# changelog

author: qinxue <qinxue6@h-partners.com> - 1:1.44.2-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mptcp fix error handling rp_filter when kernel don't support mptcp


author: yixiangzhike <yixiangzhike007@163.com> - 2.3.1-7
changelog:
  - Fix CVE-2026-54369 CVE-2026-54370
  - New API acl_get_file_at, acl_set_file_at, acl_extended_file_at, acl_delete_def_file_at
  - New provided symbol LIBACL_1_3 for new API in libacl
  - The change that commands like 'getfacl -P symlink' or 'setfacl -P symlink' will fail now


author: shixuantong <shixuantong1@h-partners.com> - 1.0.3-43
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix(xalarm): fix service stop timeout and PID lock release issues


author: shixuantong <shixuantong1@h-partners.com> - 1.0.3-46
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix sysSentry service restart issues: PID lock release and socket init


author: shixuantong <shixuantong1@h-partners.com> - 1.0.3-47
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix event switch invalidation after sysSentry service restart
         verify event switch state by reading proc file before skipping re-open


author: shixuantong <sxt1001@qq.com> - 1.0.3-48
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix PYNAME define
         cleanup: uninstall log_utils.h file
         Fix the issue of missing security compilation options
         fix bmc_ras_sentry compile failed on old gcc
         fix(script): check if driver exists before removing it
         feat(sentry_msg_monitor): add kernel-driver version compatibility check on startup


author: shixuantong <sxt1001@qq.com> - 1.0.3-49
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix potential overflow in  xalarm_report_event()
         Fix CTL message length overflow when data exceeds 3 digits


author: mapengyuan <mapengyuan@xfusion.com> - 5.3.1-16
changelog:
  - Type:CVE
  - CVE:CVE-2025-2754 CVE-2025-2756 CVE-2025-5200
  - SUG:NA
  - DESC:fix CVE-2025-2754 CVE-2025-2756 CVE-2025-5200


author: majianhan <majianhan@kylinos.cn> - 5.3.1-17
changelog:
  - Type:CVE
  - CVE:CVE-2025-2752 CVE-2025-2755 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204
  - SUG:NA
  - DESC:fix CVE-2025-2752 CVE-2025-2755 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204


author: yaoxin <1024769339@qq.com> - 5.3.1-20
changelog:
  - Fix some CVEs: CVE-2025-70067, CVE-2025-70069, CVE-2025-70070,
    CVE-2025-70071, CVE-2025-70072, CVE-2026-10200, CVE-2026-10232,
    CVE-2026-14610


author: Zihang Luo <luozihang2@huawei.com> - 6.6.0-159.4.2.153.20260624.9e7b708a0357
changelog:
  - !24182 [sync] urma: fix ubcore device attr sl flag error
  - urma: fix ubcore device attr sl flag error
  - !24173 [sync]urma: sync bugfix from OLK-6.6 from 1ac4d401e863 to cbbe52c8c74d
  - urma: fix tpid status and state reset
  - urma: fix reuse use cnt not balance cause dead lock
  - urma: fix deadlock when using loopback mode
  - urma: add order_type conversion for jfs/jfr/jetty/tjetty config


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.2.153.20260625.abca3926d80c
changelog:
  - !24201 mm/numa_remote: fix variable undeclared error whe
  - mm/numa_remote: fix variable undeclared error when CONFIG_MEMORY_RELIABLE isn't enabled
  - !24187 [sync] PR-24170: ub:ubus: Optimize the initialization performance of USI INT_TYPE2
  - ub:ubus: Optimize the initialization performance of USI INT_TYPE2
  - ub:ubus: Resolve the link change message is not reported before sending notify message
  - !24183 ub: udma: Intercept unsupported operations.
  - ub: udma: Intercept unsupported operations.


