# changelog

author: qinxue <qinxue6@h-partners.com> - 1:1.44.2-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mptcp fix error handling rp_filter when kernel don't support mptcp


author: yixiangzhike <yixiangzhike007@163.com> - 2.3.1-7
changelog:
  - Fix CVE-2026-54369 CVE-2026-54370
  - New API acl_get_file_at, acl_set_file_at, acl_extended_file_at, acl_delete_def_file_at
  - New provided symbol LIBACL_1_3 for new API in libacl
  - The change that commands like 'getfacl -P symlink' or 'setfacl -P symlink' will fail now


author: Wenlong Zhang <zhangwenlong@loongson.cn> - 36.16.5-52
changelog:
  - Type:bugfix
   - ID:NA
   - SUG:NA
   - DESC:Fixed the issue of "D_isable root account" not being translated

   * Fri Feb 27 2026 zhaoyognhao <zhaoyonghao10@h-partners.com> - 36.16.5-51
   - Type:feature
   - ID:NA
   - SUG:NA
   - DESC: enable ssh login checkbox


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 36.16.5-54
changelog:
  - Type:feature
  - ID:NA
  - SUG:NA
  - DESC: add kernel 64k page size and kernel options Chinese translation support

   * Mon Mar 9 2026 zhaoyonghao <zhaoyognhao10@h-partners.com> - 36.16.5-53
   - Type:requirement
   - ID:NA
   - SUG:NA
   - DESC:Port GUI kernel switcher for ARM 64k


author: yueyuankun <yueyuankun@kylinos.cn> - 36.16.5-55
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: Fix permissions of the ssh config created by Anaconda
          fix(users): ensure SSH config directory exists before writing


author: mapengyuan <mapengyuan@xfusion.com> - 5.3.1-16
changelog:
  - Type:CVE
  - CVE:CVE-2025-2754 CVE-2025-2756 CVE-2025-5200
  - SUG:NA
  - DESC:fix CVE-2025-2754 CVE-2025-2756 CVE-2025-5200


author: majianhan <majianhan@kylinos.cn> - 5.3.1-17
changelog:
  - Type:CVE
  - CVE:CVE-2025-2752 CVE-2025-2755 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204
  - SUG:NA
  - DESC:fix CVE-2025-2752 CVE-2025-2755 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204


author: yaoxin <1024769339@qq.com> - 5.3.1-20
changelog:
  - Fix some CVEs: CVE-2025-70067, CVE-2025-70069, CVE-2025-70070,
    CVE-2025-70071, CVE-2025-70072, CVE-2026-10200, CVE-2026-10232,
    CVE-2026-14610


author: chengyechun<chengyechun1@huawei.com> - 32:9.18.21-3
changelog:
  - Type:CVE
  - CVE:CVE-2024-0760,CVE-2024-1737,CVE-2024-1975,CVE-2024-4076
  - SUG:NA
  - DESC:fix CVE-2024-0760,CVE-2024-1737,CVE-2024-1975,CVE-2024-4076


author: chengyechun<chengyechun1@huawei.com> - 32:9.18.21-4
changelog:
  - Type:CVE
  - CVE:CVE-2024-11187,CVE-2024-12705
  - SUG:NA
  - DESC:fix CVE-2024-111878 and CVE-2024-12705


author: tangce<tangce1@huawei.com> - 32:9.18.21-5
changelog:
  - Type:CVE
  - CVE:CVE-2025-8677,CVE-2025-40778,CVE-2025-40780
  - SUG:NA
  - DESC:fix CVE-2025-8677,CVE-2025-40778,CVE-2025-40780


author: tangce <tangce1@h-partners.com> - 32:9.20.21-2
changelog:
  - Type:CVE
  - CVE:CVE-2026-3039,CVE-2026-3593,CVE-2026-3593,CVE-2026-5946,CVE-2026-5947
  ,CVE-2026-5950
  - SUG:NA
  - DESC:fix CVE-2026-3039,CVE-2026-3593,CVE-2026-3593,CVE-2026-5946,CVE-2026-5947,CVE-2026-5950


author: tangce <tangce1@h-partners.com> - 32:9.20.21-3
changelog:
  - Type:CVE
  - CVE:CVE-2026-13321,CVE-2026-11721,CVE-2026-10723,CVE-2026-11605
  - SUG:NA
  - DESC:fix CVE-2026-13321,CVE-2026-11721,CVE-2026-10723,CVE-2026-11605


author: tangce <tangce1@h-partners.com> - 32:9.20.21-4
changelog:
  - Type:CVE
  - CVE:CVE-2026-10822,CVE-2026-11331,CVE-2026-12617,CVE-2026-13204,CVE-2026-11622
  - SUG:NA
  - DESC:fix CVE-2026-10822,CVE-2026-11331,CVE-2026-12617,CVE-2026-13204,CVE-2026-11622


author: yueyuankun <yueyuankun@kylinos.cn> - 3.8.2-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix syntax error on SymbolKind.toString method
         fix interface syntax error


author: lijian <lijian2@kylinos.cn> - 1:1.36.1-21
changelog:
  - Type:cves
  - ID:CVE-2026-38754
  - SUG:NA
  - DESC:re-fix CVE-2026-38754, clear stale IFS state on expansion error


author: Han Jinpeng <hanjinpeng@kylinos.cn> - 309-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: remove incorrect provides cockpit-machines and cockpit-machines-ovirt
          remove require libvirt and libvirt-client


author: shaojiansong <shaojiansong@kylinos.cn> - 309-8
changelog:
  - Fix networking: renaming of bridges and other groups (upstream fdba746e4, RHEL-131249, backport to openEuler-24.03-LTS-Next cockpit 309, keep member activation consistent when group name is changed.)


author: shaojiansong <shaojiansong@kylinos.cn> - 309-9
changelog:
  - Fix ws: only hand out the saved password to authorize messages once. Prevents account lockout via pam_faillock when sudo sends a 'Try again' prompt, by poisoning the password after the first use.


author: dongyuzhen <dongyuzhen@h-partners.com> - 1.6.22-20
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:delete task asynchronously to avoid containerd be killed when delete is blocking


author: Yu Peng <yupeng@kylinos.cn> - 1.6.22-23
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: Fix ctr snapshot mount produce invalid mount command for empty option.


author: Qin Fandong <qinfandong@kylinos.cn> - 9.4-23
changelog:
  - Type:CVE
  - ID:CVE-2026-56392
  - SUG:NA
  - DESC:fix heap overflow in unexpand with large tab stop values


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix readdir issues
         h3: fix query of concurrent streams
         noproxy: fix the IPV6 network mask pattern match
         krb5_gssapi: fix memory leak on error path
         openldap: fix memory-leak in error path
         conn: fix hostname move on connection reuse 
         pop3: fix CAPA response termination detection
         libssh: properly free sftp_attributes
         openssl: fix a potential memory leak of params.cert


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:urlapi: avoid null deref if setting blank host to url
         urlapi: skip appending NULL pointer query


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-26
changelog:
  - Type:CVE
  - CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224
  - SUG:NA
  - DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:formdata: validate callback is non-NULL before use
         tftp: correct the filename length check


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-28
changelog:
  - Type:CVE
  - CVE:CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
  - SUG:NA
  - DESC:fix CVE-2026-1965 CVE-2026-3783 CVE-2026-3784


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-29
changelog:
  - Type:CVE
  - CVE:CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168
  - SUG:NA
  - DESC:fix CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-30
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:http1: fix potential NULL dereference in Curl_h1_req_parse_read
         mqtt: fix EOF handling


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-32
changelog:
  - Type:CVE
  - CVE:CVE-2026-8286 CVE-2026-8924 CVE-2026-8927 CVE-2026-9547 CVE-2026-10536 CVE-2026-12064
  - SUG:NA
  - DESC:fix CVE-2026-8286 CVE-2026-8924 CVE-2026-8927 CVE-2026-9547 CVE-2026-10536 CVE-2026-12064


author: lingsheng <lingsheng1@h-partners.com> - 2.90-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Update DNS records after pruning DHCP leases
         cache: Fix potential NULL deref in arcane situations.
         Fix potential memory leak
         Fix possible SIGSEGV in bpf.c
         allow binding mac with ip6


author: Liu Qingtao <liu.qingtao2@zte.com.cn> - 2.90-5
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:Ignore Wincompatible-pointer-types error when compiling with gcc-14.3


author: luoguocui <luoguouci@h-partners.com> - 2.90-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix bounds checking in check_ia()
         Fix SEGV in Dbus code
         More fixes for DHCP ops in Dbus when DHCP not configured


