chains
         nft: Special casing for among match in compare_matches
         extensions: libipt_icmp: Fix confusion between 255/255 and any
         Revert libiptc: fix wrong maptype of base chain counters on restore
         extensions: Fix checking of conntrack --ctproto 0
         libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks
         libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK
         libiptc: Fix for another segfault due to chain index NULL pointer


author: liweigang <liweiganga@uniontech.com> - 1.8.9-5
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libxtables: Fix memleak of matches' udata
          xshared: Fix parsing of empty string arg in '-c' option


author: yanglu <yanglu72@h-partners.com> - 1.8.9-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:extensions:recent:Fix format string for unsigned values
         nft:cmd:Init struct nft_cmd::head early


author: Autistic_boyya <wangzhongyi7@huawei.com> -1:1.8.0.432.b06-1
changelog:
  - modified 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - modified 8193682-Infinite-loop-in-ZipOutputStream.close.patch
  - modified 8313626-C2-crash-due-to-unexpected-exception-control.patch
  - modified Backport-8318889-Backport-Important-Fixed-Issues-in-Later-Ver.patch
  - modified GCC-12-reports-some-compiler-warnings.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - deleted 8278794-Infinite-loop-in-DeflaterOutputStream.finish.patch
  - add Backport-8057910-G1-BOT-verification-should-not-pass.patch
  - add Backport-8069330-and-adapt-G1GC-related-optimization.patch
  - add SA-redact-support-password.patch


author: kuenking111 <wangkun49@huawei.com> -1:1.8.0.432.b06-2
changelog:
  - modified add-Fix-aarch64-runtime-thread-signal-transfer-bug.patch
  - add 8253072-XERCES-version-is-displayed-incorrect.patch
  - add 8159461-8288556-getComponentType.patch
  - add 8136926-phi-NULL-assert-in-PhaseIdealLoop-try_move_s.patch
  - add 8269934-RunThese24H.java-failed-with-EXCEPTION_ACCES.patch


author: DXwangg <wangjiawei80@huawei.com> -1:1.8.0.452.b09-0
changelog:
  - update to 8u452
  - modified add-missing-test-case.patch
  - modified GCC-12-reports-some-compiler-warnings.patch


author: herengui <herengui@kylinsec.com.cn> - 1:1.8.0.452.b09-2.kb1
changelog:
  - KYOS-F: Enabling ShangMi Support for LoongArch64 (#47864)
  - KYOS-F: Support SM2/3/4 algorithms (#31880)
  - KYOS-F: Add a test suite for ShangMi. (#34885)


author: yangyingqing <yangyingqing@h-partners.com> - 1:11.0.27.6-0
changelog:
  - update to 11.0.27+6(GA)
  - delete 8347965-tz-Update-Timezone-Data-to-2025a.patch
  - add fix-potential-build-fail-in-jbolt.patch


author: herengui <herengui@kylinsec.com.cn> - 1:11.0.27.6-1.kb1
changelog:
  - KYOS-F: Enabling ShangMi Support for LoongArch64 (#47864)
  - KYOS-F: Delete the useless files generated during the adaptation of ShangMi.
  - KYOS-F: Support SM2/3/4 algorithms (#34887)


author: yinsist <jianhui.oerv@isrc.iscas.ac.cn> - 1.6-4
changelog:
  - Valgrind does not support certain architectures like RISC-V, Before depending on Valgrind, first check if Valgrind supports the architecture


author: yaoxin <1024769339@qq.com> - 1.8.0-4
changelog:
  - Fix CVE-2026-40612,CVE-2026-41256,CVE-2026-41257,CVE-2026-43894,
    CVE-2026-43895,CVE-2026-43896 and CVE-2026-44777


author: Wang Zhijiang <wangzhijiang@kylinsec.com.cn> - 3.2.0-7.kb2
changelog:
  - sync kata-containers 3.2.0-22 from openEuler 24.03 LTS (f:156748)
  - fix CVE-2026-47243 (v:156748)[CVE-2026-47243]
  - bump version for using golang update for bugfix (f:156748)
  - fix the problem of self-compilation failure in the kata-containers source package (f:156748)
  - modify the git clone download address in kata_integration_clone (f:156748)
  - add the conflict with kata-containers-go (f:156748)
  - fix CVE-2026-33186 (v:156748)[CVE-2026-33186]
  - rebuild for the golang version with the CVE fixed (f:156748)
  - fix CVE-2026-24054 (v:156748)[CVE-2026-24054]
  - fix CVE-2025-65637 (v:156748)[CVE-2025-65637]
  - fix the problem of missing kata-containers source code in the src package (f:156748)
  - fix the missing secure compilation option (f:156748)
  - fix build check for kata-containers (f:156748)
  - fix build error for kata-containers (f:156748)
  - fix build error for kata-containers on loongarch64 (f:156748)
  - runtime: 9p use cache=none (f:156748)


author: yangfeng <yangfeng@kylinsec.com.cn> - 2.6.1-17
changelog:
  - KYOS-B: fix the graphical and network hardware info no display problem.(#37289)
  - KYOS-B: Remove the duplicate graphical and network hardware info.
  - KYOS-B: The shutdown shortcut cannot be found.(#44337)
  - KYOS-B: fix compile error
  - KYOS-F: add shutdown keybinding


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.1-18
changelog:
  - KYOS-B: Fixed the issue where Unglab was not executed in a timely manner, causing subsequent Xclient connections to XServer to fail


author: yangfeng <yangfeng@kylinsec.com.cn> - 2.6.1-20
changelog:
  - KYSO-B: Fix the ntp service load order logic error
  - KYSO-B: Fix std::regex can not run in gcc version < 4.9(#48386)
  - KYSO-F: Use glibmm's regex to replace glib's regex


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.1-21
changelog:
  - KYOS-B: Fix the issue where switching between light and dark themes does not work in Gnome 41 and later versions.(#35120)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.1-22
changelog:
  - Fix crash caused by the previous commit due to the existence of a schema but the absence of a color-schema (#35120)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.1-24
changelog:
  - KYOS-F: Decrease the priority of override file configurations(#52881)
  - KYOS-F: Marking the configuration as not to be replaced


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.1-25
changelog:
  - KYOS-B: fix the passwd command compatible problem for KY3.3-9-Server(#46550)
  - KYOS-F: Add icon and cursor theme changing when enable auto switch theme.(#73665)
  - KYOS-F: Modify gtk and icon theme to light theme defaultly.


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.2-9
changelog:
  - KYOS-B: shared Networks Add Configuration Invisible(#51089)
  - KYOS-B: Fix the message that the tray service is not registered when the tray is registered.(#50967)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.2-10
changelog:
  - KYOS-B: Fixes an issue with determining connection and NIC Mac configuration matches when a connection configuration change is active(#51089)
  - KYOS-B: Fix the message that the tray service is not registered when the tray is registered.(#50967)
  - KYOS-B: shared Networks Add Configuration Invisible (#51089)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.2-13
changelog:
  - KYOS-F: Fix the problem of getting the return value of a device via NetworkManager DBus interface under stress test(#70121)


author: yuanxing <yuanxing@kylinsec.com.cn> - 2.6.3-1
changelog:
  - KYOS-F:Fix the problem of web details supporting large layouts.(#72894)
  - KYOS-F:improve code in group plugin.(#73623)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.4-1.kb1
changelog:
  - KYOS-F: Supports Meta and Window theme settings(#73665)
  - KYOS-F: Support for sound testing(#73668)
  - KYOS-B: compatible with different versions of open-source cursor to prevent program crashes(#IBV1XG)
  - KYOS-F: Split Screensaver and locking concepts, add support for embedded xscreensaver(#73664)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.4-2.kb1
changelog:
  - KYOS-B: Fix crash when ipv6 address can't be retrieved(#75993)
  - KYOS-F: Supports dimming the monitor during idle time(#76040)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.4-3.kb1
changelog:
  - KYOS-B: hide the option to dim when general settings are idle(#76040)
  - KYOS-B: Fix incorrect icon color for more options
  - KYOS-B: Network connectivity checking is not enabled by default(#77265)
  - KYOS-B: Fix monitor dimming translation when idle(#76040)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.0-18
changelog:
  - Fix the issue that executing the post script twice causes the touchpad backend plugin to be disabled


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.0.22.kb1
changelog:
  - KYOS-F: Setting the default white theme for the desktop version
  - KYOS-F: Override configuration, split screen saver as well as lock screen(#73664)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.6.0-2.kb1
changelog:
  - KYOS-B: Fix style error of install and launch button on gnome-software
  - KYOS-F: distinguish icon and cursor theme for meta theme.


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.5.1-16
changelog:
  - KYOS-F: Support default preferred login user configurable(#47534)
  - KYOS-B: fix crash in xserver without randr (#41284)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.5.1-18
changelog:
  - KYOS-B: Fix the crash caused by receiving two signals from Polkit completion(#49904)
  - KYOS-B: When disabling all power settings, the power button should not be displayed(#49764)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.5.2-3.kb1
changelog:
  - KYOS-F: greeter and unlock dialog support fullname(#40540)
  - KYOS-F: Add detection for whether to install a virtual keyboard


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.2.3-12.kb3
changelog:
  - KYOS-B: Fix the problem of closing the screensaver window in idle shutdown/logout process after locking the screen
  - rebuild for KiranUI-2.6-next


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 2.2.4-1.kb1
changelog:
  - KYOS-B: fix sonarqube scanning problem.
  - KYOS-B: Fix conflict with Display dims when idle
  - KYOS-F: Support XEmbed Screensaver theme(#78377,#73664)


author: caixiaomeng <caixiaomeng2@huawei.com> - 1:0.9.9-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:remove .export_symbol section newly added in 6.6 kernel to avoid compile error


author: fanliwei <fanliwei@kylinsec.com.cn> - 3.0.0-8
changelog:
  - KYOS-F: fix highversion log error. (Related #29348)
  - rebuild for KY3.4-4-PG-ks-ha-3.0.0. (Related #29348)


author: xiaowen <xiaowen@kylinsec.com.cn> - 2.7.9-30
changelog:
  - KYOS-F: Add a method to retrieve system information using the ks-showinfo command (#55232)
  - KYOS-F: Privatize the zlog configuration file.


author: xiaowen <xiaowen@kylinsec.com.cn> - 2.7.10-1
changelog:
  - KYOS-F: Add three machine types: virtual server, virtual desktop, and virtual industrial control.
  - KYOS-F: Add command parameters and tools to obtain machine codes and activation codes in rescue mode.
  - KYOS-F: Add command ksl-emergency


author: wangyucheng<wangyucheng@kylinsec.com.cn> - 1.3.17-5
changelog:
  - KYOS-B: fix(reboot-key-binding):fix centos6 reboot-key-binding issue(#54772 #54765)
  - KYOS-B: fix(audit-logrotate-rotate):fix period reset failure(#54624)
  - KYOS-B: fix(logrotate):fix parameters are not for global issues(#54638)
  - KYOS-B: fix(translations): Fixed the bug that the report was not translated(#54632)
  - KYOS-F: feature(br): fix bug that rollback to the initial state does not take effect(#54687)
  - KYOS-F: feature(br): Fixed the issue that getpwent returned NULL(#54749)
  - KYOS-F: feature(reboot-key-binding):Fix the issue that the centos8 reboot-key-binding cannot be reinforced(#55034)
  - KYOS-F: feature(vulnerability): Fixed bug that the backup was stuck(#54932)


author: wangyucheng<wangyucheng@kylinsec.com.cn> - 1.3.18-1
changelog:
  - KYOS-B: feature(reboot-keybinding): If the initial state of gconf is empty, the restore should also be empty
  - KYOS-B: feature(br): fix bug that failed to stop auditd
  - KYOS-B: feature(br): fix bug that failed to rollback dmesg reinforcement.
  - KYOS-B: fix(br):fix the status is wrong after cancellation.
  - KYOS-B: feature(doc):update help.pdf


author: wangyucheng <wangyucheng@kylinsec.com.cn> - 1.3.18-2
changelog:
  - KYOS-B: feature(vulnerability): remove unused code.
  - KYOS-B: rebuild for Kylinsec-V6.
  - KYOS-B: feature(*): adapts Kylinsec-V6.


author: wangyucheng <wangyucheng@kylinsec.com.cn> - 1.3.18-4
changelog:
  - KYOS-F: fix(sonarqube): fix some error from sonarqube.
  - KYOS-F: feature(*): add compile switch for disable actived & gui.
  - KYOS-F: fix(runtime): set env gio/module path in centos6.


author: shenzhongwei <shenzhongwei@kylinos.cn> - 1.29.1-10
changelog:
  - TypeLbugfix
  - CVE:NA
  - SUG:NA
  - DECS:remove the architecture judgment in the patches section;
         include all patches in the source package.


