Alibaba Cloud Linux 3 Pro image release notes

Kernel

Upgraded the kernel from kernel-5.10.134-012.ali5000.pro.al8 to kernel-5.10.134-014.ali5000.pro.al8, fixing over 100 high-risk CVEs.

1. Scheduler subsystem

   New features

   • Group Balancer enhancements:

     • Added support for CPU burst awareness.

     • Added support for cpuset awareness.

     • Introduced nr_gb_running to optimize load balancing.

     • Added support for setting cpu.group_balancer to 2, providing high-priority tasks with a soft CPU guarantee of twice the number of logical cores.

     • Prioritized searching for idle CPUs in preferred_gb_sd.

   • Group Identity enhancements:

     • Added support for using SCHED_IDLE for finer-grained priority control.

     • Added support for setting absolute_expel for tasks and cgroups.

     • Introduced ID_PUSH_EXPELLEE_CONSIDER_HIGHCLASS and ID_BOOK_CPU.

   • Proxy Execution: Introduced a simplified proxy execution mechanism for jbd2_lock.

   • PSI (Pressure Stall Information) improvements:

     • Added the PSI_CPU_FULL state.

     • Optimized task switching within shared cgroups.

     • Reduced the number of sched_clock() calls.

   Important fixes

   • Fixed an issue where h_load_next was not cleaned up when a cgroup was unregistered.

   • Fixed a performance regression for high-class tasks.

   • Fixed a crash that occurred when setting a task identity while Group Identity was disabled.

   • Fixed an update frequency issue in async_calc_cgroup_load.

---

2. Memory management

   New features

   • Uncached I/O support:

     • Added support for the RWF_DONTCACHE flag to bypass the page cache.

     • Added memcg-level control for uncached I/O.

     • Enabled ext4 support for uncached buffered I/O.

   • THP (transparent huge pages) enhancements:

     • Enhanced brk/sbrk to support THP alignment with runtime controls.

     • Provided THP-related metrics in memcg v1.

     • Added container-level shmem THP metrics.

   • Memory hotplug optimizations:

     • Added support for parallel deferred memory onlining.

     • Deferred vmemmap memory initialization.

     • Added deferred pages for vmemmap memory.

   • Page reclamation optimizations:

     • Added support for light compaction.

     • Added the PTE page table reclamation (reclaim_pt) feature.

     • Implemented smooth page cache reclamation with pagecache_limit.

   • CMA improvements: Improved concurrent allocation performance by using per-CMA locks.

     Important fixes

   • Fixed an issue in the removal of hugetlb folio mappings.

   • Fixed an issue in invalidate_inode_pages2_range() related to THP reference counting.

   • Fixed a null pointer check issue in grab_cache_page_write_begin().

   • Fixed a race condition between kfence and get_page_unless_zero().

   Reverted changes

   • Reverted a series of upstream patches related to PCP (Per-CPU Pages) to restore a more stable implementation.

---

3. Networking subsystem

   New features

   • IPVS optimizations: Changed ip_vs_svc_table and ip_vs_svc_fwm_table to be per-netns.

   Important fixes

   • Fixed multiple security issues in netfilter nf_tables, such as disallowing duplicate devices and preventing rule removal from chain bindings.

     • Fixed a race condition between TLS asynchronous notifications and socket closure.

     • Fixed multiple race conditions and use-after-free (UAF) issues in the net_sched subsystem.

     • Fixed issues with vsock binding and closing.

     • Fixed a null pointer dereference related to IPv6 routing.

     • Fixed multiple issues during SMC fallback, handshake, and write-with-immediate operations.

---

4. Storage subsystem

   New features

   • erofs enhancements:

     • Added support for 48-bit block addressing.

     • Added support for file-backed mounts.

     • Implemented encoded extended metadata.

     • Added a sysfs interface.

     • Added support for sub-page compressed blocks.

   • ext4 improvements:

     • Added support for uncached buffered I/O.

   • Virtio-blk device passthrough:

     • Enabled virtio-blk device passthrough based on io_uring_cmd, including support for bidirectional commands and vring pairs.