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.90-9
changelog:
  - Type:CVE
  - CVE:CVE-2026-4890 CVE-2026-4891 CVE-2026-4892 CVE-2026-4893 CVE-2026-5172
  - SUG:NA
  - DESC:Fix NSEC bitmap parsing infinite loop
         Verify rdlen field in RRSIG packets
         Fix buffer overflow in helper.c with large CLIDs
         Fix broken client subnet validation
         Fix buffer overflow vulnerability in extract_addresses()


author: zhongjiawei<zhongjiawei1@huawei.com> - 2:18.09.0-347
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:delete redundant characters to prevent make failure in golang 1.24


author: jade_t<yzd50036@gmail.com> - 2:18.09.0-351
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix the installation conflict between docker-engine and containerd


author: Xianglai Li <lixianglai@loongson.cn> - 202308-40
changelog:
  - revert the patch "0201-BaseTools-Scripts-GccBase-Align-.text-and-.data-to-4.patch" on loongarch
  - Fix the issue of failing to parse the serial port base address on loongarch


author: tlhf <taolinghongfei@h-partners.com> - 202308-49
changelog:
  - Fix the issue on ARM64 platforms where virtual machines created
  - via the `virt-install` command with the `--location` parameter
  - pointing to an ISO fail to boot into the ISO installation interface
  - normally and drop directly into the UEFI Shell. This regression
  - was introduced by patches addressing CVE-2025-2296 that
  - refactored the QemuKernelLoaderFsDxe driver.


author: zhang_jian <zhang_jian7@hoperun.com> - 5.8-1
changelog:
  - Upgrade to 5.8
  - Add usage hint and '-h' flag to display option summary
  - Linux: return correct status if poll(2) is interrupted
  - Add return value checks for malloc(3) and pipe(2)


author: wangkai <13474090681@163.com> - 25.3.2.6-18
changelog:
  - Fix CVE-2026-48855, CVE-2026-48858, CVE-2026-49759, CVE-2026-49760, CVE-2026-53422,
    CVE-2026-54886, CVE-2026-54887, CVE-2026-54891, CVE-2026-55950, CVE-2026-55952


author: fly_fzc <2385803914@qq.com> - 2.8.1-4
changelog:
  - fix CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407
        CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412


author: Funda Wang <fundawang@yeah.net> - 6.1.1-43
changelog:
  - Type: CVE
  - ID: CVE-2026-58049
  - SUG: NA
  - DESC: fix CVE-2026-58049 (out-of-bounds write in RASC decoder)


author: Funda Wang <fundawang@yeah.net> - 6.1.1-45
changelog:
  - Type: CVE
  - ID: CVE-2026-75141, CVE-2026-75142, CVE-2026-75143, CVE-2026-75144, CVE-2026-75146
  - SUG: NA
  - DESC: fix CVE-2026-75141 (heap buffer overflow in hvcC box writer), CVE-2026-75142 (stack buffer overflow in MPEG-PS muxer), CVE-2026-75143 (heap buffer overflow in RIST protocol reader), CVE-2026-75144 (heap buffer overflow in VC-2/Dirac RTP packetizer) and CVE-2026-75146 (out-of-bounds read in DASH demuxer)


author: Funda Wang <fundawang@yeah.net> - 6.1.1-46
changelog:
  - Type: CVE
  - ID: CVE-2026-30998
  - SUG: NA
  - DESC: fix CVE-2026-30998 (resource leak in zmqsend tool)


author: Funda Wang <fundawang@yeah.net> - 6.1.1-47
changelog:
  - Type: CVE
  - ID: CVE-2026-66036, CVE-2026-66038, CVE-2026-66039
  - SUG: NA
  - DESC: fix CVE-2026-66036 (heap out-of-bounds write in hqdn3d filter), CVE-2026-66038 (information disclosure in LCL/ZLIB decoder) and CVE-2026-66039 (integer overflow in MACE6 decoder)


author: Liu Wang <1823363429@qq.com> - 140.13.0-2
changelog:
  - Add StartupWMClass=firefox so that GNOME can correctly recognize the Firefox window and associate it with the icon.


author: Chenzhen <chenzhen126@huawei.com> - 2.0.2-4
changelog:
  - fix restart thread block by resetting probe pid
    fix service failed when cmd server thread starts late
    fix OOB write when getting proc cmdline
    fix restart gopher failed for check gopher pid multi times
    fix run sig hander core for probe mng create later
    fix potential nullptr dereference in libevent openssl cb
    ipc: reset probe_flags to 0 when restarting probes
    tcpprobe: do not flush snooped procs to avoid deleting tcp link by accident
    fix buffer overflow in sscanf
    fix buffer overflow and ret value of sscanf
    snooper: enlarge channel map and shorten poll timeout to ease event loss
    system_infos: fix oob of arrays and double free
    Refactor to reduce memory usage of metric record
    bugfix: path parsing error when gala-gopher running in container
    fix strdup relative error
    tcpprobe: fix incorret struct type of tracepoint event
    fix UAF of probe bin after parsing invalid config
    snooper: fix opposite judgment logic of container info


author: JDLihoo <donglihao1@huawei.com> - 2.0.2-6
changelog:
  - restore the pristine source tarball and package upstream changes as patches
  - consolidate upstream changes into 25 Git-formatted patches
  - exclude build artifacts, IDE metadata, profiling images, and unrelated line-ending churn


author: yaoxin <yao_xin001@hoperun.com> - 0.4.50-1
changelog:
  - Update to 0.4.50:
  - Core:
    * Better Gobject Introspection annotation coverage.
    * Improved error handling for gegl chain processing.
    * Added accessors for pad meta-data, to be able to show names and descriptions in UIs.
    * GeglColor: more lax parameters for g_arapm_values_cmp
    * exr-save: store 16bpc files as half, fixing gimp#10778
    * ff-load, ff-save: fix build with FFmpeg 7
    * dither: do processing in linear when all levels==2


author: Funda Wang <fundawang@yeah.net> - 9.56.1-14
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DECS: Fix CVE-2025-27830, CVE-2025-27832, CVE-2025-27833, CVE-2025-27834, CVE-2025-27835, CVE-2025-27836


author: hdliu <dev03108@linx-info.com> - 9.56.1-15
changelog:
  - Add font mappings so that the PS interpreter can rasterize Chinese content using the two fonts STKaiti-Regular and STheiti-Regular.


author: dillon chen <dillon.chen@gmail.com> - 9.56.1-20
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DESC:fix CVE-2025-7462
  - sync PR patch from Mon Mar 30 2026 majianhan <majianhan@kylinos.cn>


author: wangshuo <wangshuo@kylinos.cn> - 9.56.1-22
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DESC:Correct backport for CVE-2025-7462
  -      Remove unsafe gp_ferror(pdev->file) call from return statement to avoid NULL dereference


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: yaoxin <1024769339@qq.com> - 2:3.2.4-6
changelog:
  - Fix CVE-2026-18301, CVE-2026-18302, CVE-2026-18303, CVE-2026-18304,
    CVE-2026-18305, CVE-2026-18306, CVE-2026-18308 and CVE-2026-18309


author: shaojiansong <shaojiansong@kylinos.cn> - 2:3.2.4-7
changelog:
  - Fix unsigned integer underflow in PSD plugin block_rem variable that allows arbitrary code execution via crafted PSD files (CVE-2026-59090)


author: zhaoyonghao10 <zhaoyonghao10@h-partners.com> - 2.78.3-16
changelog:
  - apply 3 patches: backport-Fix-a-buffer-leak-when-finishing-connecting.patch, backport-Add-thread-pool-stress-test-to-task-c.patch, backport-Cleanup-trailing-spaces-task-c.patch


author: zhusicong <zhusicong@h-partners> - 2.78.3-17
changelog:
  - fix CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014, CVE-2026-58015, CVE-2026-58016


author: litenglong <litenglong@kylinos.cn> - 2.38-115
changelog:
  - aarch64: delete revert-aarch64-Use-memcpy_simd-as-the-default-memcpy.patch to align with the upstream community.


author: huang-xiaoquan <huangxiaoquan1@huawei.com> - 1.21.4-42
changelog:
  - Type:Feature
  - CVE:NA
  - SUG:NA
  - DESC: [stepopt2] Add goexperiment.StepOpt2 for optimized step function in runtime


author: huzhangying <huzhangying@huawei.com> - 1.21.4-43
changelog:
  - Type:CVE
  - CVE:CVE-2025-58183,CVE-2025-58189,CVE-2025-61724,CVE-2025-58188,CVE-2025-58185,CVE-2025-58187,CVE-2025-61723,CVE-2025-47912,CVE-2025-58186
  - SUG:NA
  - DESC:fix CVE-2025-58183,CVE-2025-58189,CVE-2025-61724,CVE-2025-58188,CVE-2025-58185,CVE-2025-58187,CVE-2025-61723,CVE-2025-47912,CVE-2025-58186


author: huzhangying <huzhangying@huawei.com> - 1.21.4-45
changelog:
  - Type:CVE
  - CVE:fix CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61728,CVE-2025-68121,CVE-2025-61723
  - SUG:NA
  - DESC:fix CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61728,CVE-2025-68121,CVE-2025-61723


author: huzhangying <huzhangying@huawei.com> - 1.21.4-46
changelog:
  - Type:CVE
  - CVE:CVE-2026-27139,CVE-2026-27142,CVE-2026-25679
  - SUG:NA
  - DESC:fix CVE-2026-27139,CVE-2026-27142,CVE-2026-25679


author: huzhangying <huzhangying@huawei.com> - 1.21.4-48
changelog:
  - Type:CVE
  - CVE:CVE-2026-27143,CVE-2026-27144,CVE-2026-32288,CVE-2026-27140
  - SUG:NA
  - DESC:fix CVE-2026-27143,CVE-2026-27144,CVE-2026-32288,CVE-2026-27140


author: Julian Zhu <julian.oerv@isrc.iscas.ac.cn> - 1.21.4-40
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix the bootstrap failure caused by the backport of RISC-V RVA23 support


author: yechao-w <wang.yechao255@zte.com.cn> - 1:2.12-45
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: kern/riscv/efi/init: Use time register in grub_efi_get_time_ms()