author: zhongtao<zhongtao17@huawei.com> - 2.1.4-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add enable pod events field and Add oomkilled field in inspect.json


author: bizhiyuan <bizhiyuan@kylinos.cn> - 4.13.0-23
changelog:
  - aws-vpc-move-ip/aws-vpc-route53/awseip/awsvip: add auth_type parameter and AWS Policy based authentication type


author: zhangyao <zhangyao108@huawei.com> - 2.39.1-15
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: backport community patches
          backport-sys-utils-setpriv-fix-potential-memory-leak.patch
          backport-sys-utils-save_adjtime-fix-memory-leak.patch
          backport-wall-fix-possible-memory-leak.patch
          backport-suL-fix-use-after-free-on-error.patch


author: yuanchicheng <chicheng.oerv@isrc.iscas.ac.cn> - 2.39.1-17
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: backport community patches
          backport-lscpu-add-riscv-cputype-support.patch


author: zhangyao <zhangyao108@huawei.com> - 2.39.1-19
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: backport community patches
         [add] backport-libblkid-fix-spurious-ext-superblock-checksum-mismat.patch
         backport-libblkid-fix-potential-memory-leaks.patch
         backport-sys-utils-fix-add-NULL-check-for-mnt_fs_get_target-r.patch
         backport-sulogin-fix-POSIX-locale-use.patch
         backport-setpriv.c-fix-memory-leak-in-parse_groups-function.patch
         backport-whereis-avoid-accessing-uninitialized-memory.patch
         backport-dmesg-fix-notime-use.patch


author: zhangting <dev03303@linx-info.com> - 2.39.1-20
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: fix an issue that mkfs.bfs fix memory leak
  	mkfs.bfs-fix-memory-leaks-and-weak-code.patch


author: hugel <gengqihu2@h-partners.com> - 2.39.1-21
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:revert community patch
         [del] backport-libblkid-fix-spurious-ext-superblock-checksum-mismat.patch


author: wangzhiqiang <swangzhiqiang95@huawei.com> - 3.0.4-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Add BDPluginSpec constructor and use it in plugin_specs_from_names


author: tianmuyang <tianmuyang@huawei.com> 2:1.2.2-11
changelog:
  - Adaption for sched type eBPF program:
    backport-libbpf-Adaption-for-sched-type-eBPF-program.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:0.8.1-11
changelog:
  - backport patches from upstream:
    backport-libbpf-Fix-realloc-API-handling-in-zero-sized-edge-cases.patch
    backport-libbpf-Set-close-on-exec-flag-on-gzopen.patch
    backport-libbpf-Fix-is_pow_of_2.patch
    backport-libbpf-make-RINGBUF-map-size-adjustments-more-eagerly.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:1.2.2-2
changelog:
  - backport patches from upstream:
    backport-libbpf-Fix-NULL-pointer-dereference-in_bpf_object__c.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:1.2.2-4
changelog:
  - backport patch from upstream:
    backport-libbpf-Avoid-uninitialized-value-in-BPF_CORE_READ_BI.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:1.2.2-5
changelog:
  - backport patch from upstream:
    backport-libbpf-Add-NULL-checks-to-bpf_object__prev_map,next_.patch
    backport-libbpf-Apply-map_set_def_max_entries-for-inner_maps-.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:1.2.2-6
changelog:
  - backport patch from upstream:
    backport-libbpf-Dont-take-direct-pointers-into-BTF-data-from-.patch


author: zhangmingyi <zhangmingyi5@huawei.com> 2:1.2.2-8
changelog:
  - backport patch from upstream:
    backport-libbpf-Do-not-resolve-size-on-duplicate-FUNCs.patch
    backport-libbpf-Fix-bpf_object__open_skeleton-s-mishandling-o.patch
    backport-libbpf-Fix-segfault-due-to-libelf-functions-not-sett.patch
    backport-libbpf-Fixed-getting-wrong-return-address-on-arm64-a.patch
    backport-libbpf-fix-sym_is_subprog-logic-for-weak-global-subp.patch
    backport-libbpf-move-global-data-mmap-ing-into-bpf_object__lo.patch


author: yaoxin <yao_xin001@hoperun.com> - 1.27.4-1
changelog:
  - Update to 1.27.4 for fix CVE-2024-6381 and CVE-2024-6383
  - libbson Fixes:
    * Fix build with Visual Studio 2013.
    * Fix parsing of colon in timezone.
    * Error on failure to init subdocument in bson_iter_visit_all.
    * Fix string handling in bson_string_new and bson_string_append.
    * Fix iteration in bson_strfreev.
    * Use aligned alloc for bson_array_builder_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Fix conversion warning with GCC 12.
    * Fixes to some format strings in trace logs.
    * Allow mongoc_buffer_t to be larger than INT_MAX.
    * Add bson_array_builder_t.
  - libmongoc Fixes:
    * Fix possible crash reading malformed wire protocol message.
    * Upgraded bundled Zlib from 1.2.3 to 1.3.1
    * Close leftover connections to removed servers.
    * Fix possible crash when client is configured with empty password.
    * Fix possible hang if mongoc_gridfs_file_readv is called with a corrupt chunk with incomplete data.
    * Fix 32-bit compile with 64-bit time_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Disable shared libmongoc targets if ENABLE_SHARED=OFF
    * Fix documentation build with Python 3.9.
    * Fix data race in mongoc_cursor_get_host.
    * Add back support for BUILD_VERSION CMake option. BUILD_VERSION was unintentionally removed in 1.25.0.
    * Send recoveryToken in transactions when connected to a load balancer.


author: yanglongkang <yanglongkang@h-partners.com> - 2.69-3
changelog:
  - backport upstream patches:
    getpcaps: fix program name in help message
    Stop using _pam_overwrite() in pam_cap.c


author: chenhaixing <chenhaixing@huawei.com> - 0.70.2-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libdnf:Avoid reinstalling installonly packages marked for ERASE
                Fix utimes error message in dnf-repo
                Do not download repository if our local cache is up to date in dnf-repo
                python bindings:Load all modules with RTLD_GLOBAL


author: liuxingxiang <yefeng@kylinsec.com.cn> - 0.70.2-6.kb1
changelog:
  - Modify loongarch64 patch use all arch. (Relate:#33003)
  - add lost patch:0001-libdnf-0.65.0-add-loongarch-support.patch. (Relate:#33003)


author: shixuantong <shixuantong1@huawei.com> - 3.4.4-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix x86/ffi64 calls with 6 gp and some sse registers
         Robustify floating point comparison in test
         Fix floating point compare


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 1.10.2-3.kb1
changelog:
  - sync libgcrypt 1.10.2-3.oe2403 from openEuler 24.03 LTS (f:156521)
  - fix CVE-2026-41989 (v:156521)[CVE-2026-41989]


author: wangkai <13474090681@163.com> - 2.5.31-3
changelog:
  - Fix CVE-2026-40334, CVE-2026-40334, CVE-2026-40338, CVE-2026-40339,
    CVE-2026-40340, CVE-2026-40341


author: Kai Liu <kai.liu@windriver.com> - 1:1.49.5-5
changelog:
  - Replace patch support_OPENEULER_to_configure.patch by backport-support-openEuler.patch
    which is backported from upstream, fix issue of detecting openEuler.
  - Add provide-openEuler-appliance-package-list.patch after correctly detected openEuler.
    It was using REDHAT list before.


author: xinghe <xinghe2@h-partners.com> - 8.17.2-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:extending the certificate validate period
         remove redundant patches


author: xinghe <xinghe2@h-partners.com> - 2:1.6.40-2
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


author: yangfeng <yangfeng@kylinsec.com.cn> - 2:1.6.40-12.kb1
changelog:
  - sync libpng 1.6.40-12 from openEuler 24.03 LTS (f:156477)
  - fix CVE-2026-40930 patch error (v:156477)[CVE-2026-40930]
  - fix CVE-2026-40930 (v:156477)[CVE-2026-40930]
  - fix CVE-2026-3713 (v:156477)[CVE-2026-3713]
  - fix CVE-2026-34757 (v:156477)[CVE-2026-34757]
  - fix CVE-2026-33416 CVE-2026-33636 (v:156477)[CVE-2026-33416,CVE-2026-33636]


author: xinghe <xinghe2@h-partners.com> - 2.74.3-4
changelog:
  - Type:cves
  - ID:CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
  - SUG:NA
  - DESC:fix CVE-2024-52530 CVE-2024-52531 CVE-2024-52532


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-5
changelog:
  - Type:cves
  - ID:CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784
  - SUG:NA
  - DESC:fix CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-7
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-10
changelog:
  - Type:cves
  - ID:CVE-2025-4476 CVE-2025-4948 CVE-2025-4969
  - SUG:NA
  - DESC:fix CVE-2025-4476 CVE-2025-4948 CVE-2025-4969


author: nickyang <nickyang228@163.com> - 2.74.3-12
changelog:
  - Type:cves
  - ID:CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716
  - SUG:NA
  - DESC:fix CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716


author: nickyang <nickyang228@163.com> - 2.74.3-13
changelog:
  - Type:cves
  - ID:CVE-2026-1760 CVE-2026-1801 CVE-2026-2369
  - SUG:NA
  - DESC:fix CVE-2026-1760 CVE-2026-1801 CVE-2026-2369


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-5
changelog:
  - Type:CVE
  - Id:CVE-2025-4877 CVE-2025-4878 CVE-2025-5351 CVE-2025-5987 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877CVE-2025-4878CVE-2025-5351CVE-2025-5987CVE-2025-5372


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-9
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:fix CVE-2026-0968 CVE-2026-0967 CVE-2026-0966 CVE-2026-0965 CVE-2026-0964 CVE-2025-14821


author: renmingshuai <renmingshuai@huawei.com> - 0.10.5-2
changelog:
  - Type:CVE
  - Id:CVE-2023-6004,CVE-2023-48795,CVE-2023-6918
  - SUG:NA
  - DESC:fix CVE-2023-6004,CVE-2023-48795 and CVE-2023-6918


author: yueyuankun<yueyuankun@kylinos.cn> - 1.11.0-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add patch to work around strict permissions issues for sshd tests


author: zhangbinqin <zhangbinqin@h-partners.com> - 1.11.0-6
changelog:
  - Type:CVE
  - CVE:CVE-2026-7598
  - SUG:NA
  - DESC:add username_len bounds checking to fix CVE-2026-7598


author: JiaboFeng <fengjiabo1@huawei.com> - 9.10.0-14
changelog:
  - Bugfix: Enhance the capability to trace the shutdown status of large VMS
  - conf: qemu: support provide inject secret for Hygon CSV
  - conf: qemu: add libvirt support reuse id for hygon CSV
  - Automatically unbind all devices' driver under same root port and bind to vfio-pci in the context of CVM.
  - Consistent coding style with opensource.
  - build: Make daemons depend on generated *_protocol.[ch]
  - Add the get tmm memory info API into libvirt-host. Also should add the RPC calls into libvirtd for API calling.
  - Add cvm parameter into the type of LaunchSecurity which is a optional filed for libvirt xml


author: fangyi <eric.fangyi@huawei.com> - 9.10.0-15
changelog:
  - cpu-Add-new-Dharma-CPU-model.patch
  - qemu-cvm-support-uefi-boot-by-rom.patch
  - iommufd-Support-configuring-iommufd-backends-for-qem.patch
  - vdpa-iommufd-Support-associating-iommufd-with-vDPA-h.patch
  - capabilities-add-fun-to-determine-if-binary-is-strat.patch
  - qemu_command-unsupport-command-line-will-not-built-f.patch
  - chardev-use-path-instead-of-fd-for-stratovirt.patch
  - Revert-qemu-command-Delegate-qemuBuildDriveStr-to-SD.patch
  - Revert-qemu-Remove-pre-blockdev-PFLASH-setup.patch
  - qemu_command-get-disk-alias-from-disk-instead-of-nod.patch


author: JiaboFeng <fengjiabo1@huawei.com> - 9.10.0-17
changelog:
  - Revert "Automatically unbind all devices' driver under same root port and bind to vfio-pci in the context of CVM."


author: PengruiZhang <zhangpengrui@huawei.com> - 9.10.0-18
changelog:
  - add qemu VIRTCCA capability detection
  - add virtcca test xml
  - virtcca use hugepage disable bind numa
  - util: resctrl: add parsing process for the new parameters cache id
  - util:resctrl:add L3 priority parse and format method
  - conf: add support for cachetune/L3 priority
  - util: resctrl: define memory bandwidth types & add parse and format method
  - conf: add support for memorytune XML processing for MB hardlimit
  - conf: add support for memorytune XML processing for MB priority
  - conf: add support for memorytune XML processing for MB min_bandwidth
  - [backport]domcaps: Report launchSecurity
  - [backport]qemu: Fill launchSecurity in domaincaps
  - [v4-1-4]src: Add ARM CCA support in qemu driver to launch VM
  - [v4-2-4]src: Add ARM CCA support in domain capabilities command
  - [v4-3-4]src: Add ARM CCA support in domain schema
  - hostdev: add numa configure for host pci device


author: PengruiZhang <zhangpengrui@huawei.com> - 9.10.0-19
changelog:
  - Fix the translation problem of libvirtd.policy's prompts.
  - cpu: Add new Chengdu CPU model
  - util:resctrl:add L3 min/max parse and format method
  - conf: add support for cachetune/L3 min/max
  - conf: add support for hugepage hugepage pod
  - backends:add support of one guest numa node alloc memory from multi host nodes
  - migration: support vfio-pci device migration


author: Funda Wang <fundawang@yeah.net> - 2.11.5-5
changelog:
  - Type:CVE
  - CVE:CVE-2024-56171
  - CVE:CVE-2025-24928
  - CVE:CVE-2025-27113
  - SUG:NA
  - DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113


author: Funda Wang <fundawang@yeah.net> - 2.11.5-6
changelog:
  - Type:CVE
  - CVE:CVE-2025-32414
  - CVE:CVE-2025-32415
  - SUG:NA
  - DESC: fix CVE-2025-32414, CVE-2025-32415


author: hankangkang <hankangkang5@huawei.com> - 2.2.0-62
changelog:
  - When the GAZELLE_TCP_REUSE_IPPORT is on, min_cnts_lpcb is NULL
  - Turn on the LWIP_SO-LINGER switch


author: wujichao <wujichao1@huawei.com> - 0.3-36
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:bugfix: Information in cpu directory is overwritten after lxcfs restart


author: xiejing <xiejing@kylinos.cn> - 4:10.5.25-1
changelog:
  - Bump to 10.5.25 for resolving CVE-2024-21096
  - Fix version description in systemd service file
  - Add conflict with greatsql and change requires


author: wangkai <13474090681@163.com> - 20240312-1
changelog:
  - Update to 20240312 for fix CVE-2023-38575, CVE-2023-39368,
    CVE-2023-22655, CVE-2023-43490, CVE-2023-28746


author: Funda Wang <fundawang@yeah.net> - 20240813-1
changelog:
  - update to 20240813 for fix CVE-2024-24853, CVE-2024-25939,
    CVE-2024-24980, CVE-2023-42667, CVE-2023-49141


author: Funda Wang <fundawang@yeah.net> - 20250211-1
changelog:
  - update to 2025021 for fix CVE-2024-28047, CVE-2024-31157, CVE-2024-39279,
    CVE-2024-28127, CVE-2024-29214, CVE-2024-24582, CVE-2023-34440, CVE-2024-37020,
    CVE-2024-39355, CVE-2023-43758, CVE-2024-36293, CVE-2024-31068


author: Funda Wang <fundawang@yeah.net> - 20250512-1
changelog:
  - update to 20250512 to fix CVE-2024-28956, CVE-2025-24495, CVE-2025-20012,
    CVE-2024-45332, CVE-2025-20623, CVE-2024-43420, CVE-2025-20054, CVE-2025-20103