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.2.153.20260626.9bafeaf4201f
changelog:
  - !24240 ub: ubase: clear FE reset status register during probe
  - !24233 [sync]urma: sync bugfix from OLK-6.6 from 8f7de4b6 to 6483ac53
  - ub: ubase: clear FE reset status register during probe
  - !24232 [sync] PR-24231: ub:ubus: Always invalidate tlb during decoder unmap
  - urma: fix isref send no rsp to confirm state
  - urma: add huge lock in create tpid
  - urma: fix ref in ubmad and fix UAF in ubmad_rt_work_handler
  - urma: fix flush done event dispatch
  - ub:ubus: Always invalidate tlb during decoder unmap
  - !24218 urma: optimize sleep and logging in TPID reuse and rate-limited logs
  - urma: optimize sleep and logging in TPID reuse and rate-limited logs
  - !24214 ub: udma: Optimize the process of refcount_inc
  - ub: udma: Optimize the process of refcount_inc


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.2.153.20260627.78b2f79ac1db
changelog:
  - !24260 [sync]urma: Support user mode to obtain statistical results of kernel interrupt times
  - urma: Support user mode to obtain statistical results of kernel interrupt times
  - urma: free vtpn after free tpid reuse
  - !24250 [sync]urma: delete whether head is null in select tpid
  - urma: delete whether head is null in select tpid


author: Liming An <anliming1@h-partners.com> - 6.6.0-159.4.2.153.20260627.c0e012b0953b
changelog:
  - !24279 [sync]iommu/ummu: Fix nested TLB invalidation commands
  - iommu/ummu: Fix nested TLB invalidation commands
  - iommu/ummu: Fix NULL pointer dereference in logic_ummu_tlb_inv_walk


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.4.155
changelog:
  - !24347 [sync]urma: fix urma ping server cleanup paths
  - urma: fix file lifetime race between open, close and device removal
  - urma: fix urma ping server cleanup paths
  - !24294 [sync]urma: fix call trace during JFR deletion
  - urma: fix call trace during JFR deletion


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.5.156
changelog:
  - !24560 [sync]urma: create resources in ubmad_post_send before the ack message returns
  - !24604 ub: udma: Optimize udma jetty id access logic.
  - ub: udma: Optimize udma jetty id access logic.
  - !24597 [sync]urma: fix workqueue use-after-free in ubagg_exit teardown sequence
  - urma: fix workqueue use-after-free in ubagg_exit teardown sequence
  - urma: kref_get in find_add_tpid_reuse
  - urma: create resources in ubmad_post_send before the ack message returns
  - urma: change log level to rl in ubagg_import_jetty and ubagg_import_seg
  - urma: fix nullptr in ubcore_remove_jetty_from_jetty_grp
  - !24536 [sync]iommu/ummu: Fix use-after-free in ummu_core_alloc_separate_tdev
  - iommu/ummu: Fix use-after-free in ummu_core_alloc_separate_tdev
  - !24492 ub: udma: Adjust the order of delete global variables.
  - ub: udma: Adjust the order of delete global variables.
  - !24393 [sync]urma: fix several tp state and adapter disconnect cleanup bugs
  - urma: fix several tp state and adapter disconnect cleanup bugs
  - urma: split tpid_reuse from vtpn to avoid use_after_free


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.6.157
changelog:
  * Fri Jul 10 2026 Zihang Luo <luozihang2@huawei.com> - 6.6.0-159.4.5.156.20260710.3b1ce153a752
  - !24749 [sync]urma: free jfe events outside lock
  - urma: reduce ubagg topo log noise
  - urma: drain jfe event lists in batches to avoid soft-lockup
  - urma: free jfe events outside lock
  - urma: free completion events outside jfe lock
  - !24745 urma: fix get tp list from ops to single group id
  - !24744 urma: free tpid by uobj
  - !24743 urma: Fix the issue of inaccurate timing for some functions in DFX
  - !24739 [sync]urma: fix UAF of accessing token_id in log.
  - urma: fix get tp list from ops to single group id
  - urma: free tpid by uobj
  - urma: fix UAF of accessing token_id in log.
  - urma: Fix the issue of inaccurate timing for some functions in DFX
  - !24735 [sync]urma: fix tpid_reuse attached to vtpn causes use_after_free
  - urma: fix tpid_reuse attached to vtpn causes use_after_free
  - !24703 [sync]urma: retry import jetty/jfr on EIO from tpid reuse failure
  - urma: retry import jetty/jfr on EIO from tpid reuse failure
  - urma: limit ubagg connect exchange logs
  - !24641 [sync]urma: limit ubcore logs in reuse paths
  - urma: limit ubcore logs in reuse paths