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 1:2.12-47
changelog:
  - Type:CVE
  - CVE:CVE-2025-61661,CVE-2025-61662,CVE-2025-54771,CVE-2025-54770,CVE-2025-61663,CVE-2025-61664
  - SUG:NA
  - DESC:commands/usbtest: Ensure string length is sufficient in usb string processing
         commands/usbtest: Use correct string length field
         tests/lib/functional_test: Unregister commands on module unload
         normal/main: Unregister commands on module unload
         gettext/gettext: Unregister gettext command on module unload
         net/net: Unregister net_set_vlan command on unload
         kern/file: Call grub_dl_unref() after fs->fs_close()
         commands/test: Fix error in recursion depth calculation


author: Han Gao <gaohan@iscas.ac.cn> - 1:2.12-48
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:configure: Add -mno-relax on riscv*
         configure: Defer check for -mcmodel=large until PIC/PIE checks are done


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 1:2.12-50
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: workaround the BuildRequires mis-preinstallation issue on build systems


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 1:2.12-51
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:loader/i386/pc/linux: Fix resource leak
         Revert "lzma: Make sure we don't dereference past array
         loader/efi/linux: Correctly terminate load_options member
         loader/efi/linux: Use sizeof() instead of constant
         loader/efi/linux: Use proper type for len variable
         loader/efi/linux: Do not pass excessive size for source string
         loader/efi/linux: Remove useless assignment
         loader/efi/linux: Reuse len variable
         loader/efi/linux: Unload previous Linux kernel/initrd before updating kernel size
         normal/charset: Fix underflow and overflow in loop init
         lib/LzmaEnc: Validate len before subtracting
         osdep/unix/hostdisk: Fix signed integer overflow
         fs/zfs: Fix another memory leak in ZFS code
         fs/xfs: Fix large extent counters incompat feature support


author: lvgenggeng <lvgenggeng@uniontech.com> - 1:2.12-53
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: mmap/mmap: Add missing grub_malloc() failure check
          mmap/mmap: Fix resource leak
          mmap/mmap: Fix integer overflow in binary search


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 1:2.12-54
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:grub-mkimage: Do not generate empty SBAT metadata
         efi: Fix several memory leaks of UEFI handles
         script/execute: Add a NULL check after grub_calloc() call
         normal/cmdline: Add grub_calloc() failure check and fix hist_lines state loss
         osdep/linux/ofpath: Add missing strdup() failure checks
         lib/relocator: Fix dereference after NULL check
         osdep/linux/getroot: Add missing strdup() failure checks
         script/execute: Add missing grub_strdup() failure check


author: lizhengde <lizhengde@xfusion.com> - 1.16.2-14
changelog:
  - Type:CVE
  - CVE:CVE-2026-53702
  - SUG:NA
  - DESC:Stack buffer overflow in GStreamer H.265 parser. Fix incorrect loop bound.


author: yaoxin <yao_xin001@hoperun.com> - 1.20.3-3
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47599,CVE-2024-47613,CVE-2024-47775
    CVE-2024-47776,CVE-2024-47777,CVE-2024-47778,CVE-2024-47774
    CVE-2024-47540,CVE-2024-47602,CVE-2024-47601,CVE-2024-47603
    CVE-2024-47834,CVE-2024-47537,CVE-2024-47597,CVE-2024-47543
    CVE-2024-47596,CVE-2024-47539,CVE-2024-47546,CVE-2024-47598


author: Funda Wang <fundawang@yeah.net> - 1.20.3-9
changelog:
  - fix CVE-2026-17072 (GStreamer-SA-2026-0073), GStreamer-SA-2026-0072,
    GStreamer-SA-2026-0068
  - fix CVE-2026-53705 (GStreamer-SA-2026-0035)


author: yanglu <yanglu72@h-partners.com> - 2.9.5-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:queues:Do not use pendconn_grab_from_px
         queues:Make sure we call process_srv_queue when leaving
         queue:Make process_srv_queue return the number of streams


author: xinghe <xinghe2@h-partners.com> - 2.9.5-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:haproxy: only tid 0 must not sleep if got signal
         server/addr: fix tune.events.max-events-at-once event miss and leak


author: yaoxin <yao_xin001@hoperun.com> - 1.14.5-1
changelog:
  - Update to 1.14.5:
    * Added signed Windows msi binary and signed Apple dmg binary files.
    * Moved examples to the HDF5Examples folder in the source tree.
    * Added support for using zlib-ng package as the zlib library
    * Disable CMake UNITY_BUILD for hdf5
    * Removed "function/code stack" debugging configuration option
    * Added configure options for enabling/disabling non-standard programming language features
    * Added the CMake variable HDF5_ENABLE_ROS3_VFD to the HDF5 CMake config
      file hdf5-config.cmake. This allows it to easily detect if the library
      has been built with or without read-only S3 functionality.
    * Fixed many CVE:
      CVE-2024-29157,CVE-2024-29158,CVE-2024-29159,CVE-2024-29160,CVE-2024-29161,CVE-2024-29162
      CVE-2024-29163,CVE-2024-29164,CVE-2024-29165,CVE-2024-29166,CVE-2024-32605,CVE-2024-32606
      CVE-2024-32607,CVE-2024-32608,CVE-2024-32609,CVE-2024-32610,CVE-2024-32611,CVE-2024-32612
      CVE-2024-32613,CVE-2024-32614,CVE-2024-32615,CVE-2024-32616,CVE-2024-32617,CVE-2024-32618
      CVE-2024-32619,CVE-2024-32620,CVE-2024-32621,CVE-2024-32622,CVE-2024-32623,CVE-2024-32624
      CVE-2024-33873,CVE-2024-33874,CVE-2024-33875,CVE-2024-33876,CVE-2024-33877,CVE-2018-13871
      CVE-2018-13875,CVE-2018-14034


author: Funda Wang <fundawang@yeah.net> - 1.14.5-2
changelog:
  - add patches from azure linux for fixing CVE-2025-2153, CVE-2025-2310,
    CVE-2025-2914, CVE-2025-2926, CVE-2025-6816, CVE-2025-2925,
    CVE-2025-2924, CVE-2025-44905, CVE-2025-6269, CVE-2025-6750,
    CVE-2025-6857, CVE-2025-7067, CVE-2025-7068, CVE-2025-6858,
    CVE-2025-2923, CVE-2025-2913, CVE-2025-6516, CVE-2025-6818,
    CVE-2025-6817, CVE-2025-6856, CVE-2025-7069


author: zhang_jian <zhang_jian7@hoperun.com> - 3.20-1
changelog:
  - Update to 3.20
  - A build failure with uClibc has been fixed.
  - Some memory handling errors in t_auth were fixed.


author: wangxiaomeng <wangxiaomeng@kylinos.cn> - 3.21-1
changelog:
  - Update to 3.21
  - Support has been added for Global Segmentation Offload (GSO) and Global Receive Offload (GRO) under Linux.
  - The iperf3 server provides more information about various error conditions to the client.
  - The maximum value for the --set-mss option is now 32K.
  - A race condition leading to a crash when closing sockets at the end of a test has been fixed.


author: jade_t <yzd50036@gmail.com> - 3.2.0-19
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:modify the git clone download address in kata_integration_clone


author: jade_t <yzd50036@gmail.com> - 3.2.0-20
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix the problem of self-compilation failure in the kata-containers source package


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.5.156
changelog:
  - !24560 [sync]urma: create resources in ubmad_post_send before the ack message returns
  - !24604 ub: udma: Optimize udma jetty id access logic.
  - ub: udma: Optimize udma jetty id access logic.
  - !24597 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence
  - urma: fix workqueue use-after-free in ubagg_exit teardown sequence
  - urma: kref_get in find_add_tpid_reuse
  - urma: create resources in ubmad_post_send before the ack message returns
  - urma: change log level to rl in ubagg_import_jetty and ubagg_import_seg
  - urma: fix nullptr in ubcore_remove_jetty_from_jetty_grp
  - !24536 [sync]iommu/ummu: Fix use-after-free in ummu_core_alloc_separate_tdev
  - iommu/ummu: Fix use-after-free in ummu_core_alloc_separate_tdev
  - !24492 ub: udma: Adjust the order of delete global variables.
  - ub: udma: Adjust the order of delete global variables.
  - !24393 [sync]urma: fix several tp state and adapter disconnect cleanup bugs
  - urma: fix several tp state and adapter disconnect cleanup bugs
  - urma: split tpid_reuse from vtpn to avoid use_after_free