author: Funda Wang <fundawang@yeah.net> - 20250812-1
changelog:
  - update to 20250812 to fix CVE-2025-20053, CVE-2025-20109, CVE-2025-21090,
    CVE-2025-22839, CVE-2025-22840, CVE-2025-22889, CVE-2025-24305, CVE-2025-26403,
    CVE-2025-32086


author: yaoxin <1024769339@qq.com> - 2.4.16.6-1
changelog:
  - Update to 2.4.16.6:
    * metadata: fix caching of JWKs from jwks_uri when using the default expiry setting
    * info: fix requests to the info hook with extend_session=false
    * cookie: OIDCCookieSameSite default behaviour Lax
    * cookie: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
    * cache: avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory
      cannot be found on the system upon initaliizing cache mutexes and the file cache
    * metadata: allow plain HTTP URLs in metadata elements jwks_uri and signed_jwks_uri to ensure backwards
      compatibility with <=2.4.15.7 and to support private/test deployments
    * code: address warnings from static code analysis tool CodeChecker


author: yaoxin <yao_xin001@hoperun.com> - 2.0.20-1
changelog:
  - Update to 2.0.20
    * Fix QoS 1 / QoS 2 publish incorrectly returning "no subscribers". Closes #3128.
    * Open files with appropriate access on Windows. Closes #3119.
    * Don't allow invalid response topic values.
    * Fix some strict protocol compliance issues. Closes #3052.
    * Fix cmake build on OS X. Closes #3125.
    * Fix build on NetBSD
    * Fix mismatched subscribe/unsubscribe with normal/shared topics.
    * Fix crash on bridge using remapped topic being sent a crafted packet.
    * Don't allow SUBACK with missing reason codes in client library.
    * Fix crash on subscribe under certain unlikely conditions. Closes #2885. Closes #2881.
    * Fix mosquitto_rr not honouring -R. Closes #2893.
    * Fix max_queued_messages 0 stopping clients from receiving messages. Closes #2879.
    * Fix max_inflight_messages not being set correctly. Closes #2876.
    * Fix mosquitto_passwd -U backup file creation. Closes #2873.


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 1.2.4-4.kb2
changelog:
  - sync musl 1.2.4-6 from openEuler 24.03 LTS (f:141877)
  - fix CVE-2026-40200, CVE-2026-6042 (v:141877)[CVE-2026-40200,CVE-2026-6042]
  - Fix ld file not found (f:141877)


author: zhangxingrong <zhangxingrong@uniontech.com> - 5:2.2.12-3
changelog:
  - Fix smtp client to respect $use_envelope_from option.
  - Fix smtp client $envelope_from_address possible dangling pointer.


author: Funda Wang <fundawang@yeah.net> - 5:2.2.12-4
changelog:
  - fix CVE-2026-43859, CVE-2026-43860, CVE-2026-43861, CVE-2026-43862,
    CVE-2026-43863, CVE-2026-43864


author: wangkai <13474090681@163.com> - 8.0.37-1
changelog:
  - Update to 8.0.37 for fix CVEs(CVE-2024-20964,CVE-2024-20971,CVE-2024-20976,
    CVE-2024-20973,CVE-2024-20978,CVE-2024-20981,CVE-2024-20962,CVE-2024-20977,
    CVE-2024-20963,CVE-2024-20965,CVE-2024-20972,CVE-2024-20961,CVE-2024-20982,
    CVE-2024-20970,CVE-2024-20967,CVE-2024-20984,CVE-2024-20974,CVE-2024-20966,
    CVE-2024-20960,CVE-2024-20985,CVE-2024-20969,CVE-2024-21000,CVE-2024-21069,
    CVE-2024-21009,CVE-2024-21087,CVE-2024-21047,CVE-2024-20998,CVE-2024-21013,
    CVE-2024-21060,CVE-2024-21008,CVE-2024-21102,CVE-2024-21054,CVE-2024-21062,
    CVE-2024-20994,CVE-2024-21096,CVE-2024-21061,CVE-2024-20993,CVE-2024-21055,
    CVE-2024-21057,CVE-2023-6129)


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: yaoxin <1024769339@qq.com> - 8.0.45-1
changelog:
  - Update to 8.0.45 for fix CVEs (CVE-2026-21936,CVE-2026-21937,
    CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968)


author: wangkai <13474090681@163.com> - 8.0.46-1
changelog:
  - Update to 8.0.46 for fix CVEs (CVE-2026-21998, CVE-2026-22001, CVE-2026-22002,
    CVE-2026-22004, CVE-2026-22005, CVE-2026-22009, CVE-2026-22015, CVE-2026-22017,
    CVE-2026-34267, CVE-2026-34270, CVE-2026-34271, CVE-2026-34276, CVE-2026-34278,
    CVE-2026-34293, CVE-2026-34303, CVE-2026-34304, CVE-2026-34308, CVE-2026-35236,
    CVE-2026-35237, CVE-2026-35238, CVE-2026-35239, CVE-2026-35240)


author: yaoxin <yao_xin001@hoperun.com> - 8.0-1
changelog:
  - Update to 8.0
    * CVE-2024-5742: Avoid privilege escalations via symlink attacks
      on emergency save file (boo#1226099)
    * By default ^F is bound to starting a forward search, and ^B to
      starting a backward search, while M-F and M-B repeat the search
      in the corresponding direction. (See the documentation if you
      want the old bindings back.)
    * Command-line option --modernbindings (-/) makes ^Q quit, ^X cut,
      ^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a file,
      ^R replace, ^G find again, ^D find again backwards, ^A set the mark,
      ^T jump to a line, ^P show the position, and ^E execute.
    * For easier access, M-" is bound to placing/removing an anchor,
      and M-' to jumping to the next anchor.


author: gaihuiying <eaglegai@163.com> - 1:5.9.3-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Customized the anti-attacki/reset-last_engineTime function for IdeaUI
         change the permissions of passtest


author: xingwei <xingwei14@h-partners.com> - 1:5.9.3-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Migration patch from upstream, add compatibility to parse
  Linux 6.7 Ip header while keep support for previous versions.


author: lingsheng <lingsheng1@h-partners.com> - 1:1.0.8-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: liweigang <liweiganga@uniontech.com> - 1:1.0.8-4
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: evaluate: guard against NULL basetype
  evaluate: error out if basetypes are different
  evaluate: reject attempt to update a set
  evaluate: release mpz type in expr_evaluate_list() error path
  expression: missing line in describe command with invalid expression
  evaluate: handle invalid mapping expressions in stateful object statements gracefully


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: disable meta set with ranges
         src: reject large raw payload and concat expressions
         evaluate: fix stack overflow with huge priority string
         tcpopt: don't create exthdr expression without datatype
         src: do not allow to chain more than 16 binops
         rule: fix ASAN errors in chain priority to textual names
         tests: shell: add regression test for double-free crash bug
         evaluate: handle invalid mapping expressions in stateful object
         evaluate: Fix incorrect checking the `base` variable in case of IPV6


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:ct expectation: fix 'list object x' vs. 'list objects in table' confusion
         tests: shell: connect chains to hook point


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         parser_json: release buffer returned by json_dumps
         parser_json: fix crash in json_parse_set_stmt_list
         parser_json: fix handle memleak from error path
         parser_json: fix several expression memleaks from error path
         libnftables: Zero ctx->vars after freeing it


author: eaglegai <eaglegai@163.com> - 1:1.0.8-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: don't allow nat map with specified protocol
         rule: return error if table does not exist
         json: make sure timeout list is initialised
         evaluate: don't update cache for anonymous chains
         json: return error if table does not exist
         json: don't BUG when asked to list synproxies
         evaluate: compact STMT_F_STATEFUL checks
         evaluate: only allow stateful statements in set and map definitions
         optimize: expand expression list when merging into concatenation
         netlink: fix stack overflow due to erroneous rounding
         netlink: bogus concatenated set ranges with netlink message overrun
         netlink: fix crash when ops doesn't support udata
         netlink: Catch unknown types when deserializing objects
         netlink: Avoid potential NULL-ptr deref parsing set elem expressions
         netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY
         evaluate: don't BUG on unexpected base datatype
         src: BASECHAIN flag no longer implies presence of priority expression
         parser_bison: only reset by name is supported by now


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         segtree: fix string data initialisation
         src: netlink: netlink_delinearize_table() may return NULL
         src: ensure chain policy evaluation when specified
         src: fix memory leak in anon chain error handling
         mnl: silence compiler warning
         datatype: Increase symbolic constant printer robustness
         evaluate: follow prefix expression recursively if needed


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 1:1.24.0-6.kb4
changelog:
  - sync nginx 1.24.0-10 from openEuler 24.03 LTS (f:156480)
  - fix CVE-2026-42946 CVE-2026-40701 CVE-2026-42934 (v:156480)[CVE-2026-42946,CVE-2026-40701,CVE-2026-42934]
  - fix CVE-2026-27654 CVE-2026-27784 CVE-2026-32647 (v:156480)[CVE-2026-27654,CVE-2026-27784,CVE-2026-32647]
  - fix CVE-2026-1642 (v:156480)[CVE-2026-1642]


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 1:1.24.0-6.kb4
changelog:
  - sync nginx 1.24.0-10 from openEuler 24.03 LTS (f:156480)
  - fix CVE-2026-42946 CVE-2026-40701 CVE-2026-42934 (v:156480)[CVE-2026-42946,CVE-2026-40701,CVE-2026-42934]
  - fix CVE-2026-42945 (v:156480)[CVE-2026-42945]
  - fix CVE-2026-27654 CVE-2026-27784 CVE-2026-32647 (v:156480)[CVE-2026-27654,CVE-2026-27784,CVE-2026-32647]
  - fix CVE-2026-1642 (v:156480)[CVE-2026-1642]


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 1:1.24.0-6.kb5
changelog:
  - sync nginx 1.24.0-12 from openEuler 24.03 LTS SP3 (f:161491)
  - fix CVE-2026-49975 (v:161491)[CVE-2026-49975]
  - Fix CVE-2026-9256 (v:161491)[CVE-2026-9256]


author: Zhou Bowen <zhoubowen@kylinsec.com.cn> - 1:1.24.0-6.kb6
changelog:
  - sync nginx 1.24.0-13 from openEuler 24.03 LTS SP3 (f:163905)
  - fix CVE-2026-48142 CVE-2026-42055 (v:163905)[CVE-2026-48142,CVE-2026-42055]


author: xingwei <xingwei14@h-partners.com> - 2:7.92-4
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:decouple from PCRE because it has been End-of-life, use local libpcre to build instead


author: wangkai <13474090681@163.com> - 1:20.11.1-1
changelog:
  - Update to 20.11.1
  - Fix CVE-2023-46809 CVE-2024-21896 CVE-2024-22019 CVE-2024-21892 CVE-2024-24758 CVE-2024-22025


author: yaoxin <yao_xin001@hoperun.com> - 1:20.12.1-1
changelog:
  - Update to 20.12.1:
    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
      leads to HTTP/2 server crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 1:20.12.1-2
changelog:
  - fix building w/ clang: only apply '-fno-ipa-icf' for gcc && disable LTO for clang + ld.bfd
  - improve the handling of trilling whitespaces in C/CXXFLAGS


author: Ge Wang <wang__ge@126.com> - 1:20.12.1-3
changelog:
  - CVE-2023-45853 - Reject overflows of zip header fields in minizip
  - CVE-2024-5274 - Using FunctionParsingScope for parsing class static
  - CVE-2024-5535 - Fix SSL_select_next_proto
  - CVE-2024-7971 - Spill all loop inputs before entering loop


author: wangkai <13474090681@163.com> - 1:20.18.2-1
changelog:
  - Update to 20.18.2
  - Fix CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2024-36137
    CVE-2024-22018 CVE-2024-22020


author: wangkai <13474090681@163.com> - 1:20.18.2-5
changelog:
  - Fix CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,
    CVE-2025-59465, CVE-2025-59466, CVE-2026-21637


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Add virtual cases
  - Resolve IB startup IB_Read_BW service failure issue
  - Delete redundant references
  - Resolve incorrect type in vgpu result data
  - Resolve the issue of getting the kernel source rpm


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Resolve kdump\watchdog\cpufreq\kabiwhitelist\network test failure issue 
  - Add fio test cases:read,write,randread,randwrite
  - Solve the nvme line break issue in the command line interface
  - Fix compilation errors in the make command
  - Add Vulkan testcase for nvida GPU
  - Resolve the issue of oech server startup failure on version 24.03


author: xiaochn <xiaochuannan@inspur.com> - 1.1.5-3
changelog:
  - Resolve the issue of different kernel source download locations in kabi test case
  - Resolve the issue that kabiwhitelist still passes when the ko and rpm file does not exist
  - Add the way for manually adding kabiwhitelist file
  - For custom vendors, refer to the method of obtaining openEuler os information
  - Supports custom vendor


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-0
changelog:
  - Add new test suite srpm and intel
  - Add virtual branch of test suite
  - Add support for Kylin and UOS
  - Bugfix