author: Zhengzhou Chen <chenzhengzhou@huawei.com> - 6.6.0-159.4.6.157.20260713.a4e2472763b2
changelog:
  - !24791 [sync]urma: fix UAF of accessing jfs/jetty in log.
  - urma: fix UAF of accessing jfs/jetty in log.
  - !24778 urma: fix tpid uobj used by ubcore_get_tp_list
  - !24775 [sync]urma: ratelimit import jetty/jfr error logs
  - urma: fix tpid uobj used by ubcore_get_tp_list
  - urma: ratelimit import jetty/jfr error logs


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-159.4.6.158
changelog:
  - The RISC-V architecture features have been updated.
    For more details, refer to the rvck-olk repository.


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-159.4.7.160
changelog:
  - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid
  - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va
  - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid
  - ub/ubdevshm: Support for acquiring va is a sub-range of registered va
  - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup
  - urma: use xarray for ubagg/ubcore session lookup
  - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg
  - urma: make ratelimit burst configurable for ubcore/uburma/ubagg
  - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer
  - urma: use vzalloc for ubmad tjetty and ini_rtbuffer


author: lingsheng <lingsheng1@h-partners.com> - 3.7.1-7
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5915,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5915 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: Han Jinpeng <hanjinpeng@kylinos.cn> - 309-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: remove incorrect provides cockpit-machines and cockpit-machines-ovirt
          remove require libvirt and libvirt-client


author: shaojiansong <shaojiansong@kylinos.cn> - 309-8
changelog:
  - Fix networking: renaming of bridges and other groups (upstream fdba746e4, RHEL-131249, backport to openEuler-24.03-LTS-Next cockpit 309, keep member activation consistent when group name is changed.)


author: shaojiansong <shaojiansong@kylinos.cn> - 309-9
changelog:
  - Fix ws: only hand out the saved password to authorize messages once. Prevents account lockout via pam_faillock when sudo sends a 'Try again' prompt, by poisoning the password after the first use.


author: dongyuzhen <dongyuzhen@h-partners.com> - 1.6.22-20
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:delete task asynchronously to avoid containerd be killed when delete is blocking


author: Yu Peng <yupeng@kylinos.cn> - 1.6.22-23
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: Fix ctr snapshot mount produce invalid mount command for empty option.


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix readdir issues
         h3: fix query of concurrent streams
         noproxy: fix the IPV6 network mask pattern match
         krb5_gssapi: fix memory leak on error path
         openldap: fix memory-leak in error path
         conn: fix hostname move on connection reuse 
         pop3: fix CAPA response termination detection
         libssh: properly free sftp_attributes
         openssl: fix a potential memory leak of params.cert


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:urlapi: avoid null deref if setting blank host to url
         urlapi: skip appending NULL pointer query


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-26
changelog:
  - Type:CVE
  - CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224
  - SUG:NA
  - DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:formdata: validate callback is non-NULL before use
         tftp: correct the filename length check


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-28
changelog:
  - Type:CVE
  - CVE:CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
  - SUG:NA
  - DESC:fix CVE-2026-1965 CVE-2026-3783 CVE-2026-3784