     • Added support for blk-mq dynamic request allocation.

   Important fixes

   • Fixed multiple stability issues in ext4, including data consistency, reference count overflows, and out-of-bounds (OOB) reads.

   • Fixed issues in jbd2, such as checkpoint softlockups and race conditions.

   • Fixed issues in xfs, such as AGI/AGF boundary checks and inodgc deadlocks.

   • Fixed an RCU stall issue in cgroup writeback v1.

   • Fixed a filesystem anomaly caused by io_uring batch plugging.

   • Fixed an RCU null pointer issue in overlayfs when getting ACLs.

---

5. eBPF

   New features

   • The verifier now supports custom callback return ranges.

   • Added MEM_UNINIT as a bpf_type_flag.

   • Added a cookie object to support bpf maps.

   Important fixes

   • Fixed issues with return value checks in LSM BPF.

   • Fixed an issue with the enforcement of precise return value ranges on program exit.

   • Fixed an issue where a helper could write to a read-only map.

   • Fixed an out-of-bounds (OOB) access issue in cgroup local storage.

   • Fixed a memory leak in bpf_sk_select_reuseport().

   • Fixed an issue with map poke updates in prog_array_map_poke_run.

---

6. Virtualization

   New features

   • Hygon CSV3 confidential computing enhancements:

     • Added support for 1 GB hugetlb.

     • Added support for the SET_GUEST_PRIVATE_MEMORY_EX and UPDATE_NPT_EX APIs.

     • Added support for injecting secrets into CSV3 guests.

     • Added support for multiple SMCR regions.

     • Enhanced the shared page manager.

     • Added the KVM_CSV3_LAUNCH_FINISH_EX command.

     • Added support for the RTMR (Runtime Measurement Register) interface.

     • Added support for attestation reports.

   • Dragonball platform enhancements:

     • Enabled veBPF features, including support for tc attach, perf_event, tracing, lsm, and raw tracepoint.

     • Added support for QNC (Quick Notification Channel).

     • Added pvdump and pvpanic features.

     • Added support for PCI hotplug.

     • Added support for vCPU hotplug.

     • Added pvdma support for virtio_mmio devices.

   • KVM x86 optimizations:

     • Used static_call to reduce kvm_x86_ops overhead.

     • Introduced support for the Zhaoxin PAUSEOPT instruction.

     • Implemented the PV MMIO WRITE hypercall.

   Important fixes

   • Fixed a CSV3 startup failure caused by concurrent long-term pin failures.

   • Fixed an issue with the MMU context reset during vCPU RESET/INIT.

   • Fixed a stack information leak in KVM_GET_MSRS.

   • Fixed an NMI unblocking issue in SEV-ES guests.

---

7. ARM64 architecture

   New features

   • Enabled Dragonball veBPF features.

   • Added pvdma support.

   Important fixes

   • Fixed a read latency issue in /proc/cpuinfo.

   • Fixed a capability conflict during CPU hotplug.

   • Fixed a conversion issue in lock_mm_and_find_vma().

   • Fixed an iommu_device_probe bug in SMMU-v3 caused by a duplicate stream ID.

---

8. Security fixes

   Vulnerability fixes

   • Fixed a slab-out-of-bounds vulnerability in security/keys.

   • Fixed multiple security vulnerabilities in netfilter/nf_tables.

   • Fixed multiple use-after-free (UAF) and out-of-bounds (OOB) access vulnerabilities in various filesystems.

   • Fixed a race condition vulnerability in TLS.

   • Fixed BPF verifier security checks.

   Crypto subsystem

   • Added support for Hygon CCP SM4-XTS/SM4-GCM.

   • Added support for Hygon security capabilities such as TKM/TCM, and vTPM live migration.

   • Added instruction-level optimizations for Zhaoxin SM3/SM4 algorithms.

---

9. Driver updates

   New and enhanced features

   • NVMe: Added support for the Moc NVMe controller.

   • NIC: Added full-featured support for Nebula-Matrix.

   • PCI:

     • Added checks for ROM header and data structure addresses.