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-3
changelog:
  - Update the pci.ids file
  - Remove unused variable in cdrom test suite
  - Update test_guide doc
  - Unify the location for downloading kernel source RPMs
  - Optimize kabiwhitelist and system test


author: xu_ping <707078654@qq.com> - 3.24.0-1
changelog:
  - Upgrade version to 3.24.0
    * Add support for FIPS-session mode
    * Updates to harden against RSA timing attacks
    * Add option to show the master key verification patterns of secure keys
    * Add support for exporting a key or certificate as URI-PEM file
    * Performance improvements for attribute retrieval
    * Add support for SHA-2 mechanisms
    * Experimental support for IBM Dilithium via OpenSSL OQS provider
    * Support live guest relocation for protected key (PKEY) operations
    * Add support for CKA_ALWAYS_AUTHENTICATE
    * Add support for CKD_*_SP800 KDFs for ECDH
    * Add support for SHA based key derivation mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms
    * Add support for building Opencryptoki on the IBM AIX platform
    * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
    * Add support for protecting tokens with a token specific user group
    * Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
    * Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later


author: zhang_wenyu <zhang_wenyu@hoperun.com> - 3.25.0-1
changelog:
  - Upgrade version to 3.25.0
    * Add support for PKCS#11 v3.0 SHAKE key derivation
    * Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
    * Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
    * Add support for CCA AES CIPHER secure key types
    * Add support for the CKM_ECDH1_DERIVE mechanism
    * Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
    * Add support for the CKM_RSA_AES_KEY_WRAP mechanism
    * Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
    * Add a tool for import and exporting PKCS#11 keys to a KMIP server
    * Add support for opaque secure key blob import via C_CreateObject
    * Add support for key wrapping with AES-GCM
    * Add support for newer CCA versions on s390x and non-s390x platforms
    * Add support for CKM_AES_GCM (single-part operations only)


author: bitianyuan <bitianyuan@huawei.com> - 9.3p2-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix the missing member of the struct Authmethod method_gsskeyex


author: zhangbinqin<zhangbinqin@h-partners.com> - 9.3p2-11
changelog:
  - Type:CVE
  - CVE:CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388
  - SUG:NA
  - DESC:fix CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388


author: renmingshuai<renmingshuai@huawei.com> - 9.3p1-3
changelog:
  - Type:CVE
  - CVE:CVE-2023-48795,CVE-2023-51385
  - SUG:NA
  - DESC:fix CVE-2023-48795 and CVE-2023-51385


author: mazhiguo <mazhiguo@kylinsec.com.cn> - 1.5.3-5.kb1
changelog:
  - KYOS-F: support para maxtries and unlock_time_increment (#53269)
  - KYOS-F: Solve the prompt error of entering the correct password for the first time (#32928)


author: mazhiguo <mazhiguo@kylinsec.com.cn> - 1.5.3-9.kb1
changelog:
  - KYOS-F: support unlock permanently locked user (#73769)
  - KYOS-F: set unlock_time_increment=60 maxtries=5 default for desktop (#73769)
  - KYOS-F: fixed lock error with admin users (#73769)
  - KYOS-F: add pam_pwquality.so settings in password-auth and system-auth (#57373)
  - KYOS-F: support para maxtries and unlock_time_increment (#53269)
  - KYOS-F: Solve the prompt error of entering the correct password for the first time (#32928)


author: Liu Dalin <liudalin@kylinsec.com.cn> - 1.0.1-1.kb2
changelog:
  - do not allow su and sudo
  - fix ci
  - su and sudo not allowed
  - use librba for rba role init
  - refactor is_rba_enabled
  - fix return errors


author: wangkai <13474090681@163.com> - 6.2.2-4
changelog:
  - Fix CVE-2024-45769,CVE-2024-45770
  - Fix buffer sizing checks in pmstore PDU handling (RHEL-57805)
  - Guard against symlink attacks in pmpost program (RHEL-57810)
  - Fix libpcp_web webgroup slow request refcounting (RHEL-58306)
  - Updated pmdahacluster for newer crm_mon versions (RHEL-50693)


author: Xiaoqian Lv <xiaoqian@nj.iscas.ac.cn> - 4.5-5
changelog:
  - Type: enhancement
  - ID: NA
  - SUG: NA
  - DESC: backport upstream 4.5-0.20 patches to support riscv64


author: Guofeng Yue <yueguofeng@h-partners.com> - 4.5-12
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: modify "--source_ip" to "--bind_source_ip" to fix init connection establishment with specific interface


author: pengjian <pengjian23@mails.ucas.ac.cn> - 1:0.82-3
changelog:
  - Introduced environment variable-controlled polling timeouts 
  for the close and connection-keeping functions in the os_unix.c file.


author: duyiwei <duyiwei@kylinos.cn> - 1:4.9.4-10
changelog:
  - Type:bugfix
  - CVE:CVE-2024-9355、CVE-2019-9514、CVE-2024-24791、CVE-2022-32189、CVE-2022-41715、CVE-2022-2880、CVE-2022-1962、CVE-2023-45290、CVE-2024-24783、CVE-2024-24785
  - SUG:NA
  - DESC: Optimize spec files and fix CVE in batches through rebuild


author: duyiwei <duyiwei@kylinos.cn> - 1:4.9.4-11
changelog:
  - Type:bugfix
  - CVE:CVE-2024-9676,CVE-2024-9675, CVE-2024-9407,CVE-2024-9341
  - SUG:NA
  - DESC: fix CVE-2024-9676,CVE-2024-9675, CVE-2024-9407, and CVE-2024-9341


author: wangyu <wangqingsan@huawei.com> - 123-1
changelog:
  - update to 123
    - duktape:prevent wrongful termination of runway thread
    - harden the security features of the systemd service
    - add packit build tool
    - systemd:set User/Group and don't change uid/gid if already set
    - stop installing /usr/share/polkit-1/rules.d as 700/polkitd
    - moving the 50-default.rules file location


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 123-2.kb1
changelog:
  - KYOS-B: fix polkit-agent-helper-1 PAM translations(#29452)
  - KYOS-F: remove modify-admin-authorization-from-wheel-group-to-root.patch (#52572)


author: puhongyu <puhongyu@kylinsec.com.cn> - 123-2.kb2
changelog:
  - sync polkit 123-4 from openEuler 24.03 LTS (f:168508)
  - fix CVE-2026-4897 (v:168508)[CVE-2026-4897]
  - fix Leaking zombie child processes (f:168508)


author: gaihuiying <eaglegai@163.com> - 2.5.0-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:pre-created upstream default lock dir
         Openssl engine API is deprecated for a while thus disable it


author: gaihuiying <eaglegai@163.com> - 2.5.0-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream
         Fixing up parsing in radiusclient.conf
         Add configure check to see if we have struct sockaddr_ll


author: shenzhongwei <shenzhongwei@kylinos.cn> - 1.3.8b-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix: %patchN is deprecated (7 usages found), use %patch N (or %patch -P N)


author: wangkai <13474090681@163.com> - 1.3.9a-1
changelog:
  - Update to 1.3.9a for fix CVE-2026-42167
  - Add 'proxy' sub-package with unbundled mod_proxy
  - Use libsodium to provide ed25519 key support for mod_sftp
  - Update logrotate snippet to use try-reload-or-restart rather than reload
    for distributions with systemd 229 or later


author: dongyuzhen <dongyuzhen@h-partners.com> - 25.1-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: Funda Wang <fundawang@yeah.net> - 25.1-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: fix build with wrong permission
  - DESC: fix conflicts with protobuf2
  - DESC: revert:distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: zhengxiaoxiao <zhengxiaoxiao2@huawei.com> - 25.1-13
changelog:
  - Type:CVE
  - CVE:CVE-2026-0994
  - SUG:NA
  - DESC:Fix Any recursion depth bypass in Python json_format.ParseDict


author: yaoxin <yao_xin001@hoperun.com> - 5.0.0-1
changelog:
  - Update to 5.0.0:
    * Breaking: Change default to disable private network access
      This effectively resolves GHSA-hxwh-jpp2-84pm https://osv.dev/vulnerability/PYSEC-2024-71


author: jiangxinyu <jiangxinyu@kylinos.cn> - 1.0.5-1
changelog:
  - Update package to version 1.0.5
  - fix error handling that might result in null exception
    cleanups of exception handling : errors must now have an exception
    Handling NameError is not working


author: yaoxin <1024769339@qq.com> - 1.0.6-1
changelog:
  - Update to 1.0.6:
    * drop testing and support for Python3.8, add Python 3.13, change document to reflect this.
    * implement safe_getattr and safe_format functions; fix bugs in UNSAFE_ATTRS and UNSAFE_ATTRS_DTYPES usage
    * make all procedure attributes private to curb access to AST nodes, which can be exploited
    * improvements to error messages, including use ast functions to construct better error messages
    * remove import of numpy.linalg, as documented
    * update doc description for security advisory


author: liuxinghan <liuxinghan@kylinsec.com.cn> - 42.0.2-8.kb2
changelog:
  - sync python-cryptography 42.0.2-9 from openEuler 24.03 LTS (f:141973)
  - fix CVE-2026-26007 (v:141973)[CVE-2026-26007]


author: yaoxin <yao_xin001@hoperun.com> - 4.2.14-1
changelog:
  - Update to 4.2.14
    * CVE-2024-38875: Potential denial-of-service vulnerability in django.utils.html.urlize()
    * CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords
    * CVE-2024-39330: Potential directory-traversal via Storage.save()
    * CVE-2024-39614: Potential denial-of-service vulnerability in get_supported_language_variant()


author: yaoxin <yao_xin001@hoperun.com> - 4.2.15-1
changelog:
  - Update to 4.2.15
    * CVE-2024-41989: Memory exhaustion in ``django.utils.numberformat.floatformat()``
    * CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
    * CVE-2024-41991: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` and ``AdminURLFieldWidget``
    * CVE-2024-42005: Potential SQL injection in ``QuerySet.values()`` and ``values_list()``
    * Fixed a regression in Django 4.2.14 that caused a crash in ``LocaleMiddleware`` when processing a language code over 500 characters


author: xu_ping <707078654@qq.com> - 7.0.0-1
changelog:
  - Upgrade version to 7.0.0
  - Python 3.12 support and python 3.7 no longer supported
  - Add support bind mount propagation.


author: xuchenchen <xuchenchen@kylinos.cn> - 3.1.3-2
changelog:
  - Type: CVE
  - CVE: CVE-2024-34064
  - SUG: NA
  - DESC: fix disallow invalid characters in keys to xmlattr filter


author: xuhe <xuhe@kylinos.cn> - 2.27.3-1
changelog:
  - Update to 2.27.3
  - Fix test util typings.
  - Use json5 typings.
  - Use updated releaser workflows.
  - Ignore pageconfig file if JSON is zero-length.
  - For v2 extensions parse entrypoint data.
  - Add util to get consolidated page_config from higher levels.
  - Move ENV_CONFIG_PATH import back into _get_config_manager.
  - Load overrides once, rather than in each settings handler.
  - Run docs on ubuntu.
  - Fix handling language packs for pseudo language.


author: gengqihu <gengqihu2@h-partners.com> - 23.3.1-1
changelog:
  - update version to 23.3.1
  - Fix parallel pip cache downloads causing crash (#12364)
  - Upgrade urllib3 to 1.26.17 (#12343)
  - Fix zsh completion script (#12173)
  - Fix #12166
  - Move the setuptools settings into pyproject.toml
  - Use `-r=...` instead of `-r ...` for hg
  - Drop isort and flake8 settings from setup.cfg
  - Follow imports for more vendored dependencies
  - Enable mypy's strict equality checks (#12209)
  - Fixed argument name in docstring
  - Allow truststore to not import on Python 3.9 and earlier
  - Vendor truststore
  - Fix formatting, combine numbers not strings!
  - Remove uses of `utcnow` in non-vendored code (#12006)
  - Fix issues raised in code review
  - move test_download_metadata mock pypi index utilities to conftest.py
  - Use strict optional checking in req_install.py (#11379)
  - Fix 'force' remove file without write permissions
  - Dropped unused attribute
  - Fix Pytest --use-venv init
  - Limit the double download fix to wheels
  - Fix slowness on Python 3.11 when updating an existing large environment.
  - Fix `pip completion --zsh`


author: yaoxin <yao_xin001@hoperun.com> - 6.4.1-1
changelog:
  - Update to 6.4.1
    * Parsing of the ``Transfer-Encoding`` header is now stricter.
    * Handling of whitespace in headers now matches the RFC more closely.
    * ``tornado.curl_httpclient`` now prohibits carriage return and linefeed headers in HTTP headers
    (matching the behavior of ``simple_httpclient``).


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-5
changelog:
  - Type:CVE
  - CVE:NA
  - SUG:NA
  - DESC:fix CVE-2024-6923,CVE-2024-7592,CVE-2024-8088
      - Encode newlines in headers, and verify headers are sound
      - Fix quadratic complexity in parsing quoted cookie values with backslashes
      - Replaced SanitizedNames with a more surgical fix


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-6
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup


author: Funda Wang <fundawang@yeah.net> - 3.11.6-8
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
    - Quote template strings in venv activation scripts


author: lipengyu <lipengyu@kylinos.cn> - 3.11.6-18
changelog:
  - Type:CVE
  - CVE:CVE-2025-13836 CVE-2025-13837 CVE-2025-12084
  - SUG:NA
  - DESC:fix CVE-2025-13836 CVE-2025-13837 CVE-2025-12084


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 4.1.2-1
changelog:
  - Upgrade package with version 4.1.2
    Fix highlight sequencing when replacing text in code cells
    Restore notebook scrolling on dragging a cell to the viewport edge
    Fix typing in editable elements inside of open shadow DOM
    Correct Alt + number keyboard shortcuts command map
    Update jupyter-collaboration for the Binder environment
    Add virtual scrollbar component to windowed lists.
    Load custom CSS functionality and documentation
    Add plugin manager and extension locks


author: zhaojingyu <zhaojingyu@kylinos.cn> - 4.1.6-1
changelog:
  - Upgrade package with version 4.1.6
  - Fix outputarea collapse expand
    Disable placeholder for password input


author: muxiaohui <muxiaohui@kylinos.cn> - 4.3.0-1
changelog:
  - Update version to 4.3.0
    Add setting to enable single-click navigation in file browser.
    Adds command to toggle cell outputs.
    Add kernel selection to Galata notebook creation.