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-29
changelog:
  - Type:CVE
  - CVE:CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168
  - SUG:NA
  - DESC:fix CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-30
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:http1: fix potential NULL dereference in Curl_h1_req_parse_read
         mqtt: fix EOF handling


author: zhouyihang <zhouyihang_z@163.com> - 8.4.0-32
changelog:
  - Type:CVE
  - CVE:CVE-2026-8286 CVE-2026-8924 CVE-2026-8927 CVE-2026-9547 CVE-2026-10536 CVE-2026-12064
  - SUG:NA
  - DESC:fix CVE-2026-8286 CVE-2026-8924 CVE-2026-8927 CVE-2026-9547 CVE-2026-10536 CVE-2026-12064


author: lingsheng <lingsheng1@h-partners.com> - 2.90-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Update DNS records after pruning DHCP leases
         cache: Fix potential NULL deref in arcane situations.
         Fix potential memory leak
         Fix possible SIGSEGV in bpf.c
         allow binding mac with ip6


author: Liu Qingtao <liu.qingtao2@zte.com.cn> - 2.90-5
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:Ignore Wincompatible-pointer-types error when compiling with gcc-14.3


author: luoguocui <luoguouci@h-partners.com> - 2.90-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix bounds checking in check_ia()
         Fix SEGV in Dbus code
         More fixes for DHCP ops in Dbus when DHCP not configured


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.90-9
changelog:
  - Type:CVE
  - CVE:CVE-2026-4890 CVE-2026-4891 CVE-2026-4892 CVE-2026-4893 CVE-2026-5172
  - SUG:NA
  - DESC:Fix NSEC bitmap parsing infinite loop
         Verify rdlen field in RRSIG packets
         Fix buffer overflow in helper.c with large CLIDs
         Fix broken client subnet validation
         Fix buffer overflow vulnerability in extract_addresses()


author: Xianglai Li <lixianglai@loongson.cn> - 202308-40
changelog:
  - revert the patch "0201-BaseTools-Scripts-GccBase-Align-.text-and-.data-to-4.patch" on loongarch
  - Fix the issue of failing to parse the serial port base address on loongarch


author: wangkai <13474090681@163.com> - 25.3.2.6-18
changelog:
  - Fix CVE-2026-48855, CVE-2026-48858, CVE-2026-49759, CVE-2026-49760, CVE-2026-53422,
    CVE-2026-54886, CVE-2026-54887, CVE-2026-54891, CVE-2026-55950, CVE-2026-55952


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: zhaoyonghao10 <zhaoyonghao10@h-partners.com> - 2.78.3-16
changelog:
  - apply 3 patches: backport-Fix-a-buffer-leak-when-finishing-connecting.patch, backport-Add-thread-pool-stress-test-to-task-c.patch, backport-Cleanup-trailing-spaces-task-c.patch


author: zhusicong <zhusicong@h-partners> - 2.78.3-17
changelog:
  - fix CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014, CVE-2026-58015, CVE-2026-58016


author: yixiangzhike <yixiangzhike007@163.com> - 2.39.1-31
changelog:
  - backport community patches
      fix columns reduction
      fix memory leak issue in read_Subid_range
      fix off-by-one in maximum last sector calculation
      fix memory corruption in size calculation
      fix memory corruption in read buffers


author: Xu Raoqing <609179072@qq.com> - 2.9.4-19
changelog:
  - oidc_child: fix wrong usage of printf format (a2bd434)
  - ad: use right memory context in GPO code (723a30b)
  - Responder: fix passkey auth when user-verification is off (4c6c010)
  - KRB5: fix mem leak in authenticate_stored_users (8b452b3)
  - KCM: fix use-after-free in kcm_read_options (50ae35f)
  - NSS: Fix wrong condition invalidating an optimization (6d71291)


author: Qin Fandong <qinfandong@kylinos.cn> - 2.9.4-22
changelog:
  - Type:CVE
  - ID:CVE-2026-14474
  - SUG:NA
  - DESC:fix CVE-2026-14474: warn when ldap_sudo_search_base falls back to root DN to prevent privilege escalation