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.6.157
changelog:
  * Fri Jul 10 2026 Zihang Luo <luozihang2@huawei.com> - 6.6.0-159.4.5.156.20260710.3b1ce153a752
  - !24749 [sync]urma: free jfe events outside lock
  - urma: reduce ubagg topo log noise
  - urma: drain jfe event lists in batches to avoid soft-lockup
  - urma: free jfe events outside lock
  - urma: free completion events outside jfe lock
  - !24745 urma: fix get tp list from ops to single group id
  - !24744 urma: free tpid by uobj
  - !24743 urma: Fix the issue of inaccurate timing for some functions in DFX
  - !24739 [sync]urma: fix UAF of accessing token_id in log.
  - urma: fix get tp list from ops to single group id
  - urma: free tpid by uobj
  - urma: fix UAF of accessing token_id in log.
  - urma: Fix the issue of inaccurate timing for some functions in DFX
  - !24735 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free
  - urma: fix tpid_reuse attached to vtpn causes use_after_free
  - !24703 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure
  - urma: retry import jetty/jfr on EIO from tpid reuse failure
  - urma: limit ubagg connect exchange logs
  - !24641 [sync]urma: limit ubcore logs in reuse paths
  - urma: limit ubcore logs in reuse paths


author: Zhengzhou Chen <chenzhengzhou@huawei.com> - 6.6.0-159.4.6.157.20260713.a4e2472763b2
changelog:
  - !24791 [sync]urma: fix UAF of accessing jfs/jetty in log.
  - urma: fix UAF of accessing jfs/jetty in log.
  - !24778 urma: fix tpid uobj used by ubcore_get_tp_list
  - !24775 [sync]urma: ratelimit import jetty/jfr error logs
  - urma: fix tpid uobj used by ubcore_get_tp_list
  - urma: ratelimit import jetty/jfr error logs


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-159.4.6.158
changelog:
  - The RISC-V architecture features have been updated.
    For more details, refer to the rvck-olk repository.


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.7.160
changelog:
  - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid
  - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va
  - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid
  - ub/ubdevshm: Support for acquiring va is a sub-range of registered va
  - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup
  - urma: use xarray for ubagg/ubcore session lookup
  - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg
  - urma: make ratelimit burst configurable for ubcore/uburma/ubagg
  - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer
  - urma: use vzalloc for ubmad tjetty and ini_rtbuffer


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.8.161
changelog:
  - !24998 ub: udma: Adaptation Flush Done flag
  - !25046 [sync]urma: fill vtpn param in import jetty
  - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle
  - [sync]urma: fill vtpn param in import jetty
  - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes
  - [sync]urma: add check when RC jetty bind not RC tp_handle
  - net:unic:Fixed the problem of storage device hardware version error
  - ub:ubase:Fixed the problem of CDMA Entity has not using USC
  - ub:ubase:Fixed the problem of storage device hardware version error
  - ub: udma: Adaptation Flush Done flag
  - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters
  - urma: drop param_set_uint_minmax for ratelimit burst setters


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-159.4.8.162
changelog:
  - The RISC-V architecture features have been updated.
  - Add basic support for lanxin SoC.
  - For more details, refer to the rvck-olk repository.


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.9.163
changelog:
  - !25652 [sync]urma: add check type in free driver obj
  - [sync]urma: add check type in free driver obj


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.10.164
changelog:
  - !26030 [sync] urma: ratelimit JFC cleanup error logs
  - !26029 [sync] urma: fix pointer API return value comments
  - urma: ratelimit JFC cleanup error logs
  - [sync]urma: fix pointer API return value comments


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.11.165
changelog:
  - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity
  - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity
  - !26586 [sync]urma: fix uobj_put race in uobj remove commit
  - urma: fix uobj_put race in uobj remove commit
  - !26197 [sync]urma: allow to set priority for urma_ping
  - urma: allow to set priority for urma_ping
  - !26170 urma: sync support dev/eid sharing mode
  - urma: support dev/eid sharing mode


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.12.166
changelog:
  - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform
  - x86/cpu/hygon: fix performance regression for hygon platform
  - !26660 Fix CVE-2026-64561
  - !26667 [sync]urma: reject set_opt when object is already activated
  - urma: reject set_opt when object is already activated
  - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available


author: Zihang Luo <luozihang2@huawei.com> - 6.6.0-159.4.2.153.20260624.9e7b708a0357
changelog:
  - !24182 [sync] urma: fix ubcore device attr sl flag error
  - urma: fix ubcore device attr sl flag error
  - !24173 [sync]urma: sync bugfix from OLK-6.6 from 1ac4d401e863 to cbbe52c8c74d
  - urma: fix tpid status and state reset
  - urma: fix reuse use cnt not balance cause dead lock
  - urma: fix deadlock when using loopback mode
  - urma: add order_type conversion for jfs/jfr/jetty/tjetty config


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.2.153.20260625.abca3926d80c
changelog:
  - !24201 mm/numa_remote: fix variable undeclared error whe
  - mm/numa_remote: fix variable undeclared error when CONFIG_MEMORY_RELIABLE isn't enabled
  - !24187 [sync] PR-24170: ub:ubus: Optimize the initialization performance of USI INT_TYPE2
  - ub:ubus: Optimize the initialization performance of USI INT_TYPE2
  - ub:ubus: Resolve the link change message is not reported before sending notify message
  - !24183 ub: udma: Intercept unsupported operations.
  - ub: udma: Intercept unsupported operations.


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.2.153.20260626.9bafeaf4201f
changelog:
  - !24240 ub: ubase: clear FE reset status register during probe
  - !24233 [sync]urma: sync bugfix from OLK-6.6 from 8f7de4b6 to 6483ac53
  - ub: ubase: clear FE reset status register during probe
  - !24232 [sync] PR-24231: ub:ubus: Always invalidate tlb during decoder unmap
  - urma: fix isref send no rsp to confirm state
  - urma: add huge lock in create tpid
  - urma: fix ref in ubmad and fix UAF in ubmad_rt_work_handler
  - urma: fix flush done event dispatch
  - ub:ubus: Always invalidate tlb during decoder unmap
  - !24218 urma: optimize sleep and logging in TPID reuse and rate-limited logs
  - urma: optimize sleep and logging in TPID reuse and rate-limited logs
  - !24214 ub: udma: Optimize the process of refcount_inc
  - ub: udma: Optimize the process of refcount_inc


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.2.153.20260627.78b2f79ac1db
changelog:
  - !24260 [sync]urma: Support user mode to obtain statistical results of kernel interrupt times
  - urma: Support user mode to obtain statistical results of kernel interrupt times
  - urma: free vtpn after free tpid reuse
  - !24250 [sync]urma: delete whether head is null in select tpid
  - urma: delete whether head is null in select tpid


author: Liming An <anliming1@h-partners.com> - 6.6.0-159.4.2.153.20260627.c0e012b0953b
changelog:
  - !24279 [sync]iommu/ummu: Fix nested TLB invalidation commands
  - iommu/ummu: Fix nested TLB invalidation commands
  - iommu/ummu: Fix NULL pointer dereference in logic_ummu_tlb_inv_walk


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.4.155
changelog:
  - !24347 [sync]urma: fix urma ping server cleanup paths
  - urma: fix file lifetime race between open, close and device removal
  - urma: fix urma ping server cleanup paths
  - !24294 [sync]urma: fix call trace during JFR deletion
  - urma: fix call trace during JFR deletion


author: yaoxin <1024769339@qq.com> - 1.28-3
changelog:
  - Fix CVE-2026-15811, CVE-2026-15812 and CVE-2026-15813
  - Add patches to make the tests of previous fixes run on 1.28


author: lingsheng <lingsheng1@h-partners.com> - 3.7.1-7
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5915,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5915 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: yuanchao <1050706328@qq.com> - 2.1.12-13
changelog:
  - Fix function undeclared,incompatible pointer and parameter lack in 'add-testcases-for-event.c-apis.patch',support clang build


author: andy <liuyang01@kylinos.cn> - 2.1.12-14
changelog:
  - Fix leak in evbuffer_add_file() on empty files
  - evthread: fix NULL dereference in evthread_setup_global_lock_()
  - Fix potential null dereference in http-server


author: shixuantong <shixuantong1@h-partners.com> - 2.1.12-15
changelog:
  - fix: arc4_getword integer overflow, detected by -fsanitize=undefined
  - Fix divide-by-zero in ev_token_bucket_get_tick_
  - fixed missing check for null after strdup in evutil_inet_pton_scope
  - Fix integer-overflow in ev_token_bucket_cfg_new
  - Fix integer overflow in HTTP version
  - Fix potential Null pointer dereference in bufferevent_openssl.c
  - Fix potential Null pointer dereference in dns-example.c
  - Fix potential Null pointer dereference in event-read-fifo.c
  - Fix unlikely (for libevent) UB in HT_GROW()


author: Funda Wang <fundawang@yeah.net> - 2.1.12-16
changelog:
  - Don't use deprecated functions when building against OpenSSL 3.0
  - fix linkage of shared libraries


author: fly_fzc <2385803914@qq.com> - 2.1.12-17
changelog:
  - fix CVE-2026-63387 CVE-2026-63388 CVE-2026-63384 CVE-2026-63381
        CVE-2026-63385 CVE-2026-63382 CVE-2026-63379 CVE-2026-63383


