[redhat] kernel-5.14.0-618.el9

Signed-off-by: Patrick Talbert <ptalbert@redhat.com>

Author: ptalbert

Makefile.rhelver

@@ -12,7 +12,7 @@ RHEL_MINOR = 8
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 617
+RHEL_RELEASE = 618
 
 #
 # ZSTREAM

redhat/kernel.changelog-9.8

@@ -1,3 +1,212 @@
+* Sat Sep 20 2025 Patrick Talbert <ptalbert@redhat.com> [5.14.0-618.el9]
+- x86/hyperv: Fix kdump on Azure CVMs (Vitaly Kuznetsov) [RHEL-70228]
+- hv_netvsc: Fix panic during namespace deletion with VF (Maxim Levitsky) [RHEL-109583]
+- RDMA/mana_ib: add support of multiple ports (Maxim Levitsky) [RHEL-109583]
+- RDMA/mana_ib: add additional port counters (Maxim Levitsky) [RHEL-109583]
+- RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-109583]
+- net: mana: fix spelling for mana_gd_deregiser_irq() (Maxim Levitsky) [RHEL-109583]
+- net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-109583]
+- net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-109583]
+- net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-109583]
+- net: mana: Allocate MSI-X vectors dynamically (Maxim Levitsky) [RHEL-109583]
+- net: mana: Allow irq_setup() to skip cpus for affinity (Maxim Levitsky) [RHEL-109583]
+- net: mana: explain irq_setup() algorithm (Maxim Levitsky) [RHEL-109583]
+- PCI: hv: Allow dynamic MSI-X vector allocation (Maxim Levitsky) [RHEL-109583]
+- PCI/MSI: Export pci_msix_prepare_desc() for dynamic MSI-X allocations (Maxim Levitsky) [RHEL-109583]
+- net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-109583]
+- RDMA/mana_ib: Add device statistics support (Maxim Levitsky) [RHEL-109583]
+- net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-109583]
+- net: mana: Fix warnings for missing export.h header inclusion (Maxim Levitsky) [RHEL-109583]
+- net: mana: Record doorbell physical address in PF mode (Maxim Levitsky) [RHEL-109583]
+- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart) [RHEL-101033]
+- watchdog/hpwdt: Support Suspend and Resume (Joseph Szczypek) [RHEL-104148]
+- watchdog/hpwdt: Remove unused variable (Joseph Szczypek) [RHEL-104148]
+- watchdog/hpwdt: Remove redundant test. (Joseph Szczypek) [RHEL-104148]
+- watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO (Joseph Szczypek) [RHEL-104148]
+- NFSv4/flexfiles: Fix layout merge mirror check. (Benjamin Coddington) [RHEL-108616]
+- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Benjamin Coddington) [RHEL-108616]
+- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Benjamin Coddington) [RHEL-108616]
+- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Benjamin Coddington) [RHEL-108616]
+- NFS: Fix a race when updating an existing write (Benjamin Coddington) [RHEL-108616]
+- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Benjamin Coddington) [RHEL-108616]
+- SUNRPC: call xs_sock_process_cmsg for all cmsg (Benjamin Coddington) [RHEL-108616]
+- NFSv4: Don't clear capabilities that won't be reset (Benjamin Coddington) [RHEL-108616]
+- sunrpc: fix handling of server side tls alerts (Benjamin Coddington) [RHEL-108616]
+- NFS: Fix the setting of capabilities when automounting a new filesystem (Benjamin Coddington) [RHEL-108616]
+- sunrpc: fix client side handling of tls alerts (Benjamin Coddington) [RHEL-108616]
+- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Benjamin Coddington) [RHEL-108616]
+- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Benjamin Coddington) [RHEL-108616]
+- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Benjamin Coddington) [RHEL-108616]
+- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Benjamin Coddington) [RHEL-108616]
+- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Benjamin Coddington) [RHEL-108616]
+- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Benjamin Coddington) [RHEL-108616]
+- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Benjamin Coddington) [RHEL-108616]
+- nfsd: use threads array as-is in netlink interface (Benjamin Coddington) [RHEL-108616]
+- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Benjamin Coddington) [RHEL-108616]
+- nfs: ignore SB_RDONLY when remounting nfs (Benjamin Coddington) [RHEL-108616]
+- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Benjamin Coddington) [RHEL-108616]
+- NFSv4/pnfs: Reset the layout state after a layoutreturn (Benjamin Coddington) [RHEL-108616]
+- svcrdma: Reduce the number of rdma_rw contexts per-QP (Benjamin Coddington) [RHEL-108616]
+- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Benjamin Coddington) [RHEL-108616]