author: Qin Fandong <qinfandong@kylinos.cn> - 2.17.2-2
changelog:
  - Type:CVE
  - ID:CVE-2026-34481, CVE-2026-49844
  - SUG:NA
  - DESC:fix CVE-2026-34481 and CVE-2026-49844: serialize non-finite floating-point values as JSON strings


author: yaoxin <1024769339@qq.com> - 2.4.16.6-1
changelog:
  - Update to 2.4.16.6:
    * metadata: fix caching of JWKs from jwks_uri when using the default expiry setting
    * info: fix requests to the info hook with extend_session=false
    * cookie: OIDCCookieSameSite default behaviour Lax
    * cookie: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
    * cache: avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory
      cannot be found on the system upon initaliizing cache mutexes and the file cache
    * metadata: allow plain HTTP URLs in metadata elements jwks_uri and signed_jwks_uri to ensure backwards
      compatibility with <=2.4.15.7 and to support private/test deployments
    * code: address warnings from static code analysis tool CodeChecker


author: yanglu <yanglu72@h-partners.com> - 2:0.95-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Change UDP and ICMP sockets binding to accept a source IP from the -a CLI option


author: wangkai <13474090681@163.com> - 2:2022.10.3-4
changelog:
  - Fix CVE-2026-42616, CVE-2026-42617, CVE-2026-42618, CVE-2026-46569,
    CVE-2026-46570, CVE-2026-46571, CVE-2026-46572, CVE-2026-56135, CVE-2026-56136


author: HelloZ <3161422489@qq.com> - 1.00.029-5
changelog:
  - Add patch 0001-support-DSCP-and-higher-version-gcc-compilation-opti.patch
  - support DSCP and higher version gcc compilation options


author: wangkai <13474090681@163.com> - 2.6.9-8
changelog:
  - Fix CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
    CVE-2026-13117, CVE-2026-13122, CVE-2026-13698


author: Funda Wang <fundawang@yeah.net> - 4:5.38.0-11
changelog:
  - split out patch adding link to libperl.so into two separated patches,
    and sync it with mageia, which is a better version than fedora
  - disable cleaning empty perl directories
  - use git lfs storage


author: sqfu <dev01203@linx-info.com> - 1.647-1
changelog:
  - update version to 1.647
  - Fix Makefile rules for Changes
  - Another example to bind columns 
  - Fix fetchall_arrayref for undefined NAME


author: Funda Wang <fundawang@yeah.net> - 4.18.2-34
changelog:
  - disable automatic maintenance when autopatching with git
    https://github.com/git/git/commit/1942d48380fec53f76361e9adebef15b5db9628a
  - sync patches within branches


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-72
changelog:
  - ub: don't check ers addr size is power of 2
  - ub: support process msg code exch
  - ub: replace malloc with g_malloc0
  - Migration/urma:explicitly set URMA JFS tp_type to URMA_CTP
  - MAINTAINERS: add me as maintainer to virtio-snd
  - virtio-snd: remove TODO comments
  - virtio-snd: handle 5.14.6.2 for PCM_INFO properly(CVE-2026-3196)
  - virtio-snd: fix max_size bounds check in input cb(CVE-2026-3195)
  - virtio-snd: tighten read amount in in_cb(CVE-2026-3195)
  - hw/arm: Close unreleased out_fault_fd
  - pci: avoid the info qtree crash caused by arm-smmuv3-accel


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-73
changelog:
  - target/arm: add kunpeng 920 V1 support
  - target/arm: add kunpeng 950 V1 support
  - target/arm: add kunpeng 920 V2 support
  - hw/virtio/virtio-crypto: verify asym request size(CVE-2025-14876)
  - cryptodev-builtin: Limit the maximum size(CVE-2025-14876)
  - block/vmdk: fix OOB read in vmdk_read_extent()(CVE-2026-2243)
  - lsi53c895a: keep a reference to the device while SCRIPTS execute(CVE-2024-6519)