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-9
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:fix CVE-2026-0968 CVE-2026-0967 CVE-2026-0966 CVE-2026-0965 CVE-2026-0964 CVE-2025-14821


author: zhangbinqin <zhangbinqin@h-partners.com> - 1.11.0-6
changelog:
  - Type:CVE
  - CVE:CVE-2026-7598
  - SUG:NA
  - DESC:add username_len bounds checking to fix CVE-2026-7598


author: liyufnei <liyunfei33@huawei.com> - 17.0.6-58
changelog:
  - update to llvm-for-oe-17.0.6-2603.0.1
  - release-note https://gitcode.com/openeuler/llvm-project/releases/llvm-for-oE-17.0.6-2603.0.1


author: liyufnei <liyunfei33@huawei.com> - 17.0.6-60
changelog:
  - update to llvm-for-oe-17.0.6-2603.0.2
  - release-note https://gitcode.com/openeuler/llvm-project/releases/llvm-for-oE-17.0.6-2603.0.2


author: eastb233 <xiezhiheng@huawei.com> - 17.0.6-64
changelog:
  - update to llvm-for-oe-17.0.6-2606.0.1
  - release-note https://atomgit.com/openeuler/llvm-project/releases/llvm-for-oE-17.0.6-2606.0.1


author: Qin Fandong <qinfandong@kylinos.cn> - 2.17.2-2
changelog:
  - Type:CVE
  - ID:CVE-2026-34481, CVE-2026-49844
  - SUG:NA
  - DESC:fix CVE-2026-34481 and CVE-2026-49844: serialize non-finite floating-point values as JSON strings


author: Funda Wang <fundawang@yeah.net> - 4:10.11.19-1
changelog:
  - update to 10.11.19
  - fix systemd unit files: restore --basedir=@prefix@ and @libexecdir@
    variable substitution. The 10.5.15 refresh had hardcoded
    --basedir=/var/lib/mysql/ (datadir as basedir) and /usr/libexec paths,
    which made the runtime plugin_dir resolve to a wrong location so that
    plugin loading failed and the mariadb service could not start
    (openEuler issue #310). The provider_* plugin cnf sed workaround is no
    longer needed and has been removed.
  - enable the cracklib-password-check plugin by default for password
    strength validation; the subpackage was already in place but gated by
    --with cracklib since the 10.5.10 rebase.


author: Funda Wang <fundawang@yeah.net> - 20250211-1
changelog:
  - update to 2025021 for fix CVE-2024-28047, CVE-2024-31157, CVE-2024-39279,
    CVE-2024-28127, CVE-2024-29214, CVE-2024-24582, CVE-2023-34440, CVE-2024-37020,
    CVE-2024-39355, CVE-2023-43758, CVE-2024-36293, CVE-2024-31068


author: Funda Wang <fundawang@yeah.net> - 20250512-1
changelog:
  - update to 20250512 to fix CVE-2024-28956, CVE-2025-24495, CVE-2025-20012,
    CVE-2024-45332, CVE-2025-20623, CVE-2024-43420, CVE-2025-20054, CVE-2025-20103


author: Funda Wang <fundawang@yeah.net> - 20250812-1
changelog:
  - update to 20250812 to fix CVE-2025-20053, CVE-2025-20109, CVE-2025-21090,
    CVE-2025-22839, CVE-2025-22840, CVE-2025-22889, CVE-2025-24305, CVE-2025-26403,
    CVE-2025-32086


author: yaoxin <1024769339@qq.com> - 2.4.16.6-1
changelog:
  - Update to 2.4.16.6:
    * metadata: fix caching of JWKs from jwks_uri when using the default expiry setting
    * info: fix requests to the info hook with extend_session=false
    * cookie: OIDCCookieSameSite default behaviour Lax
    * cookie: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
    * cache: avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory
      cannot be found on the system upon initaliizing cache mutexes and the file cache
    * metadata: allow plain HTTP URLs in metadata elements jwks_uri and signed_jwks_uri to ensure backwards
      compatibility with <=2.4.15.7 and to support private/test deployments
    * code: address warnings from static code analysis tool CodeChecker


author: Funda Wang <fundawang@yeah.net> - 102.9.0-9
changelog:
  - set CC and CXX so that clang won't be selected automatically
  - fix compilation errors in sw_64 support


author: yanglu <yanglu72@h-partners.com> - 2:0.95-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Change UDP and ICMP sockets binding to accept a source IP from the -a CLI option


author: Qin Fandong <qinfandong@kylinos.cn> - 3.94.0-10
changelog:
  - Type:CVE
  - ID:CVE-2026-16389
  - SUG:NA
  - DESC:fix CVE-2026-16389: guard against integer overflow in CERT_Hexify


author: wangkai <13474090681@163.com> - 2:2022.10.3-4
changelog:
  - Fix CVE-2026-42616, CVE-2026-42617, CVE-2026-42618, CVE-2026-46569,
    CVE-2026-46570, CVE-2026-46571, CVE-2026-46572, CVE-2026-56135, CVE-2026-56136


author: HelloZ <3161422489@qq.com> - 1.00.029-5
changelog:
  - Add patch 0001-support-DSCP-and-higher-version-gcc-compilation-opti.patch
  - support DSCP and higher version gcc compilation options


author: zhangbinqin<zhangbinqin@h-partners.com> - 9.6p1-13
changelog:
  - Type:CVE
  - CVE:CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388 
  - SUG:NA
  - DESC:fix CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388


author: wangkai <13474090681@163.com> - 2.6.9-8
changelog:
  - Fix CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
    CVE-2026-13117, CVE-2026-13122, CVE-2026-13698


author: Funda Wang <fundawang@yeah.net> - 4:5.38.0-11
changelog:
  - split out patch adding link to libperl.so into two separated patches,
    and sync it with mageia, which is a better version than fedora
  - disable cleaning empty perl directories
  - use git lfs storage


author: sqfu <dev01203@linx-info.com> - 1.647-1
changelog:
  - update version to 1.647
  - Fix Makefile rules for Changes
  - Another example to bind columns 
  - Fix fetchall_arrayref for undefined NAME


author: hanjinpeng <hanjinpeng@kylinos.cn> - 6.92-2
changelog:
  - Type:CVE
  - ID:CVE-2026-60074, CVE-2026-60075
  - SUG:NA
  - DESC:fix CVE-2026-60074 and CVE-2026-60075: restrict numeric date fields to ASCII digits; cap the length of a string handed to the parsers


author: Funda Wang <fundawang@yeah.net> - 1:2.0209-4
changelog:
  - Type: CVE
  - ID: CVE-2026-8177
  - SUG: NA
  - DESC: fix CVE-2026-8177: replace domParseChar with xmlValidateName to prevent OOB UTF-8 read


author: shaojiansong <shaojiansong@kylinos.cn> - 3.5-5
changelog:
  - Drop seunshare -k/--kill support; the killall() helper is racy and redundant with killall -Z, replace the call site with an error message recommending killall -Z.


author: shenzhongwei <shenzhongwei@kylinos.cn> - 1.3.8b-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix: %patchN is deprecated (7 usages found), use %patch N (or %patch -P N)


author: wangkai <13474090681@163.com> - 1.3.9a-1
changelog:
  - Update to 1.3.9a for fix CVE-2026-42167
  - Add 'proxy' sub-package with unbundled mod_proxy
  - Use libsodium to provide ed25519 key support for mod_sftp
  - Update logrotate snippet to use try-reload-or-restart rather than reload
    for distributions with systemd 229 or later


author: yaoxin <1024769339@qq.com> - 3.1.52-1
changelog:
  - Update to 3.1.52 for fix CVEs: CVE-2026-67322, CVE-2026-67323,
    CVE-2026-67324, CVE-2026-67325 and CVE-2026-67326


author: lizhengde <lizhengde@xfusion.com> - 2.12.0-4
changelog:
  - Type:CVE
  - CVE:CVE-2026-11816
  - SUG:NA
  - DESC:Security fix: path traversal in archive extraction. Add base_dir parameter to _filter_safe_paths to properly validate extraction paths.


author: wangkai <13474090681@163.com> - 3.13.5-1
changelog:
  - Update to 3.13.5
    * Fix CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34516,
      CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525


author: yaoxin <1024769339@qq.com> - 3.14.1-1
changelog:
  - Update to 3.14.1 for fix CVEs: CVE-2026-54273,CVE-2026-54274,CVE-2026-54275
    CVE-2026-54276,CVE-2026-54277,CVE-2026-54278,CVE-2026-54279,CVE-2026-54280


author: Qin Fandong <qinfandong@kylinos.cn> - 3.11.6-42
changelog:
  - Type:CVE
  - CVE:CVE-2026-6879
  - SUG:NA
  - DESC:fix CVE-2026-6879: avoid quadratic behavior in xml.etree.ElementPath index predicates