+- NFSD: unregister filesystem in case genl_register_family() fails (Benjamin Coddington) [RHEL-108616]
+- nfs: handle failure of nfs_get_lock_context in unlock path (Benjamin Coddington) [RHEL-108616]
+- nfs: add missing selections of CONFIG_CRC32 (Benjamin Coddington) [RHEL-108616]
+- nfs: Add missing release on error in nfs_lock_and_join_requests() (Benjamin Coddington) [RHEL-108616]
+- NFS: Shut down the nfs_client only after all the superblocks (Benjamin Coddington) [RHEL-108616]
+- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Benjamin Coddington) [RHEL-108616]
+- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Benjamin Coddington) [RHEL-108616]
+- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Benjamin Coddington) [RHEL-108616]
+- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Benjamin Coddington) [RHEL-108616]
+- NFSD: Fix callback decoder status codes (Benjamin Coddington) [RHEL-108616]
+- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Benjamin Coddington) [RHEL-108616]
+- nfsd: move error choice for incorrect object types to version-specific code. (Benjamin Coddington) [RHEL-108616]
+- nfsd: be more systematic about selecting error codes for internal use. (Benjamin Coddington) [RHEL-108616]
+- nfsd: Move error code mapping to per-version proc code. (Benjamin Coddington) [RHEL-108616]
+- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Benjamin Coddington) [RHEL-108616]
+- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Benjamin Coddington) [RHEL-108616]
+- nfsd: fix management of listener transports (Benjamin Coddington) [RHEL-108616]
+- NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (Benjamin Coddington) [RHEL-108616]
+- sunrpc: suppress warnings for unused procfs functions (Benjamin Coddington) [RHEL-108616]
+- NFSv4: Fix a deadlock when recovering state on a sillyrenamed file (Benjamin Coddington) [RHEL-108616]
+- SUNRPC: Prevent looping due to rpc_signal_task() races (Benjamin Coddington) [RHEL-108616]
+- SUNRPC: convert RPC_TASK_* constants to enum (Benjamin Coddington) [RHEL-108616]
+- NFS: Adjust delegated timestamps for O_DIRECT reads and writes (Benjamin Coddington) [RHEL-108616]
+- NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE (Benjamin Coddington) [RHEL-108616]
+- NFSv4.2: fix COPY_NOTIFY xdr buf size calculation (Benjamin Coddington) [RHEL-108616]
+- NFSD: Insulate nfsd4_encode_read_plus_data() from page boundaries in the encode buffer (Benjamin Coddington) [RHEL-108616]
+- NFSD: Insulate nfsd4_encode_read_plus() from page boundaries in the encode buffer (Benjamin Coddington) [RHEL-108616]
+- NFSD: Insulate nfsd4_encode_read() from page boundaries in the encode buffer (Benjamin Coddington) [RHEL-108616]
+- NFSD: Fix CB_GETATTR status fix (Benjamin Coddington) [RHEL-108616]
+- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Benjamin Coddington) [RHEL-108616]
+- nfsd: fix legacy client tracking initialization (Benjamin Coddington) [RHEL-108616]
+- nfs: clear SB_RDONLY before getting superblock (Benjamin Coddington) [RHEL-108616]
+- nfs: ignore SB_RDONLY when mounting nfs (Benjamin Coddington) [RHEL-108616]
+- platform/x86/amd/hsmp: Ensure success even if hwmon registration fails (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Enhance the print messages to prevent confusion (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Use IS_ENABLED() instead of IS_REACHABLE() (David Arcari) [RHEL-102859]
+- x86/platform/amd: replace down_timeout() with down_interruptible() (David Arcari) [RHEL-102859]
+- x86/platform/amd: move final timeout check to after final sleep (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: fix building with CONFIG_HWMON=m (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: acpi: Add sysfs files to display HSMP telemetry (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Report power via hwmon sensors (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Use a single DRIVER_VERSION for all hsmp modules (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (David Arcari) [RHEL-102859]
+- x86/platform/amd: Move the <asm/amd_node.h> header to <asm/amd/node.h> (David Arcari) [RHEL-102859]
+- x86/platform/amd: Clean up the <asm/amd/hsmp.h> header guards a bit (David Arcari) [RHEL-102859]
+- x86/platform/amd: Move the <asm/amd_hsmp.h> header to <asm/amd/hsmp.h> (David Arcari) [RHEL-102859]
+- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (David Arcari) [RHEL-102859]
+- x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (David Arcari) [RHEL-102859]