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-74
changelog:
  - virtio-blk: avoid using ioeventfd state in irqfd conditional
  - machine: Use error handling when CPU type is checked
  - hw/core/cpu: Update description of CPUState::node
  - hw/cpu/core: Cleanup unused included header in core.c
  - hw/cpu/cluster: Cleanup unused included header in cluster.c
  - hw/arm/bcm2836: Simplify use of reset-cbar property
  - hw/arm/bcm2836: Use ARM_CPU mp-affinity property
  - hw: Simplify accesses to the CPUState::start-powered-off property
  - hw/ppc/xive2_regs: Remove unnecessary cpu.h inclusion
  - hw/mips: Inline bios.h definitions
  - docs: use "buses" rather than "busses"
  - hw/ppc/spapr_cpu_core: Access QDev properties with proper API
  - hw/vfio: fix iteration over global VFIODevice list
  - vfio/iommufd: Remove the use of stat() to check file existence
  - vfio/container: Rename vfio_init_container to vfio_set_iommu
  - target/sparc: Simplify qemu_irq_ack
  - tests/avocado: add a simple i386 replay kernel test
  - tests/avocado: modernise the drive args for replay_linux
  - block: Fix crash when loading snapshot on inactive node
  - roms/efi: clean up edk2 build config
  - roms/efi: exclude efi shell from secure boot builds
  - Migration/urma:Avoid polling jfc timeouts resulting from hardware failures.
  - hyperv/syndbg: check length returned by cpu_physical_memory_map()(CVE-2026-3842)
  - ub: fix ers update error
  - kvm/arm/virt: Implement kvm-vtimer-status
  - hw/arm/virt: Implement timer early inject PV support
  - Migration/urma: replace ulseep with usleep in poll_jfc_wait


