Rocky Linux 10 aarch64 RT https://rockylinux.org Recently updated packages for Rocky Linux 10 aarch64 RT Thu, 13 Aug 2026 04:04:19 PM GMT DNF kernel-rt-64k-modules-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 600c9e8d1abc9671e95db0b6863b1416db22ef83b9c2e2bcf91e65458076678a https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-modules-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-modules - kernel modules to match the core kernel<br />

This package provides commonly used kernel modules for the core kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-debug-modules-extra-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT d0c50c067f328c9e17c023d4a2ab05b499ffa6f20dd1cba9a785cb71627fad35 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-debug-modules-extra-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-debug-modules-extra - Extra kernel modules to match the kernel<br />

This package provides less commonly used kernel modules for the kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-devel-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 741f2f928c41b9feeb50be5d520dc67b89ffade7ae9875f08153f5ad74c78b5e https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-devel-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-devel - Development package for building kernel modules to match the kernel<br />

This package provides kernel headers and makefiles sufficient to build modules<br /> against the kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 47066539363be65a5b36e07271efdd8703a8c3822059446a713024515be48e1b https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k - kernel meta-package for the rt-64k kernel<br />

The meta-package for the rt-64k kernel

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-debug-modules-core-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 344e69fa57305ab84c2b076603d1d4912b3bd8102f0102fc00c58b047fd35417 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-debug-modules-core-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-debug-modules-core - Core kernel modules to match the core kernel<br />

This package provides essential kernel modules for the core kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-debug-modules-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT ac83d59f4f5c833c314a6d5253fefb185200e6aa59cabaa52c3d0281b647c727 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-debug-modules-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-debug-modules - kernel modules to match the core kernel<br />

This package provides commonly used kernel modules for the core kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-debug-modules-extra-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 7bbc530c9a22a0d82fcc95169910da586c801cb66f38506f5d44b4e6c60731db https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-debug-modules-extra-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-debug-modules-extra - Extra kernel modules to match the kernel<br />

This package provides less commonly used kernel modules for the kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 99268efb80267e612562fbd1597189e6380379eb44895e30fb7897e2f0c24664 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt - kernel meta-package for the rt kernel<br />

The meta-package for the rt kernel

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-debug-devel-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT f925eb2dd4b8ff6c46f2cf88937e8e954a4e6bb96d47164d15c3fe697619decb https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-debug-devel-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-debug-devel - Development package for building kernel modules to match the kernel<br />

This package provides kernel headers and makefiles sufficient to build modules<br /> against the kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-debug-modules-core-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 7644557249f5b11963d5c2f9e7f942548ca351874fa57f6fb72fe1d5c8a59971 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-debug-modules-core-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-debug-modules-core - Core kernel modules to match the core kernel<br />

This package provides essential kernel modules for the core kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-debug-core-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 7861b000d8ac184a04038697b3857f94d3944f3de004e6ed36b21bc4b9bfdf1e https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-debug-core-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-debug-core - The Linux PREEMPT_RT kernel compiled with extra debugging enabled<br />

The kernel package contains the Linux kernel (vmlinuz), the core of any<br /> Linux operating system. The kernel handles the basic functions<br /> of the operating system: memory allocation, process allocation, device<br /> input and output, etc.<br /> <br /> This variant of the kernel has numerous debugging options enabled.<br /> It should only be installed when trying to gather additional information<br /> on kernel bugs, as some of these options impact performance noticably.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-debug-modules-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT b7d633dc0667aa15ee3242b7bacdf8bc5d9a4e1b8b780370d4c1eb00284b4113 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-debug-modules-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-debug-modules - kernel modules to match the core kernel<br />

This package provides commonly used kernel modules for the core kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-debug-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 13f41a1306f23e6606a5eb5785cc18234baf430934a2b54324c98bb7718cad60 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-debug-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-debug - kernel meta-package for the rt-debug kernel<br />

The meta-package for the rt-debug kernel

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-debug-devel-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 58f205c626e36c7427117e31efbcf8d145182fe71fe51efc615c3d51ca04efdd https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-debug-devel-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-debug-devel - Development package for building kernel modules to match the kernel<br />

This package provides kernel headers and makefiles sufficient to build modules<br /> against the kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-modules-extra-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 7d8be5669e998d26c07de997c655a25116473febb28b84ea97233f9be4abc0c5 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-modules-extra-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-modules-extra - Extra kernel modules to match the kernel<br />

This package provides less commonly used kernel modules for the kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-core-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT b321bdc362d2362d467c1374276a16c6b8e0f0e7c08b311b3f6c6e3ba1938dde https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-core-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-core - The Linux kernel compiled with PREEMPT_RT enabled<br />

This package includes a version of the Linux kernel compiled with the<br /> PREEMPT_RT real-time preemption support

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-modules-core-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT f33faf20ffd5ffaf5251d82ba138b93c909451344042e771caba3e4588e95473 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-modules-core-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-modules-core - Core kernel modules to match the core kernel<br />

This package provides essential kernel modules for the core kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-modules-extra-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT f6cf8a807c25cebe7d85395d3673ab21c0145f93b1f970c3adbb52ea3264b43e https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-modules-extra-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-modules-extra - Extra kernel modules to match the kernel<br />