     • Added support for automatically resizing BARs to their maximum capability.

     • Optimized AER services.

   • USB/xHCI:

     • Added support for Zhaoxin xHCI LPM U1/U2.

     • Fixed a TRB prefetch issue.

   • EDAC:

     • Added support for Intel Granite Rapids-D, Grand Ridge, and Clearwater Forest.

     • Added support for Hygon family 18h model 6h.

   • Power management:

     • Added support for Intel RAPL TPMI PMU.

     • The sp5100_tco watchdog now supports Family 17h+ CPUs.

   Important fixes

   • Fixed a bad page state in the iavf driver.

     • Fixed the AHCI Zhaoxin SATA LED quirk.

     • Fixed multiple bugs in the Phytium display engine.

---

10. Container and cgroup updates

    New features

    • Added support for modifying the information of a specified mount point in mountinfo (for rich containers).

    • Replaced the global lock with a per-threadgroup rwsem for cgroup.procs writes.

    • Enabled cgroup writeback v1 by default.

    • Disabled memcg kmem by default.

    Important fixes

    • Fixed a reference count leak in the parent blkcg.

    • Fixed a boottime calculation issue when timens and rich containers are enabled.

New features

• Added support for confidential computing features on AMD and NVIDIA GPUs.

• Added 72 ecosystem components to support the Inspur ecosystem.

• Enhanced confidential computing security.

• Enabled PCIe error injection using ras-tools.

• Introduced the ancert tool to support the Alibaba Cloud Linux hardware test suite.

• Added 10 peripheral drivers to expand hardware support.

• Improved support for multiple hardware models, including Phytium S2500, Phytium S5000C, Intel GRN, AMD Turin, and domestically-produced GPU cards.

• Updated util-linux-2.32.1-46.0.3.al8 to optimize the performance of the lscpu command in environments with a large number of PCIe devices.

• Enabled container storage with erofs-utils-1.8.2-1.al8.

• Updated java-11-alibaba-dragonwell-11.0.24.21.21-1.1.al8 to optimize the BigDecimal class for improved performance in big data scenarios.

• Updated java-21-alibaba-dragonwell-21.0.4.0.4-1.1.al8 and java-21-alibaba-jdk to improve Java performance.

• Added the system-rpm-config-129-1.0.2.1.al8 component to configure system macro variables.

The following parameters have been added to improve ECS performance:

• intel_idle.max_cstate=1

• processor.max_cstate=1

Compatibility bug fixes

• The kexec-tools component is updated from kexec-tools-2.0.26-14.0.1.5.1.al8.2 to kexec-tools-2.0.26-14.0.1.9.1.al8.2. This update adds pcie_ports=compat to the kdump command-line configuration on x86 systems to fix an issue where kdump hangs on 8th-generation instances.

• The alinux-base-setup component is updated from alinux-base-setup-3.2-6.2.al8 to alinux-base-setup-3.2-11.1.al8. This update adds UUID support in /boot/efi/EFI/alinux/grub.cfg to bind the boot disk, resolving a boot issue on bare metal systems.

Bug fixes from Alinux 3

This release includes 23 bug fixes: 10 are included in the image and 13 are available in the yum repository.