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-76
changelog:
  - target/arm: Conditionally add KVM writable properties based on RME
  - Migration/urma:adapt urma to use udma device to process iterative migration
  - Migration/urma: drop unused index in qemu_urma_init_ram_blocks
  - ub_ummu: default uninstall all tecte when cfgi all invalidate and free vdev when tecte uninstall
  - ub ummu: realize mapt_cmdq_ctxt_attr regster process
  - vfio ub: support config fd for vfio-ub device
  - hw/core/machine-smp: Deprecate unsupported "parameter=1" SMP configurations
  - hw/core/machine-smp: Calculate total CPUs once in machine_parse_smp_config()
  - hw/core/machine: Introduce the module as a CPU topology level
  - hw/core/machine: Support modules in -smp
  - hw/core: Introduce module-id as the topology subindex
  - hw/core: Support module-id in numa configuration
  - hw/i386: split x86.c in multiple parts
  - i386/cpu: Fix i/d-cache topology to core level for Intel CPU
  - i386/cpu: Use APIC ID info to encode cache topo in CPUID[4]
  - i386/cpu: Use APIC ID info get NumSharingCache for CPUID[0x8000001D].EAX[bits 25:14]
  - i386/cpu: Consolidate the use of topo_info in cpu_x86_cpuid()
  - i386/cpu: Introduce bitmap to cache available CPU topology levels
  - i386: Split topology types of CPUID[0x1F] from the definitions of CPUID[0xB]
  - i386/cpu: Decouple CPUID[0x1F] subleaf with specific topology level
  - i386: Introduce module level cpu topology to CPUX86State
  - i386: Support modules_per_die in X86CPUTopoInfo
  - i386: Expose module level in CPUID[0x1F]
  - i386: Support module_id in X86CPUTopoIDs
  - i386/cpu: Introduce module-id to X86CPU
  - tests: Add test case of APIC ID for module level parsing
  - hw/i386/pc: Support smp.modules for x86 PC machine
  - i386: Add cache topology info in CPUCacheInfo
  - i386/cpu: Use CPUCacheInfo.share_level to encode CPUID[4]
  - i386/cpu: Use CPUCacheInfo.share_level to encode CPUID[0x8000001D].EAX[bits 25:14]
  - i386: Add support for SUCCOR feature
  - i386/cpu: fixup number of addressable IDs for processor cores in the physical package
  - kvm: Allow kvm_arch_get/put_registers to accept Error**
  - i386/cpu: Don't enumerate the "invalid" CPU topology level
  - hw/core: Make CPU topology enumeration arch-agnostic
  - qapi/qom: Define cache enumeration and properties for machine
  - hw/core: Check smp cache topology support for machine
  - hw/core: Add a helper to check the cache topology level
  - hw/core/machine-smp: Initialize caches_bitmap before reading
  - hw/core/machine-smp: Fix error message parameter
  - i386/cpu: Extract a common fucntion to setup value of MSR_CORE_THREAD_COUNT
  - i386/cpu: Drop the variable smp_cores and smp_threads in x86_cpu_pre_plug()
  - i386/cpu: Drop cores_per_pkg in cpu_x86_cpuid()
  - i386/topology: Update the comment of x86_apicid_from_topo_ids()
  - i386/topology: Introduce helpers for various topology info of different level
  - target/i386/cpu: Consolidate the use of warn_report_once()
  - i386/cpu: Track a X86CPUTopoInfo directly in CPUX86State
  - i386/cpu: Hoist check of CPUID_EXT3_TOPOEXT against threads_per_core
  - cpu: Remove nr_cores from struct CPUState
  - i386/cpu: Set up CPUID_HT in x86_cpu_expand_features() instead of cpu_x86_cpuid()
  - i386/cpu: Set and track CPUID_EXT3_CMP_LEG in env->features[FEAT_8000_0001_ECX]
  - hw/core/machine: Reject thread level cache
  - i386/cpu: Support module level cache topology
  - i386/cpu: Update cache topology with machine's configuration
  - i386/pc: Support cache topology in -machine for PC machine
  - i386/cpu: add has_caches flag to check smp_cache configuration
  - i386/cpu: Introduce enable_cpuid_0x1f to force exposing CPUID 0x1f
  - i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check
  - i386/cpu: Rename enable_cpuid_0x1f to force_cpuid_0x1f
  - i386/cpu: Refine comment of CPUID2CacheDescriptorInfo
  - i386/cpu: Add descriptor 0x49 for CPUID 0x2 encoding
  - i386/cpu: Add default cache model for Intel CPUs with level < 4
  - i386/cpu: Present same cache model in CPUID 0x2 & 0x4
  - i386/cpu: Consolidate CPUID 0x4 leaf
  - i386/cpu: Drop CPUID 0x2 specific cache info in X86CPUState
  - i386/cpu: Add x-vendor-cpuid-only-v2 option for compatibility
  - i386/cpu: Mark CPUID[0x80000005] as reserved for Intel
  - i386/cpu: Rename AMD_ENC_ASSOC to X86_ENC_ASSOC
  - i386/cpu: Fix CPUID[0x80000006] for Intel CPU
  - i386/cpu: Add legacy_intel_cache_info cache model
  - i386/cpu: Add legacy_amd_cache_info cache model
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x2
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x4
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x80000005
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x80000006
  - i386/cpu: Select legacy cache model based on vendor in CPUID 0x8000001D
  - i386/cpu: Use a unified cache_info in X86CPUState
  - i386/cpu: Introduce cache model for SierraForest
  - i386/cpu: Introduce cache model for GraniteRapids
  - i386/cpu: Introduce cache model for SapphireRapids
  - i386/cpu: Add a "x-force-cpuid-0x1f" property
  - i386/cpu: Enable 0x1f leaf for SierraForest by default
  - i386/cpu: Enable 0x1f leaf for SierraForest by default
  - i386/cpu: Enable 0x1f leaf for GraniteRapids by default
  - i386/cpu: Enable 0x1f leaf for SapphireRapids by default
  - i386/cpu: Mark EBX/ECX/EDX in CPUID 0x80000000 leaf as reserved for Intel
  - i386/cpu: Mark CPUID 0x80000007[EBX] as reserved for Intel
  - i386/cpu: Mark CPUID 0x80000008 ECX bits[0:7] & [12:15] as reserved for Intel/Zhaoxin
  - i386/cpu: Reorder CPUID leaves in cpu_x86_cpuid()
  - i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX[23:16]
  - i386/cpu: Fix cpu number overflow in CPUID.01H.EBX[23:16]
  - i386/cpu: Honor maximum value for CPUID.8000001DH.EAX[25:14]
  - hw/core: allow parameter=1 for SMP topology on any machine
  - docs/deprecated: Remove undeprecated SMP description
  - i386/tcg: Make CPUID_HT and CPUID_EXT3_CMP_LEG supported
  - i386/hvf: Make CPUID_HT supported
  - target/i386/cpu: Move addressable ID encoding out of compat property in CPUID[0x1]
  - target/i386: add compatibility property for pdcm feature