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-72
changelog:
  - ub: don't check ers addr size is power of 2
  - ub: support process msg code exch
  - ub: replace malloc with g_malloc0
  - Migration/urma:explicitly set URMA JFS tp_type to URMA_CTP
  - MAINTAINERS: add me as maintainer to virtio-snd
  - virtio-snd: remove TODO comments
  - virtio-snd: handle 5.14.6.2 for PCM_INFO properly(CVE-2026-3196)
  - virtio-snd: fix max_size bounds check in input cb(CVE-2026-3195)
  - virtio-snd: tighten read amount in in_cb(CVE-2026-3195)
  - hw/arm: Close unreleased out_fault_fd
  - pci: avoid the info qtree crash caused by arm-smmuv3-accel


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-73
changelog:
  - target/arm: add kunpeng 920 V1 support
  - target/arm: add kunpeng 950 V1 support
  - target/arm: add kunpeng 920 V2 support
  - hw/virtio/virtio-crypto: verify asym request size(CVE-2025-14876)
  - cryptodev-builtin: Limit the maximum size(CVE-2025-14876)
  - block/vmdk: fix OOB read in vmdk_read_extent()(CVE-2026-2243)
  - lsi53c895a: keep a reference to the device while SCRIPTS execute(CVE-2024-6519)


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-74
changelog:
  - virtio-blk: avoid using ioeventfd state in irqfd conditional
  - machine: Use error handling when CPU type is checked
  - hw/core/cpu: Update description of CPUState::node
  - hw/cpu/core: Cleanup unused included header in core.c
  - hw/cpu/cluster: Cleanup unused included header in cluster.c
  - hw/arm/bcm2836: Simplify use of reset-cbar property
  - hw/arm/bcm2836: Use ARM_CPU mp-affinity property
  - hw: Simplify accesses to the CPUState::start-powered-off property
  - hw/ppc/xive2_regs: Remove unnecessary cpu.h inclusion
  - hw/mips: Inline bios.h definitions
  - docs: use "buses" rather than "busses"
  - hw/ppc/spapr_cpu_core: Access QDev properties with proper API
  - hw/vfio: fix iteration over global VFIODevice list
  - vfio/iommufd: Remove the use of stat() to check file existence
  - vfio/container: Rename vfio_init_container to vfio_set_iommu
  - target/sparc: Simplify qemu_irq_ack
  - tests/avocado: add a simple i386 replay kernel test
  - tests/avocado: modernise the drive args for replay_linux
  - block: Fix crash when loading snapshot on inactive node
  - roms/efi: clean up edk2 build config
  - roms/efi: exclude efi shell from secure boot builds
  - Migration/urma:Avoid polling jfc timeouts resulting from hardware failures.
  - hyperv/syndbg: check length returned by cpu_physical_memory_map()(CVE-2026-3842)
  - ub: fix ers update error
  - kvm/arm/virt: Implement kvm-vtimer-status
  - hw/arm/virt: Implement timer early inject PV support
  - Migration/urma: replace ulseep with usleep in poll_jfc_wait


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-76
changelog:
  - target/arm: Conditionally add KVM writable properties based on RME
  - Migration/urma:adapt urma to use udma device to process iterative migration
  - Migration/urma: drop unused index in qemu_urma_init_ram_blocks
  - ub_ummu: default uninstall all tecte when cfgi all invalidate and free vdev when tecte uninstall
  - ub ummu: realize mapt_cmdq_ctxt_attr regster process
  - vfio ub: support config fd for vfio-ub device
  - hw/core/machine-smp: Deprecate unsupported "parameter=1" SMP configurations
  - hw/core/machine-smp: Calculate total CPUs once in machine_parse_smp_config()
  - hw/core/machine: Introduce the module as a CPU topology level
  - hw/core/machine: Support modules in -smp
  - hw/core: Introduce module-id as the topology subindex
  - hw/core: Support module-id in numa configuration
  - hw/i386: split x86.c in multiple parts
  - i386/cpu: Fix i/d-cache topology to core level for Intel CPU
  - i386/cpu: Use APIC ID info to encode cache topo in CPUID[4]
  - i386/cpu: Use APIC ID info get NumSharingCache for CPUID[0x8000001D].EAX[bits 25:14]
  - i386/cpu: Consolidate the use of topo_info in cpu_x86_cpuid()
  - i386/cpu: Introduce bitmap to cache available CPU topology levels
  - i386: Split topology types of CPUID[0x1F] from the definitions of CPUID[0xB]
  - i386/cpu: Decouple CPUID[0x1F] subleaf with specific topology level
  - i386: Introduce module level cpu topology to CPUX86State
  - i386: Support modules_per_die in X86CPUTopoInfo
  - i386: Expose module level in CPUID[0x1F]
  - i386: Support module_id in X86CPUTopoIDs
  - i386/cpu: Introduce module-id to X86CPU
  - tests: Add test case of APIC ID for module level parsing
  - hw/i386/pc: Support smp.modules for x86 PC machine
  - i386: Add cache topology info in CPUCacheInfo
  - i386/cpu: Use CPUCacheInfo.share_level to encode CPUID[4]
  - i386/cpu: Use CPUCacheInfo.share_level to encode CPUID[0x8000001D].EAX[bits 25:14]
  - i386: Add support for SUCCOR feature
  - i386/cpu: fixup number of addressable IDs for processor cores in the physical package
  - kvm: Allow kvm_arch_get/put_registers to accept Error**
  - i386/cpu: Don't enumerate the "invalid" CPU topology level
  - hw/core: Make CPU topology enumeration arch-agnostic
  - qapi/qom: Define cache enumeration and properties for machine
  - hw/core: Check smp cache topology support for machine
  - hw/core: Add a helper to check the cache topology level
  - hw/core/machine-smp: Initialize caches_bitmap before reading
  - hw/core/machine-smp: Fix error message parameter
  - i386/cpu: Extract a common fucntion to setup value of MSR_CORE_THREAD_COUNT
  - i386/cpu: Drop the variable smp_cores and smp_threads in x86_cpu_pre_plug()
  - i386/cpu: Drop cores_per_pkg in cpu_x86_cpuid()
  - i386/topology: Update the comment of x86_apicid_from_topo_ids()
  - i386/topology: Introduce helpers for various topology info of different level
  - target/i386/cpu: Consolidate the use of warn_report_once()
  - i386/cpu: Track a X86CPUTopoInfo directly in CPUX86State
  - i386/cpu: Hoist check of CPUID_EXT3_TOPOEXT against threads_per_core
  - cpu: Remove nr_cores from struct CPUState
  - i386/cpu: Set up CPUID_HT in x86_cpu_expand_features() instead of cpu_x86_cpuid()
  - i386/cpu: Set and track CPUID_EXT3_CMP_LEG in env->features[FEAT_8000_0001_ECX]
  - hw/core/machine: Reject thread level cache
  - i386/cpu: Support module level cache topology
  - i386/cpu: Update cache topology with machine's configuration
  - i386/pc: Support cache topology in -machine for PC machine
  - i386/cpu: add has_caches flag to check smp_cache configuration
  - i386/cpu: Introduce enable_cpuid_0x1f to force exposing CPUID 0x1f
  - i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check
  - i386/cpu: Rename enable_cpuid_0x1f to force_cpuid_0x1f
  - i386/cpu: Refine comment of CPUID2CacheDescriptorInfo
  - i386/cpu: Add descriptor 0x49 for CPUID 0x2 encoding
  - i386/cpu: Add default cache model for Intel CPUs with level < 4
  - i386/cpu: Present same cache model in CPUID 0x2 & 0x4
  - i386/cpu: Consolidate CPUID 0x4 leaf
  - i386/cpu: Drop CPUID 0x2 specific cache info in X86CPUState
  - i386/cpu: Add x-vendor-cpuid-only-v2 option for compatibility
  - i386/cpu: Mark CPUID[0x80000005] as reserved for Intel
  - i386/cpu: Rename AMD_ENC_ASSOC to X86_ENC_ASSOC
  - i386/cpu: Fix CPUID[0x80000006] for Intel CPU
  - i386/cpu: Add legacy_intel_cache_info cache model
  - i386/cpu: Add legacy_amd_cache_info cache model
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x2
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x4
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x80000005
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x80000006
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x8000001D
  - i386/cpu: Use a unified cache_info in X86CPUState
  - i386/cpu: Introduce cache model for SierraForest
  - i386/cpu: Introduce cache model for GraniteRapids
  - i386/cpu: Introduce cache model for SapphireRapids
  - i386/cpu: Add a "x-force-cpuid-0x1f" property
  - i386/cpu: Enable 0x1f leaf for SierraForest by default
  - i386/cpu: Enable 0x1f leaf for SierraForest by default
  - i386/cpu: Enable 0x1f leaf for GraniteRapids by default
  - i386/cpu: Enable 0x1f leaf for SapphireRapids by default
  - i386/cpu: Mark EBX/ECX/EDX in CPUID 0x80000000 leaf as reserved for Intel
  - i386/cpu: Mark CPUID 0x80000007[EBX] as reserved for Intel
  - i386/cpu: Mark CPUID 0x80000008 ECX bits[0:7] & [12:15] as reserved for Intel/Zhaoxin
  - i386/cpu: Reorder CPUID leaves in cpu_x86_cpuid()
  - i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX[23:16]
  - i386/cpu: Fix cpu number overflow in CPUID.01H.EBX[23:16]
  - i386/cpu: Honor maximum value for CPUID.8000001DH.EAX[25:14]
  - hw/core: allow parameter=1 for SMP topology on any machine
  - docs/deprecated: Remove undeprecated SMP description
  - i386/tcg: Make CPUID_HT and CPUID_EXT3_CMP_LEG supported
  - i386/hvf: Make CPUID_HT supported
  - target/i386/cpu: Move addressable ID encoding out of compat property in CPUID[0x1]
  - target/i386: add compatibility property for pdcm feature