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 4.3.5-1
changelog:
  - Upgrade package with version 4.3.5
    Fix scrolling and selection restoration on undo/redo
    Fix windowing crash due to out-of-bounds access
    Increase color contrast of operators in code editor
    Fix jupyverse installation instructions
    Use Zulip for instant messaging


author: liuxinghan <liuxinghan@kylinsec.com.cn> - 3.7-2.kb1
changelog:
  - sync python-markdown 3.7-2 from openEuler 24.03 LTS (f:141947)
  - Fix CVE-2025-69534 (v:141947)[CVE-2025-69534]
  - Upgrade to 3.7 (f:141947)
  - fix build error due to python3 fix CVE-2025-6069. (v:141947)[CVE-2025-6069]


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 7.16.6-1
changelog:
  - Update package with version 7.16.6
    Prevent leading whitespace in markdown code blocks from being stripped
    Update base.tex.j2 for macro compatibility with newer versions of Pandoc
    Allow including text/x-rst outputs in rst conversion, transition away from text/restructuredtext
    Add support for mistune 3.1.0
    [HTMLExporter] Initialize resources before widget filtering
    Add a toggle to skip the svg encoding of images
    Support configureable width and height of reveal presentations
    Convert coalescese_streams function to CoalesceStreamsPreprocessor


author: openeuler_bot <infra@openeuler.sh> - 7.17.0-1
changelog:
  - Add support for arbitrary browser arguments (version:7.17.0).
  - Fix QtPNGExporter returning empty bytes on macOS (version:7.17.0).
  - Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) (version:7.17.0).
  - Drop support for Python 3.8, fix the CI tests (version:7.17.0).


author: YangengLiu <dev01202@linx-info.com> - 7.17.1-1
changelog:
  - update version to 7.17.1
    * Allow configureable WebPDF JavaScript processing timeout.
    * Fix when checking template paths on shared filesystems.
    * Tweak webpdf template logic to fix duplicate extension problem.


author: gaihuiying <eaglegai@163.com> - 1.17.1-15
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: gaihuiying <eaglegai@163.com> - 1.17.1-16
changelog:
  - Type:cves
  - CVE:CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960
  - SUG:NA
  - DESC:fix CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 1.26.18-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Prevent issue in HTTPResponse().read() when decoded_content is True and then False


author: lixiaoyong <lixiaoyong@kylinos.cn> - 0.14.1-1
changelog:
  - Upgrade package to version 0.14.1
    - Drop support for Python older than 3.6
    - Additional ruff/Pyflakes/codespell fixes


author: Xianglai Li <lixianglai@loongson.cn> - 11:8.2.0-27
changelog:
  - fix compile error on loongarch
  - hw/loongarch: fix cpu hotplug reset
  - hw/loongarch/boot: Use warn_report when no kernel filename
  - hw/loongarch: clean code
  - hw/loongarch: Add KVM pch msi device support
  - hw/loongarch: Add KVM pch pic device support
  - hw/loongarch: Add KVM extioi device support
  - hw/loongarch: Add KVM IPI device support
  - hw/loongarch/virt: Update the ACPI table for hotplug cpu
  - hw/loongarch/virt: Add basic CPU plug support
  - hw/loongarch/virt: Add CPU topology support
  - accel/kvm/kvm-all: Fixes the missing break in vCPU unpark logic
  - gdbstub: Add helper function to unregister GDB register space
  - physmem: Add helper function to destroy CPU AddressSpace
  - hw/acpi: Update CPUs AML with cpu-(ctrl)dev change
  - hw/acpi: Update ACPI GED framework to support vCPU Hotplug
  - hw/acpi: Move CPU ctrl-dev MMIO region len macro to common header file
  - accel/kvm: Extract common KVM vCPU {creation,parking} code
  - target/loongarch: Add steal time support on migration
  - linux-headers: loongarch: Add kvm_para.h and unistd_64.h
  - target/loongarch/kvm: Implement LoongArch PMU extension
  - target/loongarch: Implement lbt registers save/restore function
  - target/loongarch: Add loongson binary translation feature
  - sync loongarch linux-headers
  - target/loongarch: Avoid bits shift exceeding width of bool type
  - target/loongarch: Use explicit little-endian LD/ST API
  - target/loongarch: fix -Werror=maybe-uninitialized false-positive
  - target/loongarch: Support QMP dump-guest-memory
  - target/loongarch/kvm: Add vCPU reset function
  - target/loongarch: Add compatible support about VM reboot
  - target/loongarch: Fix cpu_reset set wrong CSR_CRMD
  - target/loongarch: Set CSR_PRCFG1 and CSR_PRCFG2 values
  - target/loongarch: Remove avail_64 in trans_srai_w() and simplify it
  - target/loongarch/kvm: Add software breakpoint support
  - target/loongarch: Add loongarch vector property unconditionally
  - target/loongarch/kvm: Fix VM recovery from disk failures
  - target/loongarch: Put cpucfg operation before CSR register
  - target/loongarch: Add TCG macro in structure CPUArchState
  - hw/arm/virt-acpi-build.c: Migrate SPCR creation to common location
  - hw/loongarch/virt: Add FDT table support with acpi ged pm register
  - hw/loongarch/virt: Add description for virt machine type
  - hw/loongarch: Add acpi SPCR table support
  - hw/loongarch: virt: pass random seed to fdt
  - hw/loongarch: virt: support up to 4 serial ports
  - hw/loongarch: Remove default enable with VIRTIO_VGA device
  - hw/loongarch: Fix length for lowram in ACPI SRAT
  - hw/loongarch/virt: Remove unused assignment
  - hw/loongarch: Change the tpm support by default
  - hw/loongarch/boot.c: fix out-of-bound reading
  - hw/loongarch/virt: Use MemTxAttrs interface for misc ops
  - tests/libqos: Add loongarch virt machine node
  - hw/loongarch: Remove minimum and default memory size
  - hw/loongarch: Refine system dram memory region
  - hw/loongarch: Refine fwcfg memory map
  - hw/loongarch: Refine fadt memory table for numa memory
  - hw/loongarch: Refine acpi srat table for numa memory
  - hw/loongarch: Add VM mode in IOCSR feature register in kvm mode
  - hw/loongarch: Refine default numa id calculation
  - hw/loongarch: Rename LoongArchMachineState with LoongArchVirtMachineState
  - hw/loongarch: Rename LOONGARCH_MACHINE with LOONGARCH_VIRT_MACHINE
  - hw/loongarch: move memory map to boot.c
  - loongarch: switch boards to "default y"
  - hw/loongarch: Add cells missing from rtc node
  - hw/loongarch: Add cells missing from uart node
  - hw/loongarch: fdt remove unused irqchip node
  - hw/loongarch: fdt adds pcie irq_map node
  - hw/loongarch: fdt adds pch_msi Controller
  - hw/loongarch: fdt adds pch_pic Controller
  - hw/loongarch: fdt adds Extend I/O Interrupt Controller
  - hw/loongarch: fdt adds cpu interrupt controller node
  - hw/loongarch: Init efi_fdt table
  - hw/loongarch: Init efi_initrd table
  - hw/loongarch: Init efi_boot_memmap table
  - hw/loongarch: Init efi_system_table
  - hw/loongarch: Add init_cmdline
  - hw/loongarch: Add slave cpu boot_code
  - hw/loongarch: Add load initrd
  - hw/loongarch: Move boot functions to boot.c


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-28
changelog:
  - hw/misc/mos6522: Fix bad class definition of the MOS6522 device
  - target/i386: Fix minor typo in NO_NESTED_DATA_BP feature bit
  - cpu: ensure we don't call start_exclusive from cpu_exec
  - Avoid unaligned fetch in ladr_match()
  - audio/audio.c: remove trailing newline in error_setg
  - acpi/tests/avocado/bits: wait for 200 seconds for SHUTDOWN event from bits VM
  - linux-user: Tolerate CONFIG_LSM_MMAP_MIN_ADDR
  - accel/tcg: Fix user-only probe_access_internal plugin
  - linux-user: Honor elf alignment when placing images
  - Reserve address for MSI mapping in the CVM scenario.


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-29
changelog:
  - target/i386: csv: Support inject secret for CSV3 guest only if the extension is enabled
  - target/i386: csv: Support load kernel hashes for CSV3 guest only if the extension is enabled
  - target/i386: csv: Request to set private memory of CSV3 guest if the extension is enabled
  - target/i386: kvm: Support to get and enable extensions for Hygon CoCo guest
  - qapi/qom,target/i386: csv-guest: Introduce secret-header-file=str and secret-file=str options
  - bakcend: VirtCCA:resolve hugepage memory waste issue in vhost-user scenario
  - parallels: fix ext_off assertion failure due to overflow
  - backends/cryptodev-vhost-user: Fix local_error leaks
  - hw/usb/hcd-ehci: Fix debug printf format string
  - target/riscv/vector_helper.c: fix 'vmvr_v' memcpy endianess
  - target/riscv/vector_helper.c: optimize loops in ldst helpers
  - target/riscv/vector_helper.c: set vstart = 0 in GEN_VEXT_VSLIDEUP_VX()
  - target/hexagon: don't look for static glib
  - virtio-net: Fix network stall at the host side waiting for kick
  - Add if condition to avoid assertion failed error in blockdev_init
  - target/arm: Use float_status copy in sme_fmopa_s
  - target/arm: take HSTR traps of cp15 accesses to EL2, not EL1
  - target/arm: Reinstate "vfp" property on AArch32 CPUs
  - target/i386/cpu: Fix notes for CPU models
  - target/arm: LDAPR should honour SCTLR_ELx.nAA
  - target/riscv: Avoid bad shift in riscv_cpu_do_interrupt()
  - hvf: remove unused but set variable
  - hw/misc/nrf51_rng: Don't use BIT_MASK() when we mean BIT()
  - Avoid taking address of out-of-bounds array index
  - target/arm: Fix VCMLA Dd, Dn, Dm[idx]
  - target/arm: Fix UMOPA/UMOPS of 16-bit values
  - target/arm: Fix SVE/SME gross MTE suppression checks
  - target/arm: Fix nregs computation in do_{ld,st}_zpa
  - crypto: fix error check on gcry_md_open
  - Change vmstate_cpuhp_sts vmstateDescription version_id
  - hw/pci: Remove unused pci_irq_pulse() method
  - hw/intc: Don't clear pending bits on IRQ lowering
  - target/arm: Drop user-only special case in sve_stN_r
  - migration: Ensure vmstate_save() sets errp
  - target/i386: fix hang when using slow path for ptw_setl
  - contrib/plugins: add compat for g_memdup2
  - hw/audio/hda: fix memory leak on audio setup
  - crypto: perform runtime check for hash/hmac support in gcrypt
  - target/arm: Fix incorrect aa64_tidcp1 feature check
  - target/arm: fix exception syndrome for AArch32 bkpt insn
  - target/arm: Don't get MDCR_EL2 in pmu_counter_enabled() before checking ARM_FEATURE_PMU
  - linux-user: Print tid not pid with strace
  - target/arm: Fix A64 scalar SQSHRN and SQRSHRN
  - target/arm: Don't assert for 128-bit tile accesses when SVL is 128
  - hw/timer/exynos4210_mct: fix possible int overflow
  - target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()
  - hw/audio/virtio-snd: Always use little endian audio format
  - target/riscv: Fix vcompress with rvv_ta_all_1s
  - usb-hub: Fix handling port power control messages


