# changelog

author: Julio Faracco <jfaracco@redhat.com> [4.18.0-193.84.1.el8_2]
changelog:
  - dm: fix mempool NULL pointer race when completing IO (Benjamin Marzinski) [2088036 2034424]
  - efi/x86: drop task_lock() from efi_switch_mm() (Fernando Pacheco) [2082090 2035415]


author: Julio Faracco <jfaracco@redhat.com> [4.18.0-193.85.1.el8_2]
changelog:
  - net: openvswitch: fix leak of nested actions (Eelco Chaudron) [2086604 2073538]
  - genirq: Use rcu in kstat_irqs_usr() (Waiman Long) [2083310 2068445]


author: Julio Faracco <jfaracco@redhat.com> [4.18.0-193.86.1.el8_2]
changelog:
  - mm: thp: fix MADV_REMOVE deadlock on shmem THP (Waiman Long) [2089090 1974659] {CVE-2020-29368}
  - mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked() (Waiman Long) [2089090 1974659] {CVE-2020-29368}


author: Julio Faracco <jfaracco@redhat.com> [4.18.0-193.87.1.el8_2]
changelog:
  - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Phil Sutter) [2092984 2092987] {CVE-2022-1966}
  - SUNRPC: Set memalloc_nofs_save() for sync tasks (Benjamin Coddington) [2094459 1934098]
  - tcp: drop the hash_32() part from the index calculation (Guillaume Nault) [2064872 2064876] {CVE-2022-1012}
  - tcp: increase source port perturb table to 2^16 (Guillaume Nault) [2064872 2064876] {CVE-2022-1012}
  - tcp: dynamically allocate the perturb table used by source ports (Guillaume Nault) [2064872 2064876] {CVE-2022-1012}
  - tcp: add small random increments to the source port (Guillaume Nault) [2064872 2064876] {CVE-2022-1012}
  - tcp: resalt the secret every 10 seconds (Guillaume Nault) [2064872 2064876] {CVE-2022-1012}
  - tcp: use different parts of the port_offset for index and offset (Guillaume Nault) [2064872 2064876] {CVE-2022-1012}
  - secure_seq: use the 64 bits of the siphash for port offset calculation (Guillaume Nault) [2064872 2064876] {CVE-2022-1012}
  - tcp: add some entropy in __inet_hash_connect() (Guillaume Nault) [2064872 2064876] {CVE-2022-1012}
  - tcp: change source port randomizarion at connect() time (Guillaume Nault) [2064872 2064876] {CVE-2022-1012}
  - perf: Fix sys_perf_event_open() race against self (Michael Petlan) [2087946 2087949] {CVE-2022-1729}


author: Julio Faracco <jfaracco@redhat.com> [4.18.0-193.89.1.el8_2]
changelog:
  - [ipc] Revert "ipc, sem: remove uneeded sem_undo_list lock usage in exit_sem()" (Herton R. Krzesinski) [2095494 1807627]
  - redhat: flesh out rpminspect config file (Jarod Wilson)
  - blk-mq: fix blk_mq_flush_plug_list (Ming Lei) [2096933 2088397]
  - [block] blk-mq: optimise blk_mq_flush_plug_list() (Ming Lei) [2096933 1881760]
  - [include] list: introduce list_for_each_continue() (Ming Lei) [2096933 1881760]


author: Julio Faracco <jfaracco@redhat.com> [4.18.0-193.90.1.el8_2]
changelog:
  - af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register (Xin Long) [2106652 2075181] {CVE-2022-1353}
  - net: openvswitch: fix parsing of nw_proto for IPv6 fragments (Eelco Chaudron) [2106705 2101537]


author: Chengweizheng <chengweizheng@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.01]
changelog:
  - Type: cves
  - ID:   [TASK#184510]
  - SUG:  NA
  - DESC:
  - add translation patch [ 0002~0006 patches ] and change config file for cjk
  - add patch: 0007-x86_kernel-4.18.0-305.el8_add_hygon_family_18h.patch for Hygon CPU
  - add patch: 0008-zhaoxin-patch and .config to support zhaoxin
  - add patch: 0009-add-qla2xxx-device-number-2432.patch
  - debrand for kylin kernel productization
  - net:ipset: add the missing IP_SET_HASH_WITH_NET0 macro {CVE-2023-42753}


author: Chengweizheng <chengweizheng@kylinos.cn> - [4.18.0-193.91.1.el8_2.ks8.02]
changelog:
  - Type: cves
  - ID:   [TASK#224824]
  - SUG:  NA
  - DESC:
  -  netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) {CVE-2024-1086}


author: dujinxiu <dujinxiu@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.03]
changelog:
  - Type: cves
  - ID:   [TASK#625229]
  - SUG:  NA
  - DESC:
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) {CVE-2026-31431}
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)


author: wangsong <wangsong01@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.04]
changelog:
  - Type: cves
  - ID:   CVE-2026-31668、CVE-2026-43284
  - SUG:  NA
  - DESC:
  - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  - xfrm: esp: avoid in-place decrypt on shared skb frags


author: cuiyudong <cuiyudong@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.05]
changelog:
  - Type: cves
  - ID:   CVE-2026-43600
  - SUG:  NA
  - DESC:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers


author: kuangkai <kuangkai@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.06]
changelog:
  - Type: cves
  - ID:   CVE-2026-46333
  - SUG:  NA
  - DESC:
  - ptrace: slightly saner 'get_dumpable()' logic (Uwe Kleine-König) {CVE-2026-46333}


author: wuheng <wuheng@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.07]
changelog:
  - Type: cves
  - ID:   QVD-2026-27616
  - SUG:  NA
  - DESC:
  - net/rds: reset op_nents when zerocopy page pin fails


author: pengkunlun <pengkunlun@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.08]
changelog:
  - Type: cves
  - ID:   QVD-2026-29453
  - SUG:  NA
  - DESC:
  - smb: client: reject userspace cifs.spnego descriptions


author: yangyang <yangyang2@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.09]
changelog:
  - Type: cves
  - ID:   CVE-2026-46331
  - SUG:  NA
  - DESC:
  - net/sched: fix pedit partial COW leading to page cache corruption


author: pengkunlun <pengkunlun@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.10]
changelog:
  - Type: cves
  - ID:   CVE-2026-43456 CVE-2026-43503
  - SUG:  NA
  - DESC:
  - bonding: fix type confusion in bond_setup_by_slave() (Jiayuan Chen) {CVE-2026-43456}
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) {CVE-2026-43503}


author: kuangkai <kuangkai@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.11]
changelog:
  - Type: cves
  - ID:   CVE-2026-43499
  - SUG:  NA
  - DESC:
  -  rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) {CVE-2026-43499}
  -  KYLIN: KVM: x86: Fix shadow paging UAF from stale child pages {CVE-2026-53359}


author: yetaixin <yetaixin@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.12]
changelog:
  - Type: cves
  - ID:   CVE-2026-64600
  - SUG:  NA
  - DESC:
  -  xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong) {CVE-2026-64600}


author: wangsong <wangsong01@kylinos.cn> [4.18.0-193.91.1.el8_2.ks8.13]
changelog:
  - Type: cves
  - ID:   CVE-2026-64564
  - SUG:  NA
  - DESC:
  -  sctp: don't free the ASCONF's own transport in DEL-IP processing (Jun Yang) {CVE-2026-64564}