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-77
changelog:
  - system/physmem: Fix possible double free when destroy cpu address space
  - Migration: add virtcca secure CVM live migration support
  - Migration: add virtcca secure CVM live migration support
  - virtcca migration: bugfix, meson option 'virtcca_migration' default value set to disabled
  - ub: update VFIO UB IRQ index enum definitions
  - ub: add VFIO_UB_REINIT_IRQ_INDEX for reinit interrupt support
  - ub: return error code to vm
  - ub: fix passthrough errno to vm
  - ub: reinit irq set failed don't stop vm
  - migration/cgs: fix some function name spell error
  - migration/cgs: Fix mismatched allocator in write_numa_info_to_sysfs
  - ub: fix fill_rq_cq not checking fill_cq return value
  - ub: fix ub cq depth
  - ub: pass ub feature to guest os
  - migration/cgs: bugfix, adding poison ignore CONFIG_VIRTCCA_MIGRATION when building non-aarch64 target to avoid error


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-78
changelog:
  - system/physmem: disable guest RAM core dump for cca
  - vhost: Remove unused log_fd variable in vhost_dev_log_resize()
  - i386/cpu: Allow cache to be shared at thread level
  - hw/vfio: Allow multiple vfio devices migration if none support P2P_MIGRATION


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-79
changelog:
  - virtio-gpu: fix overflow check when allocating 2d image (CVE-2026-3886)
  - ui/vnc: fix OOB read updating VNC update frequency stats(CVE-2026-48003)
  - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914)


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-81
changelog:
  - hw/net/rocker_of_dpa: Check group ID pointers are not NULL(CVE-2022-36648)
  - hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match()
  - ub_ummu: support CMD_TLBI_OS_ASID_U and CMD_TLBI_HYP_ASID_U command
  - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare(CVE-2026-5763)


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-82
changelog:
  - tcg: move free_tcg_plugin_context to the correct macro range
  - hw/arm/virt: Fix build error on ARM
  - virtio-blk: fix zone report buffer out-of-memory (CVE-2026-5761)
  - iotests/copy-before-write: lower throttle rate to fix cbw-timeout flakiness


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-83
changelog:
  - hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise() (CVE-2026-16043)
  - hw/9pfs: add xattr FID limit to prevent memory exhaustion (CVE-2026-8348)
  - ui/vnc: validate SetPixelFormat field ranges (CVE-2026-15578)
  - usbredir: fix use-after-free on buffered bulk packet overflow (CVE-2026-15705)
  - usbredir: fix infinite loop and SIGFPE with zero max_packet_size (CVE-2026-63319)
  - hw/9pfs: add response_buffer_size transport callback
  - 9pfs/virtio: implement response_buffer_size callback
  - 9pfs/xen: implement response_buffer_size callback
  - hw/9pfs: cap Treaddir allocation (CVE-2026-9238)
  - ui/vnc: fix OOB write in VNC stats array (CVE-2026-48002)
  - ui/vnc: fix OOB write in lossy rect worker code (CVE-2026-48002)
  - ui/vnc: fix OOB write in vnc_refresh_lossy_rect (CVE-2026-48002)
  - ui/vnc: fix out-of-bounds write in lossy refresh dirty marking (CVE-2026-61475)
  - ui/vnc: remove redundant rows computation
  - hw/9pfs: fix O_TRUNC bypass on read-only export (CVE-2026-63318)


author: Funda Wang <fundawang@yeah.net> - 4.18.2-34
changelog:
  - disable automatic maintenance when autopatching with git
    https://github.com/git/git/commit/1942d48380fec53f76361e9adebef15b5db9628a
  - sync patches within branches


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 8.2312.0-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix passing the value to EscapeChar
         Do not free the uninitialized cstring
         Keep original free pattern
         network subsystem: improve connection failure error message
         Fix runConf NULL pointer refence
         rainerscript: do not try to call a function if it does not exist
         nsd_ptcp regression fix: remove debugging messages emited to stderr
         Fix legacy $ActionQueueDiscardMark parameter


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 8.2312.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:gnutls bugfix: Avoid blocking sockets during TLS handshake
         gnutls bugfix: Add timeout to GnuTLS handshake
         core: fix potential NULL ptr access on HUP in very early startup phase
         omfwd: fix segfault in UDP freeaddrinfo
         gnutls TLS driver: fix small memory leak
         rsyslog startup bugfix: cosmetic memory leak
         core: fix potential misadressing in sigmask
         covscan: remove defect type of RESOURCE_LEAK
         Fix a buffer overflow when the argument to replace is empty


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 8.2312.0-9
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:omusrmsg bugfix: potential null pointer dereference causes segfault
         omusrmsg bugfix: potential double free, which can cause segfault
         imjournal: fix double sd_journal_close() during thread cancellation
         imuxsock: Add statistics counter for discarded messages
         omjournal: Fix priority value
         fix stringop-overread warning in omusrmsg
         fix hashtable realloc memset range
         fix off-by-one buffer overflow


author: qujingling <qujingling@huawei.com> - 8.2312.0-10
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:imjournal: initialize instance fields to avoid invalid free
         imjournal: fix vulnerability in state file creation


author: zhangbinqin <zhangbinqin@h-partners.com> - 8.2312.0-12
changelog:
  - Type:CVE
  - ID:CVE-2026-19654
  - SUG:NA
  - DESC:fix CVE-2026-19654 imtcp: guard regex framing match at line start


author: shixuantong <sxt1001@qq.com> - 3.2.2-158
changelog:
  - Type:CVE
  - CVE:CVE-2026-47240 CVE-2026-47241 CVE-2026-47242
  - SUG:NA
  - DESC:fix CVE-2026-47240 CVE-2026-47241 CVE-2026-47242


author: xinghe <xingheyd@163.com> - 4.19.3-9
changelog:
  - Type:cves
  - ID:CVE-2026-3238 CVE-2026-3012 CVE-2026-4480 CVE-2026-4408
  - SUG:NA
  - DESC:fix CVE-2026-3238 CVE-2026-3012 CVE-2026-4480 CVE-2026-4408


author: xinghe <xingheyd@163.com> - 4.19.3-10
changelog:
  - Type:cves
  - ID:CVE-2026-6949 CVE-2026-58224 CVE-2026-58216 CVE-2026-58218 CVE-2026-58221 CVE-2026-58222
  - SUG:NA
  - DESC:fix CVE-2026-6949 CVE-2026-58224 CVE-2026-58216 CVE-2026-58218 CVE-2026-58221 CVE-2026-58222


author: Xu Raoqing <609179072@qq.com> - 2.9.4-19
changelog:
  - oidc_child: fix wrong usage of printf format (a2bd434)
  - ad: use right memory context in GPO code (723a30b)
  - Responder: fix passkey auth when user-verification is off (4c6c010)
  - KRB5: fix mem leak in authenticate_stored_users (8b452b3)
  - KCM: fix use-after-free in kcm_read_options (50ae35f)
  - NSS: Fix wrong condition invalidating an optimization (6d71291)


author: Qin Fandong <qinfandong@kylinos.cn> - 2.9.4-22
changelog:
  - Type:CVE
  - ID:CVE-2026-14474
  - SUG:NA
  - DESC:fix CVE-2026-14474: warn when ldap_sudo_search_base falls back to root DN to prevent privilege escalation


author: StratoVirt Team <stratovirt@openeuler.org> - 2.4.0-12
changelog:
  - sync x86_64 and aarch64 to upstream master 71a0c899 as Patch0014-Patch1016
  - keep the 2.4.0 downstream patch stack (Patch0001-Patch0008 and
    Patch0012-Patch0013) for riscv64 only, which upstream does not support
  - drop Patch0009-Patch0011: Patch0009/Patch0010 are superseded by the
    riscv64 reworks Patch0012/Patch0013, and Patch0011 no longer applies
    since Patch0006 removed the field it fixes
  - add virtio_pmem, vhost_vsock, vhostuser_fs, virtio_balloon, virtio_serial
    and virtio_rng features


author: shixuantong <shixuantong1@h-partners.com> - 1.0.3-43
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix(xalarm): fix service stop timeout and PID lock release issues


author: shixuantong <shixuantong1@h-partners.com> - 1.0.3-46
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix sysSentry service restart issues: PID lock release and socket init


author: shixuantong <shixuantong1@h-partners.com> - 1.0.3-47
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix event switch invalidation after sysSentry service restart
         verify event switch state by reading proc file before skipping re-open


author: shixuantong <sxt1001@qq.com> - 1.0.3-48
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix PYNAME define
         cleanup: uninstall log_utils.h file
         Fix the issue of missing security compilation options
         fix bmc_ras_sentry compile failed on old gcc
         fix(script): check if driver exists before removing it
         feat(sentry_msg_monitor): add kernel-driver version compatibility check on startup


author: shixuantong <sxt1001@qq.com> - 1.0.3-49
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix potential overflow in  xalarm_report_event()
         Fix CTL message length overflow when data exceeds 3 digits