Component	Previous version	Updated version	Update method
alinux-release	alinux-release-3.2104.12p-3.al8	alinux-release-3.2104.13p-1.al8	image update
alinux-release-source	alinux-release-source-3.2104-1.al8	alinux-release-source-3.2104-3.al8	yum repository
anaconda	anaconda-33.16.7.12-1.0.6.4.al8	anaconda-33.16.7.12-1.0.7.5.al8	yum repository
cloud-init	cloud-init-23.2.2-1.0.1.al8	cloud-init-23.2.2-9.0.1.1.al8	image update
cups-filters	cups-filters-1.20.0-35.0.2.al8	cups-filters-1.20.0-36.0.2.1.al8	yum repository
firefox	#N/A	firefox-115.14.0-2.0.1.al8	yum repository
fuse	fuse-2.9.7-19.al8	fuse-2.9.7-19.1.al8	image update
gcc	gcc-10.2.1-3.9.al8	gcc-10.2.1-3.8.al8	image update
gcc-toolset-12	gcc-toolset-12-12.0-6.al8	gcc-toolset-12-12.0-6.1.al8	yum repository
grubby	grubby-8.40-49.0.1.al8	grubby-8.40-49.0.1.1.al8	image update
iputils	iputils-20180629-11.0.1.al8	iputils-20180629-11.0.2.al8	image update
kexec-tools	kexec-tools-2.0.26-14.0.1.5.1.al8.2	kexec-tools-2.0.26-14.0.1.9.1.al8.2	image update
kpatch	kpatch-0.9.7-2.0.1.al8	kpatch-0.9.7-2.0.4.al8	image update
libappstream-glib	libappstream-glib-0.7.18-5.0.1.al8	libappstream-glib-0.7.18-6.al8	yum repository
maven	maven-3.6.2-7.al8	maven-3.6.2-9.1.al8	yum repository
postgres-decoderbufs	postgres-decoderbufs-0.10.0-2.1.al8	postgres-decoderbufs-0.10.0-2.2.al8	yum repository
qt5-qtmultimedia	qt5-qtmultimedia-5.15.3-1.al8	qt5-qtmultimedia-5.15.3-1.1.al8	yum repository
rasdaemon	rasdaemon-0.6.7-16.0.1.al8	rasdaemon-0.8.3-2.al8	yum repository
system-rpm-config	system-rpm-config-129-1.0.2.1.al8	system-rpm-config-129-1.0.2.2.al8	yum repository
systemd	systemd-239-82.0.3.1.al8.3	systemd-239-82.0.4.5.1.al8.5	image update
tee-primitives	tee-primitives-1.0-1.al8	tee-primitives-1.0-3.al8	yum repository
tpm2-tools	tpm2-tools-4.1.1-5.0.5.al8	tpm2-tools-4.1.1-5.0.6.al8	yum repository
util-linux	util-linux-2.32.1-46.0.3.al8	util-linux-2.32.1-48.0.1.1.al8	image update

Bug fixes from Anolis OS 8

This release includes 27 updates: 12 are included in the image and 15 are available in the yum repository.

Component	Previous version	Updated version	Update method
coreutils	coreutils-8.30-15.0.3.al8	coreutils-8.30-16.0.1.al8	image update
dnsmasq	dnsmasq-2.79-33.al8	dnsmasq-2.79-35.al8	yum repository
dracut	dracut-049-233.git20240115.0.2.al8	dracut-049-239.git20251127.0.1.1.al8	image update
evolution-data-server	evolution-data-server-3.40.4-9.0.1.al8	evolution-data-server-3.40.4-10.0.1.al8	yum repository
geoclue2	geoclue2-2.6.0-7.al8	geoclue2-2.6.0-8.al8.1	yum repository
gnome-session	gnome-session-40.1.1-9.0.1.al8	gnome-session-40.1.1-10.0.1.al8	yum repository
gnome-settings-daemon	gnome-settings-daemon-40.0.1-17.0.1.al8	gnome-settings-daemon-40.0.1-19.0.1.al8	yum repository
gnome-shell-extensions	gnome-shell-extensions-40.7-19.0.1.al8	gnome-shell-extensions-40.7-29.0.1.al8	yum repository
gsettings-desktop-schemas	gsettings-desktop-schemas-40.0-6.0.1.al8	gsettings-desktop-schemas-40.0-8.0.1.al8	yum repository
ksh	ksh-20120801-267.0.1.al8	ksh-20120801-269.0.1.al8	yum repository
mod_security_crs	mod_security_crs-3.3.4-3.al8	mod_security_crs-3.3.4-3.al8.2	yum repository
motif	motif-2.3.4-20.al8	motif-2.3.4-24.al8	yum repository
mutter	mutter-40.9-22.0.1.al8	mutter-40.9-23.0.1.al8	yum repository
nftables	nftables-1.0.4-4.al8	nftables-1.0.4-7.al8	image update
openldap	openldap-2.4.46-20.al8	openldap-2.4.46-21.al8	image update
pam	pam-1.3.1-36.1.al8	pam-1.3.1-39.1.al8	image update
portreserve	portreserve-0.0.5-19.2.al8	portreserve-0.0.5-20.0.1.al8	yum repository
pulseaudio	pulseaudio-15.0-2.0.1.al8	pulseaudio-15.0-3.0.1.al8	yum repository
quota	quota-4.09-2.0.1.al8	quota-4.09-4.0.1.al8	image update
selinux-policy	selinux-policy-3.14.3-139.0.1.al8.1	selinux-policy-3.14.3-139.0.1.al8.2	image update
sudo	sudo-1.9.5p2-1.0.2.al8	sudo-1.9.5p2-1.0.2.al8.3	image update
tar	tar-1.30-9.0.2.al8	tar-1.30-11.0.1.al8	image update
traceroute	traceroute-2.1.0-6.2.0.3.al8	traceroute-2.1.0-9.0.1.al8	yum repository
tuned	tuned-2.22.1-5.0.1.1.al8	tuned-2.22.1-6.0.1.1.al8	image update
unixODBC	unixODBC-2.3.7-1.2.al8	unixODBC-2.3.7-2.0.1.al8	yum repository
unzip	unzip-6.0-47.0.1.al8	unzip-6.0-48.0.1.al8	yum repository
util-linux	util-linux-2.32.1-46.0.3.al8	util-linux-2.32.1-47.0.1.1.al8	image update
which	which-2.21-20.0.1.al8	which-2.21-21.0.1.al8	image update