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-77
changelog:
  - system/physmem: Fix possible double free when destroy cpu address space
  - Migration: add virtcca secure CVM live migration support
  - Migration: add virtcca secure CVM live migration support
  - virtcca migration: bugfix, meson option 'virtcca_migration' default value set to disabled
  - ub: update VFIO UB IRQ index enum definitions
  - ub: add VFIO_UB_REINIT_IRQ_INDEX for reinit interrupt support
  - ub: return error code to vm
  - ub: fix passthrough errno to vm
  - ub: reinit irq set failed don't stop vm
  - migration/cgs: fix some function name spell error
  - migration/cgs: Fix mismatched allocator in write_numa_info_to_sysfs
  - ub: fix fill_rq_cq not checking fill_cq return value
  - ub: fix ub cq depth
  - ub: pass ub feature to guest os
  - migration/cgs: bugfix, adding poison ignore CONFIG_VIRTCCA_MIGRATION when building non-aarch64 target to avoid error


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-78
changelog:
  - system/physmem: disable guest RAM core dump for cca
  - vhost: Remove unused log_fd variable in vhost_dev_log_resize()
  - i386/cpu: Allow cache to be shared at thread level
  - hw/vfio: Allow multiple vfio devices migration if none support P2P_MIGRATION


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-79
changelog:
  - virtio-gpu: fix overflow check when allocating 2d image (CVE-2026-3886)
  - ui/vnc: fix OOB read updating VNC update frequency stats(CVE-2026-48003)
  - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914)


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-81
changelog:
  - hw/net/rocker_of_dpa: Check group ID pointers are not NULL(CVE-2022-36648)
  - hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match()
  - ub_ummu: support CMD_TLBI_OS_ASID_U and CMD_TLBI_HYP_ASID_U command
  - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare(CVE-2026-5763)


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


author: yaoxin <1024769339@qq.com> - 1:9.0.119-1
changelog:
  - Update to 9.0.119 for fix CVEs: CVE-2026-50229, CVE-2026-53404,
    CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956,
    CVE-2026-55957


author: herengui <herengui@kylinsec.com.cn> - 7.4.3-5
changelog:
  - Fix CVE-2026-34475: Fix http/1.1 absolute form dissection edge case leading to cache poisoning or authentication bypass


author: chenyanpan <chenyanpan@xfusion.com> - 1.21.4-4
changelog:
  - Fix CVE-2026-15146
  - Fix CVE-2026-58469
  - Fix CVE-2026-58470
  - Fix CVE-2026-58471
  - Fix CVE-2026-58472


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: Wang Kui <wangkui35@h-partners.com> - 1.20.11-41
changelog:
  - Fix CVE-2025-49176 CVE-2025-49179 CVE-2025-49180 CVE-2022-49737
    CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-42
changelog:
  - fix CVE-2022-49737 CVE-2025-49175 CVE-2025-49176 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-45
changelog:
  - fix CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264