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-30
changelog:
  - Revert "linux-user: Print tid not pid with strace"
  - gpex-acpi: Remove duplicate DSM #5
  - smmuv3: Use default bus for arm-smmuv3-accel
  - smmuv3: Change arm-smmuv3-nested name to arm-smmuv3-accel
  - smmu-common: Return sysmem address space only for vfio-pci
  - smmuv3: realize get_pasid_cap and set ssidsize with pasid
  - vfio: Synthesize vPASID capability to VM
  - backend/iommufd: Report PASID capability
  - pci: Get pasid capability from vIOMMU
  - smmuv3: Add support for page fault handling
  - kvm: Translate MSI doorbell address only if it is valid
  - hw/arm/smmuv3: Enable sva/stall IDR features
  - iommufd.h: Updated to openeuler olk-6.6 kernel
  - tests/data/acpi/virt: Update IORT acpi table
  - hw/arm/virt-acpi-build: Add IORT RMR regions to handle MSI nested binding
  - tests/qtest: Allow IORT acpi table to change
  - hw/arm/virt-acpi-build: Build IORT with multiple SMMU nodes
  - hw/arm/smmuv3: Associate a pci bus with a SMMUv3 Nested device
  - hw/arm/smmuv3: Add initial support for SMMUv3 Nested device
  - hw/arm/virt: Add an SMMU_IO_LEN macro
  - hw/pci-host/gpex: [needs kernel fix] Allow to generate preserve boot config DSM #5
  - tests/data/acpi: Update DSDT acpi tables
  - acpi/gpex: Fix PCI Express Slot Information function 0 returned value
  - tests/qtest: Allow DSDT acpi tables to change
  - hw/arm/smmuv3: Forward cache invalidate commands via iommufd
  - hw/arm/smmu-common: Replace smmu_iommu_mr with smmu_find_sdev
  - hw/arm/smmuv3: Add missing STE invalidation
  - hw/arm/smmuv3: Add smmu_dev_install_nested_ste() for CFGI_STE
  - hw/arm/smmuv3: Check idr registers for STE_S1CDMAX and STE_S1STALLD
  - hw/arm/smmuv3: Read host SMMU device info
  - hw/arm/smmuv3: Ignore IOMMU_NOTIFIER_MAP for nested-smmuv3
  - hw/arm/smmu-common: Return sysmem if stage-1 is bypassed
  - hw/arm/smmu-common: Add iommufd helpers
  - hw/arm/smmu-common: Add set/unset_iommu_device callback
  - hw/arm/smmu-common: Extract smmu_get_sbus and smmu_get_sdev helpers
  - hw/arm/smmu-common: Bypass emulated IOTLB for a nested SMMU
  - hw/arm/smmu-common: Add a nested flag to SMMUState
  - backends/iommufd: Introduce iommufd_viommu_invalidate_cache
  - backends/iommufd: Introduce iommufd_vdev_alloc
  - backends/iommufd: Introduce iommufd_backend_alloc_viommu
  - vfio/iommufd: Implement [at|de]tach_hwpt handlers
  - vfio/iommufd: Implement HostIOMMUDeviceClass::realize_late() handler
  - HostIOMMUDevice: Introduce realize_late callback
  - vfio/iommufd: Add properties and handlers to TYPE_HOST_IOMMU_DEVICE_IOMMUFD
  - backends/iommufd: Add helpers for invalidating user-managed HWPT
  - Update iommufd.h header for vSVA
  - vfio/common: Allow disabling device dirty page tracking
  - vfio/migration: Don't block migration device dirty tracking is unsupported
  - vfio/iommufd: Implement VFIOIOMMUClass::query_dirty_bitmap support
  - vfio/iommufd: Implement VFIOIOMMUClass::set_dirty_tracking support
  - vfio/iommufd: Probe and request hwpt dirty tracking capability
  - vfio/{iommufd, container}: Invoke HostIOMMUDevice::realize() during attach_device()
  - vfio/iommufd: Add hw_caps field to HostIOMMUDeviceCaps
  - vfio/{iommufd,container}: Remove caps::aw_bits
  - HostIOMMUDevice: Store the VFIO/VDPA agent
  - vfio/iommufd: Introduce auto domain creation
  - vfio/ccw: Don't initialize HOST_IOMMU_DEVICE with mdev
  - vfio/ap: Don't initialize HOST_IOMMU_DEVICE with mdev
  - vfio/iommufd: Return errno in iommufd_cdev_attach_ioas_hwpt()
  - backends/iommufd: Extend iommufd_backend_get_device_info() to fetch HW capabilities
  - vfio/iommufd: Don't initialize nor set a HOST_IOMMU_DEVICE with mdev
  - vfio/pci: Extract mdev check into an helper
  - intel_iommu: Check compatibility with host IOMMU capabilities
  - intel_iommu: Implement [set|unset]_iommu_device() callbacks
  - intel_iommu: Extract out vtd_cap_init() to initialize cap/ecap
  - vfio/pci: Pass HostIOMMUDevice to vIOMMU
  - hw/pci: Introduce pci_device_[set|unset]_iommu_device()
  - hw/pci: Introduce helper function pci_device_get_iommu_bus_devfn()
  - vfio: Create host IOMMU device instance
  - backends/iommufd: Implement HostIOMMUDeviceClass::get_cap() handler
  - vfio/container: Implement HostIOMMUDeviceClass::get_cap() handler
  - vfio/iommufd: Implement HostIOMMUDeviceClass::realize() handler
  - backends/iommufd: Introduce helper function iommufd_backend_get_device_info()
  - vfio/container: Implement HostIOMMUDeviceClass::realize() handler
  - range: Introduce range_get_last_bit()
  - backends/iommufd: Introduce TYPE_HOST_IOMMU_DEVICE_IOMMUFD[_VFIO] devices
  - vfio/container: Introduce TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO device
  - backends/host_iommu_device: Introduce HostIOMMUDeviceCaps
  - backends: Introduce HostIOMMUDevice abstract
  - vfio/iommufd: Remove CONFIG_IOMMUFD usage
  - vfio/spapr: Extend VFIOIOMMUOps with a release handler
  - vfio/spapr: Only compile sPAPR IOMMU support when needed
  - vfio/iommufd: Introduce a VFIOIOMMU iommufd QOM interface
  - vfio/spapr: Introduce a sPAPR VFIOIOMMU QOM interface
  - vfio/container: Intoduce a new VFIOIOMMUClass::setup handler
  - vfio/container: Introduce a VFIOIOMMU legacy QOM interface
  - vfio/container: Introduce a VFIOIOMMU QOM interface
  - vfio/container: Initialize VFIOIOMMUOps under vfio_init_container()
  - vfio/container: Introduce vfio_legacy_setup() for further cleanups
  - docs/devel: Add VFIO iommufd backend documentation
  - vfio: Introduce a helper function to initialize VFIODevice
  - vfio/ccw: Move VFIODevice initializations in vfio_ccw_instance_init
  - vfio/ap: Move VFIODevice initializations in vfio_ap_instance_init
  - vfio/platform: Move VFIODevice initializations in vfio_platform_instance_init
  - vfio/pci: Move VFIODevice initializations in vfio_instance_init
  - hw/i386: Activate IOMMUFD for q35 machines
  - kconfig: Activate IOMMUFD for s390x machines
  - hw/arm: Activate IOMMUFD for virt machines
  - vfio: Make VFIOContainerBase poiner parameter const in VFIOIOMMUOps callbacks
  - vfio/ccw: Make vfio cdev pre-openable by passing a file handle
  - vfio/ccw: Allow the selection of a given iommu backend
  - vfio/ap: Make vfio cdev pre-openable by passing a file handle
  - vfio/ap: Allow the selection of a given iommu backend
  - vfio/platform: Make vfio cdev pre-openable by passing a file handle
  - vfio/platform: Allow the selection of a given iommu backend
  - vfio/pci: Make vfio cdev pre-openable by passing a file handle
  - vfio/pci: Allow the selection of a given iommu backend
  - vfio/iommufd: Enable pci hot reset through iommufd cdev interface
  - vfio/pci: Introduce a vfio pci hot reset interface
  - vfio/pci: Extract out a helper vfio_pci_get_pci_hot_reset_info
  - vfio/iommufd: Add support for iova_ranges and pgsizes
  - vfio/iommufd: Relax assert check for iommufd backend
  - vfio/iommufd: Implement the iommufd backend
  - vfio/common: return early if space isn't empty
  - util/char_dev: Add open_cdev()
  - backends/iommufd: Introduce the iommufd object
  - vfio/spapr: Move hostwin_list into spapr container
  - vfio/spapr: Move prereg_listener into spapr container
  - vfio/spapr: switch to spapr IOMMU BE add/del_section_window
  - vfio/spapr: Introduce spapr backend and target interface
  - vfio/container: Implement attach/detach_device
  - vfio/container: Move iova_ranges to base container
  - vfio/container: Move dirty_pgsizes and max_dirty_bitmap_size to base container
  - vfio/container: Move listener to base container
  - vfio/container: Move vrdl_list to base container
  - vfio/container: Move pgsizes and dma_max_mappings to base container
  - vfio/container: Convert functions to base container
  - vfio/container: Move per container device list in base container
  - vfio/container: Switch to IOMMU BE set_dirty_page_tracking/query_dirty_bitmap API
  - vfio/container: Move space field to base container
  - vfio/common: Move giommu_list in base container
  - vfio/common: Introduce vfio_container_init/destroy helper
  - vfio/container: Switch to dma_map|unmap API
  - vfio/container: Introduce a empty VFIOIOMMUOps
  - vfio: Introduce base object for VFIOContainer and targeted interface
  - cryptodev: Fix error handling in cryptodev_lkcf_execute_task()
  - hw/xen: Fix xen_bus_realize() error handling
  - hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
  - target/s390x: Fix a typo in s390_cpu_class_init()
  - hw/sd/sdhci: free irq on exit
  - hw/ufs: free irq on exit
  - hw/pci-host/designware: Fix ATU_UPPER_TARGET register access
  - target/i386: Make invtsc migratable when user sets tsc-khz explicitly
  - target/i386: Construct CPUID 2 as stateful iff times > 1
  - target/i386: Enable fdp-excptn-only and zero-fcs-fds
  - target/i386: Don't construct a all-zero entry for CPUID[0xD 0x3f]
  - i386/cpuid: Remove subleaf constraint on CPUID leaf 1F
  - target/i386: pass X86CPU to x86_cpu_get_supported_feature_word
  - target/i386: Raise the highest index value used for any VMCS encoding
  - target/i386: Add VMX control bits for nested FRED support
  - target/i386: Delete duplicated macro definition CR4_FRED_MASK
  - target/i386: Add get/set/migrate support for FRED MSRs
  - target/i386: enumerate VMX nested-exception support
  - vmxcap: add support for VMX FRED controls
  - target/i386: mark CR4.FRED not reserved
  - target/i386: add support for FRED in CPUID enumeration
  - target/i386: fix feature dependency for WAITPKG
  - target/i386: Add more features enumerated by CPUID.7.2.EDX
  - net: fix build when libbpf is disabled, but libxdp is enabled
  - hw/nvme: fix invalid endian conversion
  - hw/nvme: fix invalid check on mcl
  - backends/cryptodev: Do not ignore throttle/backends Errors
  - backends/cryptodev: Do not abort for invalid session ID
  - virtcca: add kvm isolation when get tmi version.
  - qga: Don't daemonize before channel is initialized
  - qga: Add log to guest-fsfreeze-thaw command
  - backends: VirtCCA: cvm_gpa_start supports both 1GB and 3GB
  - BUGFIX: Enforce isolation for virtcca_shared_hugepage
  - arm: VirtCCA: qemu CoDA support UEFI boot
  - arm: VirtCCA: Compatibility with older versions of TMM and the kernel
  - arm: VirtCCA: qemu uefi boot support kae
  - arm: VirtCCA: CVM support UEFI boot


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-31
changelog:
  - target/arm: Change arm_cpu_mp_affinity when enabled IPIV feature
  - fw_cfg: Don't set callback_opaque NULL in fw_cfg_modify_bytes_read()


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-32
changelog:
  - target/i386: csv: Release CSV3 shared pages after unmapping DMA
  - target/i386: Add new CPU model ClearwaterForest
  - target/i386: add sha512, sm3, sm4 feature bits
  - docs: Add GNR, SRF and CWF CPU models
  - target/i386: Export BHI_NO bit to guests
  - target/i386: Introduce SierraForest-v2 model
  - vdpa/iommufd:Implement DMA mapping through the iommufd interface
  - vdpa/iommufd:Introduce vdpa-iommufd module
  - vdpa/iommufd:support associating iommufd backend for vDPA devices
  - Kconfig/iommufd/VDPA: Update IOMMUFD module configuration dependencies The vDPA module can also use IOMMUFD like the VFIO module. 
  - backends/iommufd: Get rid of qemu_open_old()
  - backends/iommufd: Make iommufd_backend_*() return bool
  - backends/iommufd: Fix missing ERRP_GUARD() for error_prepend()
  - backends/iommufd: Remove mutex
  - backends/iommufd: Remove check on number of backend users
  - hw/intc: Add extioi ability of 256 vcpu interrupt routing
  - hw/rtc: Fixed loongson rtc emulation errors
  - hw/loongarch/boot: Adjust the loading position of the initrd
  - target/loongarch: Fix the cpu unplug resource leak
  - target/loongarch: fix vcpu reset command word issue
  - vdpa:Fix dirty page bitmap synchronization not done after suspend for vdpa devices


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-33
changelog:
  - arm: cvm: fix arm-softmmu build on x86 platform
  - arm: VirtCCA: fix arm-softmmu build on x86 platform
  - hw/arm/virt: HDBSS: fix arm-softmmu build on x86 platform
  - hw/arm/virt: decouple migrate_hdbss_buffer_size() with kvm_update_hdbss_cap()
  - hw/arm/virt: only support the HDBSS feature in aarch64
  - multifd: bugfix for incorrect migration data with qatzip compression
  - multifd: bugfix for incorrect migration data with QPL compression
  - multifd: bugfix for migration using compression methods
  - migration/multifd: Zero p->flags before starting filling a packet
  - migration/multifd: Ensure packet->ramblock is null-terminated
  - migration/multifd: Fix rb->receivedmap cleanup race
  - migration/multifd: Fix loop conditions in multifd_zstd_send_prepare and multifd_zstd_recv
  - tests/migration: Add integration test for 'qatzip' compression method
  - migration: Introduce 'qatzip' compression method
  - migration: Add migration parameters for QATzip
  - meson: Introduce 'qatzip' feature to the build system
  - docs/migration: add qatzip compression feature
  - migration/multifd: Fix p->iov leak in multifd-uadk.c
  - tests/migration-test: add uadk compression test
  - migration/multifd: Switch to no compression when no hardware support
  - migration/multifd: Add UADK based compression and decompression
  - migration/multifd: Add UADK initialization
  - migration/multifd: add uadk compression framework
  - configure: Add uadk option
  - docs/migration: add uadk compression feature
  - configure: add --enable-qpl build option
  - migration/multifd: implement qpl compression and decompression
  - migration/multifd: implement initialization of qpl compression
  - migration/multifd: include ram.h in multifd.h
  - migration/multifd: add qpl compression method
  - migration/multifd: put IOV initialization into compression method
  - docs/migration: add qpl compression feature
  - migration/multifd: solve zero page causing multiple page faults
  - migration/multifd: Implement ram_save_target_page_multifd to handle multifd version of MigrationOps::ram_save_target_page.
  - migration/multifd: Implement zero page transmission on the multifd thread
  - migration/multifd: Add new migration option zero-page-detection
  - migration/multifd: Allow multifd without packets
  - migration/multifd: Rename MultiFDSend|RecvParams::data to compress_data
  - migration/multifd: Cleanup multifd_recv_sync_main
  - tests/migration: Set compression level in migration tests
  - migration: Properly apply migration compression level parameters
  - migration/multifd: Drop unnecessary helper to destroy IOC
  - migration/multifd: Cleanup outgoing_args in state destroy
  - migration/multifd: Make multifd_channel_connect() return void
  - migration/multifd: Drop registered_yank
  - migration/multifd: Cleanup TLS iochannel referencing
  - migration/multifd: Release recv sem_sync earlier
  - migration/multifd: Remove p->quit from recv side
  - migration/multifd: Add a synchronization point for channel creation
  - migration/multifd: Unify multifd and TLS connection paths
  - migration/multifd: Move multifd_send_setup into migration thread
  - migration/multifd: Move multifd_send_setup error handling in to the function
  - migration/multifd: Remove p->running
  - migration/multifd: Join the TLS thread
  - migration: Fix logic of channels and transport compatibility check
  - migration/multifd: Optimize sender side to be lockless
  - migration/multifd: Stick with send/recv on function names
  - migration/multifd: Cleanup multifd_load_cleanup()
  - migration/multifd: Cleanup multifd_save_cleanup()
  - migration/multifd: Rewrite multifd_queue_page()
  - migration/multifd: Change retval of multifd_send_pages()
  - migration/multifd: Change retval of multifd_queue_page()
  - migration/multifd: Split multifd_send_terminate_threads()
  - migration/multifd: Forbid spurious wakeups
  - migration/multifd: Move header prepare/fill into send_prepare()
  - migration/multifd: Move trace_multifd_send|recv()
  - migration/multifd: Move total_normal_pages accounting
  - migration/multifd: Rename p->num_packets and clean it up
  - migration/multifd: Drop pages->num check in sender thread
  - migration/multifd: Simplify locking in sender thread
  - migration/multifd: Separate SYNC request with normal jobs
  - migration/multifd: Drop MultiFDSendParams.normal[] array
  - migration/multifd: Postpone reset of MultiFDPages_t
  - migration/multifd: Drop MultiFDSendParams.quit, cleanup error paths
  - migration/multifd: multifd_send_kick_main()
  - migration/multifd: Drop stale comment for multifd zero copy
  - docs/migration: Further move virtio to be feature of migration
  - docs/migration: Further move vfio to be feature of migration
  - docs/migration: Organize "Postcopy" page
  - docs/migration: Split "dirty limit"
  - docs/migration: Split "Postcopy"
  - docs/migration: Split "Debugging" and "Firmware"
  - docs/migration: Split "Backwards compatibility" separately
  - docs/migration: Convert virtio.txt into rST
  - docs/migration: Create index page
  - docs/migration: Create migration/ directory
  - tests/qtest: Re-enable multifd cancel test
  - tests/qtest/migration: Use the new migration_test_add
  - tests/qtest/migration: Add a wrapper to print test names
  - tests/qtest/migration: Print migration incoming errors
  - migration: Report error in incoming migration
  - migration/multifd: Change multifd_pages_init argument
  - migration/multifd: Remove QEMUFile from where it is not needed
  - migration/multifd: Remove MultiFDPages_t::packet_num
  - migration/multifd: Remove unnecessary usage of local Error
  - migration: Fix migration_channel_read_peek() error path
  - migration/multifd: Remove error_setg() in migration_ioc_process_incoming()
  - migration/multifd: Fix leaking of Error in TLS error flow
  - migration/multifd: Simplify multifd_channel_connect() if else statement
  - migration/multifd: Fix error message in multifd_recv_initial_packet()
  - hw/arm/virt: support the HDBSS feature