Feature updates from Alinux 3

• Enhanced security capabilities: This update uses the LoongShield and CAI components to support three major feature sets: foundational security, such as identity authentication and access control; enhanced security, such as dynamic permission management and SM algorithms; and advanced data protection, including runtime security, large model security, and AI confidential computing security:

  • Added the loongshield component (loongshield-1.0.0-1.al8) to support foundational security capabilities such as identity authentication and access control. This update is included in the image.

  • Added the trustee component (trustee-1.7.6-1.al8) for remote attestation.

  • Updated the trustiflux component from trustiflux-1.0.0-1.al8 to trustiflux-1.4.8-1.al8 to optimize confidential computing capabilities.

  • Updated the cryptpilot component from cryptpilot-0.1.0-1.al8 to cryptpilot-0.2.7-1.al8 to enhance encryption capabilities.

  • Updated the trusted-network-gateway component from trusted-network-gateway-1.0.3-2.al8 to trusted-network-gateway-2.2.6-1.al8 to improve secure channel protection.

  • Added the gocryptfs component (gocryptfs-2.4.0-2.al8) for an encrypted file system.

  • Updated the tee-primitives component from tee-primitives-1.0-1.al8 to tee-primitives-1.0-3.al8. This update modifies the component's URL and rebuilds it.

• System operations enhancements:

  • Updated sysak from sysak-3.4.0-1 to sysak-3.10.0-1 to improve system operations. This update is available via the yum repo.

• Security Level 4 and activation updates:

  • Updated the activation_agent component from activation_agent-0.2.0-3.al8 to activation_agent-0.3.0-1.al8 to provide BMCP and offline virtual machine activation. This update is included in the image.

  • Added four tools for Security Level 4: libgcrypt-1.10.2-1.al8, btrfs-progs-6.1.2-3.al8, cups-pdf-3.0.1-17.0.1.al8, and fscryptctl-1.1.0-2.al8. These tools are available via the yum repo.

• Enhanced core OS capabilities:

  • Updated alinux-base-setup from alinux-base-setup-3.2-6.2.al8 to alinux-base-setup-3.2-11.1.al8. This update disables the rpcbind service by default for security reasons and adds UUID support in /boot/efi/EFI/alinux/grub.cfg to bind the initial boot disk, resolving boot issues on bare metal systems. This update is included in the image.

  • Updated alinux-release from alinux-release-3.2104.12p-3.al8 to alinux-release-3.2104.13p-1.al8 to mark the release of Alinux 3.13 Pro. This update is included in the image.