+- x86/amd_node: Use defines for SMN register offsets (David Arcari) [RHEL-102859]
+- x86/amd_node: Remove dependency on AMD_NB (David Arcari) [RHEL-102859]
+- x86/amd_node: Update __amd_smn_rw() error paths (David Arcari) [RHEL-102859]
+- x86/amd_nb: Move SMN access code to a new amd_node driver (David Arcari) [RHEL-102859]
+- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (David Arcari) [RHEL-102859]
+- x86/amd_nb: Simplify function 3 search (David Arcari) [RHEL-102859]
+- x86/amd_nb: Use topology info to get AMD node count (David Arcari) [RHEL-102859]
+- x86/amd_nb: Simplify root device search (David Arcari) [RHEL-102859]
+- x86/amd_nb: Simplify function 4 search (David Arcari) [RHEL-102859]
+- x86: Start moving AMD node functionality out of AMD_NB (David Arcari) [RHEL-102859]
+- x86/amd_nb: Clean up early_is_amd_nb() (David Arcari) [RHEL-102859]
+- x86/amd_nb: Restrict init function to AMD-based systems (David Arcari) [RHEL-102859]
+- x86/amd_nb: Add new PCI ID for AMD family 1Ah model 20h (David Arcari) [RHEL-102859]
+- x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h-70h (David Arcari) [RHEL-102859]
+- x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h (David Arcari) [RHEL-102859]
+- x86/amd_nb: Enhance SMN access error checking (David Arcari) [RHEL-102859]
+- hwmon: (k10temp) Check return value of amd_smn_read() (David Arcari) [RHEL-102859]
+- EDAC/amd64: Remove unused register accesses (David Arcari) [RHEL-102859]
+- EDAC/amd64: Check return value of amd_smn_read() (David Arcari) [RHEL-102859]
+- x86/amd_nb: Check for invalid SMN reads (David Arcari) [RHEL-102859]
+- x86/amd_nb: Add new PCI IDs for AMD family 0x1a (David Arcari) [RHEL-102859]
+- platform/x86: amd: Use *-y instead of *-objs in Makefiles [partial] (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Add support for HSMP protocol version 7 messages (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Change the error type (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Add new error code and error logs (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Use dev_groups in the driver structure (David Arcari) [RHEL-102859]
+- sysfs: Fix crash on empty group attributes array (David Arcari) [RHEL-102859]
+- sysfs: Introduce a mechanism to hide static attribute_groups (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Use name space while exporting module symbols (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (David Arcari) [RHEL-102859]
+- redhat/configs: Enable CONFIG_AMD_HSMP_ACPI and CONFIG_AMD_HSMP_PLAT on RHEL (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Move ACPI code to acpi.c (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Move platform device specific code to plat.c (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Move structure and macros to header file (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Create wrapper function init_acpi() (David Arcari) [RHEL-102859]
+- platform/x86/amd/hsmp: Create hsmp/ directory (David Arcari) [RHEL-102859]
+- Documentation/x86/amd/hsmp: Updating urls (David Arcari) [RHEL-102859]
+- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [RHEL-106430] {CVE-2025-38472}
+- s390/sclp: Fix SCCB present check (CKI Backport Bot) [RHEL-113557] {CVE-2025-39694}
+- ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Hangbin Liu) [RHEL-111150] {CVE-2025-38550}
+- devlink: add reserved fields to devlink_*_ops (Petr Oros) [RHEL-111906]
+- ixgbe: prevent from unwanted interface name changes (CKI Backport Bot) [RHEL-109607]
+- devlink: let driver opt out of automatic phys_port_name generation (CKI Backport Bot) [RHEL-109607]
+- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CKI Backport Bot) [RHEL-109528] {CVE-2025-38500}
+- dpll: add reserved fields to dpll_device_ops and dpll_pin_ops structs (Ivan Vecera) [RHEL-111904]
+- ice: use fixed adapter index for E825C embedded devices (Michal Schmidt) [RHEL-104010]
+- net: openvswitch: remove misbehaving actions length check (Aaron Conole) [RHEL-83440]
+- irdma: free iwdev->rf after removing MSI-X (Kamal Heib) [RHEL-103278 RHEL-95816]
+- sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113332] {CVE-2025-38718}
+- net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112247] {CVE-2023-53125}
+- net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112247] {CVE-2023-53125}
+- cpufreq: Move endif to the end of Kconfig file (Mark Langsdorf) [RHEL-112816]
+- cpufreq: Move CPPC configs to common Kconfig and add RISC-V (Mark Langsdorf) [RHEL-112816]