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-34
changelog:
  - target/arm: support the IPIV feature
  - Revert "target/arm: Change arm_cpu_mp_affinity when enabled IPIV feature"
  - vdpa/iommufd: All vdpa devices perform only one log_sync each time.
  - memory:Optimize flatview ioeventfd processing
  - memory/eventfd:Introduce ioeventfd batch processing to reduce the time required to update ioeventfd
  - migration/memory:Optimize unnecessary memory region updates during live migration
  - migration:Extand the fdtable in the incoming phase of migration
  - virtio/irqfd: Batch processing of irqfd related operations during virtio device startup
  - kvm/msi: Mark whether there is an IRQ route table update through changes
  - virtio-pci:Batch processing of IRQFD mapping for multi queue Virtio devices


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-35
changelog:
  - Fix error in virtCCA CoDA scenario.
  - Revert "backends/iommufd: Make iommufd_backend_*() return bool"


author: qiuwenbo <qiuwenbo@kylinos.com.cn> - 11:8.2.0-21.kb1
changelog:
  - KYOS-F: enable snapshot for UEFI based virtual machine (Related:#57253)
  - KYOS-F: enabel spice vnc and smartcard,Remove some deletion operations.(Related:#52618 #52796)
  - KYOS-F: fix loongarch64 virtio-vga unused and fix spec error (#6789)


author: Junqi Ma <majunqi1@huawei.com> - 11:8.2.0-48
changelog:
  - target/s390x: Fix MVC not always invalidating translation blocks
  - target/sparc: Fix gdbstub incorrectly handling registers f32-f62
  - virtio-net: Fix size check in dhclient workaround
  - vdpa: Fix endian bugs in shadow virtqueue
  - x86/loader: only patch linux kernels
  - target/ppc: Fix e200 duplicate SPRs
  - vfio/container: For CSV3 VM, only register listener to shared_memory_listener list in vfio_connect_container()
  - target/riscv/kvm: update the KVM regs to Linux rvck-6.6
  - target/riscv/kvm: Fix exposure of Zkr
  - hw/arm/virt: Introduce a IPIV machine option
  - hw/vfio/migration: Fix vfio migration isn't aborted in a corner case


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-49
changelog:
  - common-user/host/riscv: use tail pseudoinstruction for calling tail
  - meson: Remove CONFIG_STATX and CONFIG_STATX_MNT_ID
  - qga: fix potentially not initialized nr_volumes in qga_vss_fsfreeze()
  - hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint(CVE-2024-8354)
  - hw/usb/hcd-xhci: Unmap canceled packet
  - meson: Use has_header_symbol() to check getcpu()
  - hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3
  - migration: fix SEEK_CUR offset calculation in qio_channel_block_seek


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-50
changelog:
  - Revert "hw/arm/virt: Introduce a IPIV machine option"
  - target/arm: add ipiv=on/off option
  - arm/cpu: Add sysreg definitions in cpu-sysregs.h
  - arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays
  - arm/cpu: Store aa64isar1/2 into the idregs array
  - arm/cpu: Store aa64pfr0/1 into the idregs array
  - arm/cpu: Store aa64mmfr0-2 into the idregs array
  - arm/cpu: Store aa64dfr0/1 into the idregs array
  - arm/cpu: Store aa64smfr0 into the idregs array
  - arm/cpu: Store id_isar0-7 into the idregs array
  - arm/cpu: Store id_pfr0/1/2 into the idregs array
  - arm/cpu: Store id_dfr0/1 into the idregs array
  - arm/cpu: Store id_mmfr0-5 into the idregs array
  - arm/cpu: Add generated sysreg properties
  - arm/cpu: Add sysreg properties generation
  - arm/cpu: Add infra to handle generated ID register definitions
  - kvm: kvm_get_writable_id_regs
  - arm/kvm: use fd instead of fdarray[2]
  - arm/cpu: switch to a generated cpu-sysregs.h.inc
  - arm/cpu: Add sysreg generation scripts
  - arm/cpu: Store aa64dfr0/1 into the idregs array
  - arm/cpu: Store aa64mmfr0-2 into the idregs array
  - arm/cpu: Store aa64pfr0/1 into the idregs array
  - arm/cpu: Store aa64isar1/2 into the idregs array
  - arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays
  - arm/cpu: Add sysreg definitions in cpu-sysregs.h
  - arm/cpu: more customization for the kvm host cpu model
  - arm/kvm: write back modified ID regs to KVM
  - arm/kvm: Allow reading all the writable ID registers
  - arm/cpu-features: document ID reg properties
  - arm/qmp-cmds: introspection for ID register props
  - arm/cpu: manually make MIDR/REVIDR/AIDR writable
  - arm/cpu: enable MIDR writable
  - target/arm/kvm: Add SMMC hypercall definitions
  - hw/arm/virt: Initial support to set target_impl CPUs
  - target/arm/kvm: Use PSCI_VERSION for version info
  - target/arm/kvm: Set DISCOVER_IMPL_* hypercalls
  - Fix the compilation of target arm-softmmu


author: huangyan <huangyan@cdjrlc.com> - 11:8.2.0-51
changelog:
  - Add qemu-user package for arm, aarch64, riscv32, riscv64 targets
  - Add user-static, user-binfmt package for statically-linked QEMU user emulator


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-52
changelog:
  - trace: Add trace to measure hot migrate downtime
  - backends: Add support of one guest numa node alloc memory from multi host nodes


author: panchenbo <panchenbo@kylinsec.com.cn> - 11:8.2.0-53.kb2
changelog:
  - sync 8.2.0-53 form openEuler 24.03 LTS SP2(f:114081)
  - enable snapshot for UEFI based virtual machine (b:57253)
  - enable spice vnc and smartcard,Remove some deletion operations.(f:52796)
  - fix loongarch64 virtio-vga unused and fix spec error (b:6789)


author: Wang Zhijiang <wangzhijiang@kylinsec.com.cn> - 11:8.2.0-53.kb4
changelog:
  - sync qemu 8.2.0-55 from openEuler 24.03 LTS (f:141892)
  - target/arm: add kunpeng 920 V1 support (f:141892)
  - target/arm: add kunpeng 950 V1 support (f:141892)
  - target/arm: add kunpeng 920 V2 support (f:141892)
  - hw/virtio/virtio-crypto: verify asym request size(CVE-2025-14876) (v:141892)[CVE-2025-14876]
  - cryptodev-builtin: Limit the maximum size(CVE-2025-14876) (v:141892)[CVE-2025-14876]
  - block/vmdk: fix OOB read in vmdk_read_extent()(CVE-2026-2243) (v:141892)[CVE-2026-2243]
  - lsi53c895a: keep a reference to the device while SCRIPTS execute(CVE-2024-6519) (v:141892)[CVE-2024-6519]
  - MAINTAINERS: add me as maintainer to virtio-snd (f:141892)
  - virtio-snd: remove TODO comments (f:141892)
  - virtio-snd: handle 5.14.6.2 for PCM_INFO properly(CVE-2026-3196) (v:141892)[CVE-2026-3196]
  - virtio-snd: fix max_size bounds check in input cb(CVE-2026-3195) (v:141892)[CVE-2026-3195]
  - virtio-snd: tighten read amount in in_cb(CVE-2026-3195) (v:141892)[CVE-2026-3195]
  - net: pad packets to minimum length in qemu_receive_packet() (CVE-2025-12464) (v:141892)[CVE-2025-12464]
  - io: release active GSource in TLS channel finalizer (f:141892)
  - io: move websock resource release to close method (f:141892)
  - io: fix use after free in websocket handshake code(CVE-2025-11234) (v:141892)[CVE-2025-11234]
  - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()(CVE-2026-0665) (v:141892)[CVE-2026-0665]


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 5.15.10-11.kb1
changelog:
  - KYOS-B: for greeter and screensaver-dialog, fix Xmanager7 cannot update QScreen geometry size(#56511)
  - KYOS-B: sync patch from KY3.5-2: fix cursorTheme update issue(#22557)


author: liuxinhao <liuxinhao@kylinsec.com.cn> - 5.15.10-12.kb1
changelog:
  - for greeter and screensaver-dialog, fix Xmanager7 cannot update QScreen geometry size(b:56511)
  - fix cursorTheme update issue(b:22557)


author: lifeifei <lifeifei@kylinos.cn> - 2.19-3
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Add the socket option IPV6_MULTICAST_LOOP to prevent the interface from autoconfiguring using RA messages sent by itself.


author: yanglongkang <yanglongkang@h-partners.com> - 0.6.8-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport libtraceevent patch to adapt to kernel ftrace ring buffer change


author: renhongxun <renhongxun@h-partners.com> - 0.6.8-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:clear the link to rasdaemon.service when uninstalling rasdaemon
         and ensure rasdaemon restart once be upgraded


author: luoshengwei <luoshengwei@huawei.com> - 0.8.0-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cpu isolate errors when some cpus are offline
    before the service started


author: wangjiang <app@cameyan.com> - 0.8.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Add some improvements and add new modules to HiSilicon common section


author: shixuantong <shixuantong1@huawei.com> - 8.2-4
changelog:
  - Add shell command to switch bracketed-paste mode from on to off to keep consistent with realine-8.0


author: wangkai <13474090681@163.com> - 7.2.7-1
changelog:
  - Update to 7.2.7
  - Fix CVE-2021-32626 CVE-2021-32627 CVE-2021-32762 CVE-2021-32675
    CVE-2021-41099 CVE-2021-32628 CVE-2021-32687 CVE-2022-24735
    CVE-2022-24736 CVE-2022-3647 CVE-2022-3734 CVE-2022-35977
    CVE-2023-25155 CVE-2024-46981


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 6.2.7-3.kb1
changelog:
  - sync 24.03-LTS 6.2.7-6 patch (v:111558)
  - Fix CVE-2025-46817 CVE-2025-46818 CVE-2025-46819
  - Fix CVE-2025-21605 CVE-2025-32023 CVE-2025-48367 CVE-2025-49844
  - License compliance rectification


author: dongyuzhen <dongyuzhen@h-partners.com> - 2.18-5
changelog:
  - revert: remove the require to rpm-build.For consistency with other community-released dependencies


author: Funda Wang <fundawang@yeah.net> - 3.2.7-6
changelog:
  - fix CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087,
    CVE-2024-12088, CVE-2024-12747


author: zhangyaqi <zhangyaqi@kylinos.cn> - 8.2312.0-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix memory leak in omazureeventhubs on accepted PN_DELIVERY event


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 8.2312.0-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix passing the value to EscapeChar
         Do not free the uninitialized cstring
         Keep original free pattern
         network subsystem: improve connection failure error message
         Fix runConf NULL pointer refence
         rainerscript: do not try to call a function if it does not exist
         nsd_ptcp regression fix: remove debugging messages emited to stderr
         Fix legacy $ActionQueueDiscardMark parameter


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 8.2312.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:gnutls bugfix: Avoid blocking sockets during TLS handshake
         gnutls bugfix: Add timeout to GnuTLS handshake
         core: fix potential NULL ptr access on HUP in very early startup phase
         omfwd: fix segfault in UDP freeaddrinfo
         gnutls TLS driver: fix small memory leak
         rsyslog startup bugfix: cosmetic memory leak
         core: fix potential misadressing in sigmask
         covscan: remove defect type of RESOURCE_LEAK
         Fix a buffer overflow when the argument to replace is empty


author: weiyucheng <weiyucheng@kylinos.cn> - 2.0.0-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:restart
  - DESC:sync upstream patches to support isulad container engine and systemd cgroup driver


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 1.1.8-21.kb1
changelog:
  - sync 24.03-LTS 1.1.8-26 (v:111558) [CVE-2025-31133 and CVE-2025-52565 and CVE-2025-52881]
  - allowing libct/cap to work with nil capabilities
  - fix can't set cpuset-cpus and cpuset-mems at the same time