  • Updated glibc from glibc-2.32-1.16.al8 to glibc-2.32-1.23.al8 to add performance optimizations for Hygon processors. This update is included in the image.

  • Updated NetworkManager from NetworkManager-1.40.16-18.0.1.al8 to NetworkManager-1.40.16-19.0.1.1.al8 to enable the ipvlan feature. This update is included in the image.

  • Updated systemd from systemd-239-82.0.3.1.al8.3 to systemd-239-82.0.4.3.al8.5 to support the new NetworkNamespacePath feature. This update is included in the image.

  • Updated logrotate from logrotate-3.14.0-6.0.1.al8 to logrotate-3.14.0-6.0.1.1.al8. This update optimizes system memory usage by changing the system log storage method to compress. This update is included in the image.

  • Updated tpm2-tss from tpm2-tss-2.3.2-6.0.2.al8 to tpm2-tss-2.4.6-1.0.2.al8 to provide runtime dependency libraries for confidential computing. This update is available via the yum repo.

  • Updated tpm2-tools from tpm2-tools-4.1.1-5.0.5.al8 to tpm2-tools-4.1.1-5.0.6.al8 to provide runtime dependency libraries for confidential computing. This update is available via the yum repo.

  • Updated tengine from qatengine-0.6.19-1.al8 to tengine-3.1.0-3.al8. This update integrates the nginx-module-vts plugin for improved performance on the Yitian processor. This update is available via the yum repo.

  • Updated gcc-toolset-12-gcc from gcc-toolset-12-gcc-12.2.1-7.8.0.1.1.al8 to gcc-toolset-12-gcc-12.3.0-1.2.al8 to provide a newer version of GCC. This update is available via the yum repo.

  • Updated rasdaemon from rasdaemon-0.6.7-16.0.1.al8 to rasdaemon-0.6.7-16.5.al8 to provide a RAS diagnostic and self-healing solution. This update is available via the yum repo.

  • Updated tracker from tracker-3.1.2-3.0.1.al8 to tracker-3.1.2-3.0.1.1.al8. This update modifies the build options to disable the version check for sqlite. This update is available via the yum repo.

  • Updated ostree from ostree-2022.2-8.al8 to ostree-2022.2-11.al8 to support security updates in ContainerOS. This update is available via the yum repo.

  • Updated intel-QAT20 from intel-QAT20-L.0.9.4-00004.12.al8 to intel-QAT20-L.0.9.4-00004.15.al8 to recognize the QAT VF device ID for 9th-generation GNR instances. This update is available via the yum repo.

  • Updated edk2 from edk2-20220126gitbb1bba3d77-13.0.1.al8.5 to edk2-20220126gitbb1bba3d77-13.0.1.al8.8 to add support for dynamic measurement for Hygon CSV3 in OVMF/Qemu. This update is available via the yum repo.

• System tuning enhancements:

  • Released version 3.2.0 of keentuned and keentune-target. These components are available via the yum repo.

• Kernel-related component updates:

  • Updated smc-tools to smc-tools-1.8.3-1.0.4.al8. This minor version adds monitoring and packet capture features and is available via the yum repo.

  • Updated vtoa to vtoa-2.1.1-1.al8 to provide compatibility between new and old versions. This update is available via the yum repo.

  • Updated erofs-utils to erofs-utils-1.8.10-1.al8. This is a bug fix release and is available via the yum repo.

  • Updated ipflt-xdp from ipflt-xdp-1.2.0-1.al8 to ipflt-xdp-1.3.0-1.al8 to provide jumbo frame compatibility for ipflt-xdp on the 5.10 kernel. This update is available via the yum repo.

• Cloud application component updates:

  • Updated aliyun-cli from aliyun-cli-3.0.245-1.al8 to aliyun-cli-3.2.6-1.al8. This update is included in the image.

  • Updated ossfs from ossfs-1.80.6-1.al8 to ossfs-1.91.8-1.al8 to fix basic functionality issues. This update is available via the yum repo.