This package provides less commonly used kernel modules for the kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-debug-core-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 9697b2898702a0d63c64dbfaadfa1ea1742a773b30b316f7500c70349ca9de50 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-debug-core-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-debug-core - The Linux PREEMPT_RT kernel compiled with extra debugging enabled<br />

The debug kernel package contains a variant of the ARM64 Linux PREEMPT_RT kernel using<br /> a 64K page size.<br /> This variant of the kernel has numerous debugging options enabled.<br /> It should only be installed when trying to gather additional information<br /> on kernel bugs, as some of these options impact performance noticably.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-modules-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 3a08178ba7e0ab69ca661f5615ce917f298d0d3e3b089e9bcd32b1cbfa9bbaef https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-modules-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-modules - kernel modules to match the core kernel<br />

This package provides commonly used kernel modules for the core kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-core-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT fda76d1de2ce82ffa1636770eeb67e0b19c914e328ff400faa2204654b196ef7 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-core-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-core - The Linux PREEMPT_RT kernel compiled for 64k pagesize usage<br />

The kernel package contains a variant of the ARM64 Linux PREEMPT_RT kernel using<br /> a 64K page size.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-modules-core-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT 55bb2a5bb8832fd3b374dd5ee489b83aad8c2d729fa3cc9984aec607952c9b4f https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-modules-core-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-modules-core - Core kernel modules to match the core kernel<br />

This package provides essential kernel modules for the core kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-64k-debug-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT abc7d91e4685158d7f3b315f62f6e935244631072b43d7777fe0f428e5f9dba2 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-64k-debug-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-64k-debug - kernel meta-package for the rt-64k-debug kernel<br />

The meta-package for the rt-64k-debug kernel

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> kernel-rt-devel-6.12.0-211.47.1.el10_2.aarch64 Thu, 13 Aug 2026 01:05:38 AM GMT e59dd157007a20dfca12da44e2357664cb6ed2c4391cc4b09015d34066af35e5 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/k/kernel-rt-devel-6.12.0-211.47.1.el10_2.aarch64.rpm

kernel-rt-devel - Development package for building kernel modules to match the kernel<br />

This package provides kernel headers and makefiles sufficient to build modules<br /> against the kernel package.

Change Log:

<pre>Wed, 12 Aug 2026 GMT - Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1 - Add partial riscv64 support for build root - Provide basic VisionFive 2 support Wed, 12 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} Mon, 10 Aug 2026 GMT - CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} ...</pre> tuned-profiles-realtime-2.27.0-2.el10_2.noarch Tue, 04 Aug 2026 09:38:18 PM GMT ad1a852f12fb736d20e3884d0692cbb8c89c660a5edaff226c48c13517109d85 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/t/tuned-profiles-realtime-2.27.0-2.el10_2.noarch.rpm

tuned-profiles-realtime - Additional tuned profile(s) targeted to realtime<br />

Additional tuned profile(s) targeted to realtime.

Change Log:

<pre>Mon, 15 Jun 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 Sun, 22 Feb 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1 - new release - rebased tuned to latest upstream related: RHEL-123608 Tue, 10 Feb 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile ...</pre> tuned-profiles-nfv-host-2.27.0-2.el10_2.noarch Tue, 04 Aug 2026 09:38:18 PM GMT 00e2c080a7e28876bbf1cae31069dff31e291d71561183b0c400f6b3a66416eb https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/t/tuned-profiles-nfv-host-2.27.0-2.el10_2.noarch.rpm

tuned-profiles-nfv-host - Additional tuned profile(s) targeted to Network Function Virtualization (NFV) host<br />

Additional tuned profile(s) targeted to Network Function Virtualization (NFV) host.

Change Log:

<pre>Mon, 15 Jun 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 Sun, 22 Feb 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1 - new release - rebased tuned to latest upstream related: RHEL-123608 Tue, 10 Feb 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile ...</pre> tuned-profiles-nfv-guest-2.27.0-2.el10_2.noarch Tue, 04 Aug 2026 09:38:18 PM GMT 4f29bd3b6a6cff0002b676ddc576f2b682f68c26d7506e883404f376727db68b https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/t/tuned-profiles-nfv-guest-2.27.0-2.el10_2.noarch.rpm

tuned-profiles-nfv-guest - Additional tuned profile(s) targeted to Network Function Virtualization (NFV) guest<br />

Additional tuned profile(s) targeted to Network Function Virtualization (NFV) guest.

Change Log:

<pre>Mon, 15 Jun 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 Sun, 22 Feb 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1 - new release - rebased tuned to latest upstream related: RHEL-123608 Tue, 10 Feb 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile ...</pre> tuned-profiles-nfv-2.27.0-2.el10_2.noarch Tue, 04 Aug 2026 09:38:18 PM GMT 7705446a1a210f7fc0b5c089d97f8b1facf25f82dd6b4280d28e2d7dc2cb9da8 https://dl.rockylinux.org/pub/rocky/10/RT/aarch64/os/Packages/t/tuned-profiles-nfv-2.27.0-2.el10_2.noarch.rpm

tuned-profiles-nfv - Additional tuned profile(s) targeted to Network Function Virtualization (NFV)<br />

Additional tuned profile(s) targeted to Network Function Virtualization (NFV).

Change Log:

<pre>Mon, 15 Jun 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 Sun, 22 Feb 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1 - new release - rebased tuned to latest upstream related: RHEL-123608 Tue, 10 Feb 2026 GMT - Jaroslav Škarvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile ...</pre>