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


author: yaoxin <1024769339@qq.com> - 1:9.0.119-1
changelog:
  - Update to 9.0.119 for fix CVEs: CVE-2026-50229, CVE-2026-53404,
    CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956,
    CVE-2026-55957


author: langfei <langfei@huawei.com> - 2024a-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Aysén Region moves from -04/-03 to -03; new zone;
  -	Improve recent commentary for Chilean decrees;
  -	No need for America/Coyhaique in zonenow.tab.


author: Liu Chao <liuchao173@huawei.com> - 2024a-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Moldova has used EU transition times since 2022
  	Most of BC moves from PDT to Pacific Time on 03-09
  	Delay America/Vancouver tm_isdst transition


author: fundawang <fundawang@yeah.net> - 2.10.1-10
changelog:
  - Fix CVE-2026-7867 (as-user mount authorization bypass, local privilege escalation)
  - Normalize License field to SPDX identifiers (GPL-2.0-or-later, LGPL-2.0-or-later)
  - Drop unused 
  - Align BuildRequires versions with upstream configure.ac (systemd 209, libmount >= 2.30, add libblkid-devel)
  - Convert pkg-config style BuildRequires to pkgconfig() form
  - Drop unused intltool BuildRequires (i18n uses GNU gettext)


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B008
changelog:
  - urma: update recv wr list bath, add cna field to, add multi-transport types FLUSH_DMA, and enable without backup wr
  - umq: update handle fc rx buf, optimize post recv wr, and optimize ub_imm structure with
  - umdk: update ums support building umdk-ums-64kb
  - umdk: add main package dependency metadata


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B009
changelog:
  - umdk: update docs clarify UMDK build, ums Adapting Compilation for, update urpc dev config, and cam format master a2
  - urma: update urma/admin reserve nul when, urma/perftest reject zero size, using nlattr to query, and fix the data plane
  - umq: update add shared transport public, jetty pool management, adapt urma_get_rjetty, support create/deatroy logic umq, and support logic umq post/poll
  - umdk: drop stale paths from refreshed tarball


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B010
changelog:
  - urpc: update urpc/perftest bound framework eid, urpc/perftest bound concurrent latency, and fix urma_seg_t ext value
  - umq: update umq/perftest bound string option, set correct rjetty flag, fix umq post tx, packet deduplication, and support wr trace
  - urma: update fix potential out-of-bounds access, perftest log register need, umra fix rqe_cnt in, and remove stale netlink declarations
  - umdk: update umq update max bind, converge related bug fix, urpc case fix, and cam fix linewidth and


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B011
changelog:
  - umq: update flow-control SGE management, revert the patch that, add func str for, and reduce empty poll operations
  - urma: update split common UT files, add print cna for, disable failback and health, and fix perftest tp aware
  - umdk: update cam fix Chinese comments, ums new test cases, umq suport tp_type/tp_mode configration, and revise code according to
  - umdk: drop stale paths from refreshed tarball


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B012
changelog:
  - urma: update fix show_stats failed log, add param check when, refactor failback task management, del_tag_in_user, and refine log level for
  - umdk: update cam fix cam docs
  - umq: update support configuring the port and fix incorrect __ATOMIC_RELAXED usage


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B013
changelog:
  - umdk: update ums fix orphan socket, test add ums ut, fix urpc case name, and fix urma case name
  - urma: update optimize bondp_post_jetty_send_wr, copy extra vwr to, split remaining URMA UT, add thread local cache, and fix rqe_cnt err when
  - umq: update add validation for rjetty_size, extract common qbuf pool, expose duplicate flow control, and add trace point and
  - umdk: drop stale paths from refreshed tarball


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B014
changelog:
  - urma: update optimize bond rearm jfc, optimization messages in get, use source MAC for, and correct spelling mistakes in
  - umq: update add reference counting for, reset alloc/free trace, add param validate for, and resolve coredump caused by


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B015
changelog:
  - umdk: update cam Add structs for, reinforce ums smoke test, and fix ums case fail
  - umq: update fix invalide poll tx, fix coredump in umq_uninit, add option timestamp, and add tiny qbuf pool
  - urma: update DFX function adds interrupt, simplify urma_perftest socket api, refactor failback trigger in, and resend failed cr one


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B016
changelog:
  - umdk: update cam change cpp operator, cam add adaptation to, ums add UT for, and cam add shmem rdma_basckend_base
  - umq: update fix get fc_event failed, revert fc sge management, revert qbuf cnt, adaptive send threshold, and add qbuf alloc/free perf
  - urma: update fix bond jetty shared, git-test, fix typo for CNA, add API fuzz coverage, fix perftest bond_mode balance, and build
  - umdk: drop stale paths from refreshed tarball


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B017
changelog:
  - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg
  - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks
  - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to
  - umdk: drop stale paths from refreshed tarball


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B018
changelog:
  - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem
  - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer
  - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id
  - umdk: drop stale paths from refreshed tarball


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B019
changelog:
  - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier
  - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build
  - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num
  - umdk: drop stale paths from refreshed tarball


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B020
changelog:
  - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty
  - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info
  - umdk: update cam Update the base and fix
  - umdk: drop stale paths from refreshed tarball


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B021
changelog:
  - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua
  - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for
  - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE
  - urpc: update docs fix documentation drift and docs refine generated documentation
  - dlock: fix docs fix documentation drift


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B022
changelog:
  - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256
  - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype
  - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK
  - umdk: drop stale paths from refreshed tarball


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B023
changelog:
  - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation
  - umdk: update ums update docs add
  - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B024
changelog:
  - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers
  - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability


author: luyizhou <luyizhou1@huawei.com> - 26.06.0-B025
changelog:
  - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage
  - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for
  - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc
  - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck -
  - umdk: drop stale paths from refreshed tarball


author: gaihuiying <eaglegai@163.com> - 1.17.1-15
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: gaihuiying <eaglegai@163.com> - 1.17.1-16
changelog:
  - Type:cves
  - CVE:CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960
  - SUG:NA
  - DESC:fix CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960


author: gaihuiying <eaglegai@163.com> - 1.17.1-17
changelog:
  - Type:cves
  - CVE:CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390,CVE-2026-44608
  - SUG:NA
  - DESC:fix CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390,CVE-2026-44608


author: gaihuiying <eaglegai@163.com> - 1.17.1-19
changelog:
  - Type:CVE
  - CVE:CVE-2026-46582,CVE-2026-40691,CVE-2026-42955,CVE-2026-44621,CVE-2026-44687,CVE-2026-44690,CVE-2026-50046,CVE-2026-50243,CVE-2026-50248,CVE-2026-50251,CVE-2026-55708,CVE-2026-55717,CVE-2026-55990,CVE-2026-56416
  - SUG:NA
  - DESC:fix CVE-2026-46582,CVE-2026-40691,CVE-2026-42955,CVE-2026-44621,CVE-2026-44687,CVE-2026-44690,CVE-2026-50046,CVE-2026-50243,CVE-2026-50248,CVE-2026-50251,CVE-2026-55708,CVE-2026-55717,CVE-2026-55990,CVE-2026-56416


author: yixiangzhike <yixiangzhike007@163.com> - 2.39.1-31
changelog:
  - backport community patches
      fix columns reduction
      fix memory leak issue in read_Subid_range
      fix off-by-one in maximum last sector calculation
      fix memory corruption in size calculation
      fix memory corruption in read buffers


author: herengui <herengui@kylinsec.com.cn> - 7.4.3-5
changelog:
  - Fix CVE-2026-34475: Fix http/1.1 absolute form dissection edge case leading to cache poisoning or authentication bypass


author: zuohsh <zuohongsheng@kylinos.cn> - 2:9.0.2092-40
changelog:
  - fix 5 test failed: Test_ccomplete_no_exec_via_typeref, Test_ccomplete_typeref_completion_still_works, Test_find_completion_backtick_in_path, Test_path_modeline, Test_timer_oneshot.


author: chenyanpan <chenyanpan@xfusion.com> - 1.21.4-4
changelog:
  - Fix CVE-2026-15146
  - Fix CVE-2026-58469
  - Fix CVE-2026-58470
  - Fix CVE-2026-58471
  - Fix CVE-2026-58472


author: liliguang <liliguang@baidu.com> - 1.4.30-1
changelog:
  - update to 1.4.30
  - Fix compiler warnings in testsuite when building on AIX.
  - The API docs still said DatabaseError was thrown for operations on a closed
    database, but since 1.4.10 we throw its subclass DatabaseClosedError instead.


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: Wang Kui <wangkui35@h-partners.com> - 1.20.11-41
changelog:
  - Fix CVE-2025-49176 CVE-2025-49179 CVE-2025-49180 CVE-2022-49737
    CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-42
changelog:
  - fix CVE-2022-49737 CVE-2025-49175 CVE-2025-49176 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-45
changelog:
  - fix CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264