+- HID: core: Harden s32ton() against conversion to 0 bits (Benjamin Tissoires) [RHEL-111034] {CVE-2025-38556}
+- HID: stop exporting hid_snto32() (Benjamin Tissoires) [RHEL-111034] {CVE-2025-38556}
+- HID: simplify snto32() (Benjamin Tissoires) [RHEL-111034] {CVE-2025-38556}
+- redhat: set defaults for RHEL 9.7 (Augusto Caringi)
+- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport Bot) [RHEL-112783] {CVE-2025-38352}
+- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Audra Mitchell) [RHEL-110312] {CVE-2025-38396}
+- idpf: convert control queue mutex to a spinlock (Michal Schmidt) [RHEL-106051] {CVE-2025-38392}
+- redhat/configs: Enable CONFIG_MITIGATION_TSA for x86 (Waiman Long) [RHEL-83897]
+- x86/process: Move the buffer clearing before MONITOR (Waiman Long) [RHEL-83897 RHEL-83906] {CVE-2024-36357 CVE-2024-36350}
+- x86/microcode/AMD: Add TSA microcode SHAs (Waiman Long) [RHEL-83897 RHEL-83906] {CVE-2024-36357 CVE-2024-36350}
+- KVM: SVM: Advertise TSA CPUID bits to guests (Waiman Long) [RHEL-83897 RHEL-83906] {CVE-2024-36357 CVE-2024-36350}
+- x86/bugs: Add a Transient Scheduler Attacks mitigation (Waiman Long) [RHEL-83897 RHEL-83906] {CVE-2024-36357 CVE-2024-36350}
+- x86/bugs: Rename MDS machinery to something more generic (Waiman Long) [RHEL-83897 RHEL-83906] {CVE-2024-36357 CVE-2024-36350}
+- x86/idle: Use MONITOR and MWAIT mnemonics in <asm/mwait.h> (Waiman Long) [RHEL-83897]
+- x86/idle: Remove .s output beautifying delimiters from simpler asm() templates (Waiman Long) [RHEL-83897]
+- x86/idle: Standardize argument types for MONITOR{,X} and MWAIT{,X} instruction wrappers on 'u32' (Waiman Long) [RHEL-83897]
+- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and  prefer_mwait_c1_over_halt() (Waiman Long) [RHEL-83897]
+- x86/bugs: Rename mmio_stale_data_clear to cpu_buf_vm_clear (Waiman Long) [RHEL-83897]
+- x86/microcode: Consolidate the loader enablement checking (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-83897] {CVE-2025-22047}
+- x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Get rid of the _load_microcode_amd() forward declaration (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Remove unused save_microcode_in_initrd_amd() declarations (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Remove ugly linebreak in __verify_patch_section() signature (Waiman Long) [RHEL-83897]
+- x86/cpu: Introduce new microcode matching helper (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Remove ret local var in early_apply_microcode() (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Return bool from find_blobs_in_containers() (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-83897]
+- x86/CPU/AMD: Terminate the erratum_1386_microcode array (Waiman Long) [RHEL-83897] {CVE-2024-56721}
+- x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-83897]
+- x86/cpu: Fix formatting of cpuid_bits[] in scattered.c (Waiman Long) [RHEL-83897]
+- x86/cpufeatures: Add X86_FEATURE_AMD_WORKLOAD_CLASS feature bit (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-83897]
+- x86/bugs: Use code segment selector for VERW operand (Waiman Long) [RHEL-83897] {CVE-2024-50072}
+- x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-83897]
+- x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-83897]
+- x86/CPU/AMD: Improve the erratum 1386 workaround (Waiman Long) [RHEL-83897]
+- x86: Add a comment about the "magic" behind shadow sti before mwait (Waiman Long) [RHEL-83897]
+- x86/bugs: Revert "Reverse instruction order of CLEAR_CPU_BUFFERS" (Waiman Long) [RHEL-83897]
+- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl) [RHEL-108656]
+- Revert "drm/gem-dma: Use dma_buf from GEM object instance" (Robert Foss) [RHEL-106696]
+- Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance" (Robert Foss) [RHEL-106696]
+- Revert "drm/prime: Use dma_buf from GEM object instance" (Robert Foss) [RHEL-106696]
+- drm/framebuffer: Acquire internal references on GEM handles (Robert Foss) [RHEL-106696]
+- drm/gem: Acquire references on GEM handles for framebuffers (CKI Backport Bot) [RHEL-106696] {CVE-2025-38449}
+- Revert "e1000e: change k1 configuration on MTP and later platforms" (Michal Schmidt) [RHEL-110519]
+Resolves: RHEL-102859, RHEL-108616, RHEL-104148, RHEL-113559, RHEL-101033, RHEL-109583, RHEL-70228
+
 * Mon Sep 15 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-617.el9]
 - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113331] {CVE-2025-38718}
 - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-109212]