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 1.1.8-21.kb2
changelog:
  - sync runc 1.1.8-30 from openEuler 24.03 LTS (f:142050)
  - rebuild for the golang version with the CVE fixed (f:142050)
  - fix set nofile rlimit error (f:142050)
  - check sysctl fullpath whether is mountpoint (f:142050)
  - fix CVE-2025-65637 (v:142050)[CVE-2025-65637]
  - fix CVE-2025-31133 and CVE-2025-52565 and CVE-2025-52881 (v:142050)[CVE-2025-31133,CVE-2025-52565,CVE-2025-52881]


author: jinlun<jinlun@huawei.com> - 40.7-1
changelog:
  - update version to 40.7
    - Allow chronyd-restricted read chronyd key files
    - Allow systemd-sleep set attributes of efivarfs files
    - Make name_zone_t and named_var_run_t a part of the mountpoint attribute
    - Update cifs interfaces to include fs_search_auto_mountpoints()
    - Allow map xserver_tmpfs_t files when xserver_clients_write_xshm is on
    - Add map_read map_write to kernel_prog_run_bpf
    - Add policy for nvme-stas
    - Make new virt drivers permissive
    - Allow named and ndc use the io_uring api
    - Allow sssd send SIGKILL to passket_child running in ipa_otpd_t


author: mazhiguo <mazhiguo@kylinsec.com.cn> - 40.7-4.kb1
changelog:
  - KYOS-F: allow secadm_t capability fowner (#57326)
  - KYOS-F: fix permissions of sysadm users (#53743)
  - KYOS-F: divided adminitrators permissions (#53743)
  - KYOS-F: allow iptables_t to have read and write access to fifo_filed for kernel_t (#51292)
  - KYOS-F:add path mapping(#32959)


author: zhongqianyi <zhongqianyi@kylinsec.com.cn> - 40.7-5.kb1
changelog:
  - KYOS-F: fix the hibernation failure issue (#82365)
  - KYOS-F: allow secadm_t capability fowner (#57326)
  - KYOS-F: fix permissions of sysadm users (#53743)
  - KYOS-F: divided adminitrators permissions (#53743)
  - KYOS-F: allow iptables_t to have read and write access to fifo_filed for kernel_t (#51292)
  - KYOS-F:add path mapping(#32959)


author: zhengxiaoxiao <zhengxiaoxiao2@huawei.com> - 2:4.14.3-1
changelog:
  - update version to 4.14.3
    -Avoid null pointer dereference
    -Update utmp at an initial login
    -Merge libshadow and libmisc into a single libshadow
    -Adding the userdel and groupdel hooks to release tarball


author: yueyuankun <yueyuankun@kylinos.cn> - 15.7-21
changelog:
  - spec: Remove debugsource requirement from debuginfo
  - Allow debuginfo to be installed alone without pulling in the debugsource package.


author: wjiang <app@cameyan.com> -15.7-22
changelog:
  - Backport bugfix patches from upstream
  - Fix build with binutils 2.46 (c4665d2)
  - Fix memory leak on TPM log error in mirror_one_mok_variable (92630f2)


author: yanglu <yanglu72@h-partners.com> - 7:6.1-2
changelog:
  - Type:cves
  - ID:CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848
  - SUG:NA
  - DESC:fix CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848


author: xinghe <xingheyd@163.com> - 7:6.6-8
changelog:
  - Type:cves
  - ID:CVE-2026-33526 CVE-2026-33515 CVE-2026-32748
  - SUG:NA
  - DESC:fix CVE-2026-33526 CVE-2026-33515 CVE-2026-32748


author: panchenbo <panchenbo@kylinsec.com.cn> - 1.9.15p5-5.kb3
changelog:
  - sync sudo 1.9.15p5-6 from openEuler 24.03 LTS (f:141890)
  - Apply patch: backport-CVE-2026-35535.patch (v:141890)[CVE-2026-35535]


author: lingsheng <lingsheng1@h-partners.com> - 6.04-16
changelog:
  - update libpng 1.6.36 to fix CVE-2011-2501 CVE-2011-2690 CVE-2011-2691
  - CVE-2011-2692 CVE-2011-3045 CVE-2011-3048 CVE-2012-3425 CVE-2015-7981
  - CVE-2015-8126 CVE-2015-8472 CVE-2015-8540 CVE-2016-10087 CVE-2017-12652


author: fuanan <fuanan3@h-partners.com> - 255-42
changelog:
  - backport: sync patches from systemd community
    add backport-run-pass-the-pty-slave-fd-to-transient-service.patch
        backport-run-do-not-pass-the-pty-slave-fd-to-transient-servic.patch


author: xiaowen <xiaowen@kylinsec.com.cn> - 255-43.kb1
changelog:
  - Modify the rule for generating audit_type-to-name.h
  - KYOS-B: Remove pretty symbols to ensure compatibility with legacy systems.(#82004)
  - KYOS-F: network wont turn on when it starts up causing slow start (#39560)
  - KYOS-F: changed the waiting time for shutdown error to 10 seconds (#41995)
  - KYOS-F: expand udev line size for property buffer overflow (#22555)


author: baiyanjie <baiyanjie@kylinsec.com.cn> - 255-43.kb2
changelog:
  - KYOS-F: Revert "user: delegate cpu controller, assign weights to user slices"(#92078)
  - KYOS-F: fix build failure from duplicate AUDIT_* macros in kernel headers.(#92078)


author: panchenbo <panchenbo@kylinsec.com.cn> - 255-49.kb1
changelog:
  - fix build failure from duplicate AUDIT_* macros in kernel headers. (b:99100)
  - changed the waiting time for shutdown error to 10 seconds (b:41995)
  - network wont turn on when it starts up causing slow start (b:39560)
  - expand udev line size for property buffer overflow (b:22555)
  - Remove pretty symbols to ensure compatibility with legacy systems. (b:82004)
  - Revert "user: delegate cpu controller, assign weights to user slices" (b:92078)
  - Fix multi-user switching black screen or stuck problem (b:91710)


author: gaobo <gaobo@kylinsec.com.cn> - 255-49.kb5
changelog:
  - sync systemd 255-57 from openEuler 24.03 LTS (f:141912)
  - network networkd address does not set up firewall rules (f:141912)


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 255-49.kb6
changelog:
  - sync systemd 255-59 from openEuler 24.03 LTS SP3 (f:161667)
  - fix CVE-2026-40225 (v:161667)[CVE-2026-40225]
  - fix CVE-2026-40226 (v:161667)[CVE-2026-40226]
  - fix CVE-2026-29111 (v:161667)[CVE-2026-29111]
  - fix CVE-2026-4105 (v:161667)[CVE-2026-4105]
  - fix coredump generation when systemd-resolved and systemd-networkd service is started then uninstalled (f:161667)
  - sync community patches (f:161667)
  - backport community patches and skip bios_version test: (f:161667)
  - umount do not move busy network mounts (f:161667)
  - fix udevadm trigger coredump after execute mount / (f:161667)
  - add backport-network-networkd-address-don-t-set-up-firewall-rules.patch (f:161667)


author: langfei<langfei@huawei.com> - 4.5-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix some test cases fail to be executed, Resolve the sc2168 warning detected by the shellcheck tool.


author: liuchao <liuchao173@huawei.com> - 5.0-1
changelog:
  - Upgrade to 5.0:
    - Performance improvements in uprobe registration and module startup.
    - More probe point process details are printed in "-L" list mode with more "-v".
    - For the case where newer kernels may break systemtap runtime APIs, better pass-4 failure diagnostics are printed.
    - Tapset function print_ubacktrace_fileline() now understands DWARF5.
    - The target(s) of process probes may be specified by path name globs,  as located selected debuginfod servers.
    - The kernel-user message transport system added framing codes, making the transport more reliable, but becoming incompatible across pre-5.0 versions. Use matching versions of stap and staprun.
    - The testsuite Makefile has been simplified to remove concurrency, so "parallel" and "resume" modes are gone.
    - New runtime macro STP_TIMING_NSECS is now supported for reporting probe timing stats in nsecs instead of cycles.  This may become default later.
    - Add new runtime macro STP_FORCE_STDOUT_TTY to override STP_STDOUT_NOT_ATTY.


author: Yu Peng <yupeng@kylinos.cn> - 1:0.17-81
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix telnet crashes on stack overflow due to infinite recursion.


author: puhongyu <puhongyu@kylinsec.com.cn> - 1.13.1-2.kb3
changelog:
  - sync tigervnc 1.13.1-3 from openEuler 24.03 LTS (f:168509)
  - fix CVE-2026-34352 (v:168509)[CVE-2026-34352]


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


author: Hongjian Dai <daihongjian@kylinsec.com.cn> - 9.2.11-3.kb1
changelog:
  - sync trafficserver 9.2.11-3 from openEuler 24.03 LTS (f:156507)
  - Fix CVE-2025-58136 and CVE-2025-65114 (v:156507)[CVE-2025-58136,CVE-2025-65114]
  - update config.guess and config.sub to fix build error (f:156507)
  - Update to 9.2.11 for fix CVE-2025-49763 and CVE-2025-31698 (v:156507)[CVE-2025-49763,CVE-2025-31698]
  - Update to 9.2.9 (f:156507)


author: liuchao <liuchao173@huawei.com> - 2.21.0-1
changelog:
  - upgrade to 2.21.0:
    - api: fixed stop method not to require any parameter
    - plugin_scheduler: fix perf fd leaks
    - allow skipping rollback when restarting TuneD or switching profile
    - function_calc_isolated_cores: no errors for offline CPUs
    - sap-hana: new profile sap-hana-kvm-guest
    - serialized SIGHUP handler to prevent possible bootcmdline corruption
    - fixed possible traceback on SIGHUP
    - updated manual pages to be consistent
    - tuned-adm: better error message for unauthorized switch_profile
    - plugin_sysctl: report reapplied sysctls only on different values
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - plugin_cpu: added support for intel_pstate scaling driver
    - plugin_scheduler: do not leak FDs from the perf
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - throughput-performance: set net.core.somaxconn to at least 2048
    - API: added support for moving devices between instances
    - added support for the API access through the Unix Domain Socket
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - do not exit on duplicate config lines


author: ZhaoYu Jiang <jiangzhaoyu@kylinos.cn> - 2.24.1-1
changelog:
  - Upgrade to 2.24.1:
    - fixed privileged execution of arbitrary scripts by active local user. (CVE-2024-52336)
    - added sanity checks for API methods parameters. (CVE-2024-52337)
    - tuned-ppd: fixed controller init to correctly set_on_battery


author: tianmuyang <tianmuyang@huawei.com> - 2.24.1-4
changelog:
  - profiles: add programmable scheduling based on eBPF
  - package:  change package tuned to architecture-dependent


author: shijilin <shijilin@kylinsec.com.cn> - 2.24.1-4.kb1
changelog:
  - KYOS-F: migrate all user-defined profiles, Related (#68444)
  - KYOS-F: remove from start menu, Related (#28100)


author: langfei<langfei@huawei.com> - 2022g-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix Palestine predictions for 2072 through 2075; Ittoqqortoormiit (America/Scoresbysund) zone change.


author: langfei <langfei@huawei.com> - 2024a-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Aysén Region moves from -04/-03 to -03; new zone;
  -	Improve recent commentary for Chilean decrees;
  -	No need for America/Coyhaique in zonenow.tab.


author: lutong <lutong14@huawei.com> - 1.1-9
changelog:
  - bugfix:fixed display error caused by missing signal_exits & revert change method of getting domain id


author: gcw_X8YNlwar <wangjintao1@xfusion.com> - 1.20.4-1
changelog:
  - Update to 1.20.4
  - Fix CVE-2026-40354: Prevent trashing of arbitrary host files via symlink attack


author: yanglu <yanglu72@h-partners.com> -1.20.11-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix regression caused by the fix for CVE-2024-0229 
         fix use after free related to CVE-2024-21886


author: shuaijiakun <shuaijiakun1288@phytium.com.cn> -1.20.11-32
changelog:
  - Type:feature
  - CVE:NA
  - SUG:NA
  - DESC:fix display error for ps23xx when using ast and pe2201 bmc card.


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: tangjie02 <tangjie02@kylinsec.com.cn> - 1.20.11-38.kb1
changelog:
  - revert patch: backport-0001-CVE-2023-5574.patch 
  - KYOS-F: In vmware, when we stopping xorg ,this will attribute to xorg core dump.(#73757)
  - KYOS-F: Add Jingjia graphic cards support.(#29917)
  - KYOS-F: add glenfly arise pci ids for xorg.(#52900)
  - KYOS-F: Add mtgpu support patches.(#51776)


author: pengmeng <pengmeng@kylinsec.com.cn> - 1.20.11-38.kb2
changelog:
  - sync upstream patches for memory leak. (b:127194)
  - fix memory leak on ms_do_pageflip error.(b:118834)


author: pengmeng <pengmeng@kylinsec.com.cn> - 1.20.11-38.kb5
changelog:
  - sync xorg-x11-server 1.20.11-44 from openEuler 24.03 LTS (f:141853)
  - change Patch10008 for can not be applied.(b:116582)
  - fix CVE-2026-33999 CVE-2026-34000 CVE-2026-34001 CVE-2026-34002 CVE-2026-34003 (v:141853)[CVE-2026-33999,CVE-2026-34000,CVE-2026-34001,CVE-2026-34002,CVE-2026-34003]
  - Fix possible Xorg crashes for ps23xx when using  ast and pe2201 bmc card (f:141853)
  - fix CVE-2022-49737 CVE-2025-49175 CVE-2025-49176 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 (v:141853)[CVE-2022-49737,CVE-2025-49175,CVE-2025-49176,CVE-2025-49178,CVE-2025-49179,CVE-2025-49180,CVE-2025-62229,CVE-2025-62230,CVE-2025-62231]
  - Fix CVE-2025-49176 CVE-2025-49179 CVE-2025-49180 CVE-2022-49737 (v:141853)[CVE-2025-49176,CVE-2025-49179,CVE-2025-49180,CVE-2022-49737]
  - Fix CVE-2025-49178 (v:141853)[CVE-2025-49178]
  - Fix CVE-2025-49175 (v:141853)[CVE-2025-49175]


author: XiaoWen <xiaowen@kylinsec.com.cn> - 1.20.11-38.kb6
changelog:
  - sync xorg-x11-server 1.20.11-46 from openEuler 24.03 LTS SP3, fix CVE-2026-55999 CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264 (v:161472)[CVE-2026-55999,CVE-2026-50256,CVE-2026-50257,CVE-2026-50258,CVE-2026-50259,CVE-2026-50260,CVE-2026-50261,CVE-2026-50262,CVE-2026-50263,CVE-2026-50264]


author: xiaowen <xiaowen@kylinsec.com.cn> - 2:42.2-3.kb1
changelog:
  - KYOS-F:Change the SPEC file to prevent gnome software from displaying the application(#79607)
  - KYOS-F: nodisplay-in-kiran-menu.(#56656)


author: tangjie02 <tangjie02@kylinsec.com.cn> - 1.2.15-5
changelog:
  - if the output directory does not exist, it will be created automatically.
  - fix the pointer position update error after enviroment variable is replaced. 
  - ignore the rule when the environment in %E(env) isn't found.