• OS Copilot update:

  • Updated os-copilot from os-copilot-0.9.0-1.al8 to os-copilot-1.1.0-2.al8, which provides an AI assistant for the OS environment. This update is available via the yum repo.

• New ecosystem components: This update adds components for containers and OS analysis tools.

  • Added six container-related components: cni-1.8.0-1.al8, containerd-2.2.0_rc.1-1.al8, k8s-1.29-1.al8, kata-containers-2.4.3-1.al8, docker-20.10.25-2.al8, and kubernetes-1.22.10-1.al8. These components are available via the yum repo.

  • Added three OS compatibility analysis tools: abi-compliance-checker-2.3-2.al8, abi-dumper-1.2-4.al8, and vtable-dumper-1.2-3.al8. These components are available via the yum repo.

  • Added two OS application tools: dnf-plugin-kernel-install-1.0-5.al8 and eclipse-2025.06-1.al8. These components are available via the yum repo.

Feature updates from Anolis OS 8

• This release syncs 26 feature updates from Anolis OS 8. Of these, 9 are included in the image and 17 are available via the yum repo. The following table lists the component updates.

Component name	Previous version	New version	Update method
389-ds-base	389-ds-base-1.4.3.39-9.0.1.al8	389-ds-base-1.4.3.39-15.0.1.al8	Available via yum repo
alsa-lib	alsa-lib-1.2.12-1.0.1.al8	alsa-lib-1.2.14-1.0.1.al8	Available via yum repo
augeas	augeas-1.13.0-6.al8	augeas-1.14.1-3.al8	Available via yum repo
autofs	autofs-5.1.4-114.0.1.al8.1	autofs-5.1.4-114.0.1.al8.2	Available via yum repo
cockpit-session-recording	cockpit-session-recording-16-1.al8	cockpit-session-recording-20-1.al8	Available via yum repo
device-mapper-multipath	device-mapper-multipath-0.8.4-41.0.1.al8	device-mapper-multipath-0.8.4-42.0.1.al8	Included in image
dnf	dnf-4.7.0-20.0.1.1.al8	dnf-4.7.0-21.0.1.1.al8	Included in image
firewalld	firewalld-0.9.11-9.0.1.al8	firewalld-0.9.11-10.0.1.al8	Included in image
jasper	jasper-2.0.14-5.0.1.al8	jasper-2.0.14-6.0.1.al8	Available via yum repo
java-1.8.0-openjdk-portable	java-1.8.0-openjdk-portable-1.8.0.432.b06-1.0.2.1.al8	java-1.8.0-openjdk-portable-1.8.0.472.b08-1.0.1.1.al8	Available via yum repo
java-17-openjdk-portable	java-17-openjdk-portable-17.0.13.0.11-1.0.2.1.al8	java-17-openjdk-portable-17.0.17.0.10-1.0.2.1.al8	Available via yum repo
libdnf	libdnf-0.63.0-20.0.1.2.al8	libdnf-0.63.0-21.0.1.1.al8	Included in image
libdrm	libdrm-2.4.121-1.0.1.al8	libdrm-2.4.123-2.0.1.al8	Available via yum repo
libisoburn	libisoburn-1.5.4-4.al8	libisoburn-1.5.4-5.al8	Available via yum repo
libselinux	libselinux-2.9-9.1.al8	libselinux-2.9-10.1.al8	Included in image
libsemanage	libsemanage-2.9-10.0.1.al8	libsemanage-2.9-12.0.1.al8	Included in image
linux-firmware	linux-firmware-20241014-125.git06bad2f1.al8	linux-firmware-20250325-129.git710a336b.al8	Included in image
lvm2	lvm2-2.03.14-14.0.1.al8	lvm2-2.03.14-15.0.1.al8	Included in image
mysql-selinux	mysql-selinux-1.0.10-1.al8	mysql-selinux-1.0.14-1.al8	Available via yum repo
qatzip	qatzip-1.0.9-1.al8	qatzip-1.1.2-1.al8	Available via yum repo
qpl	qpl-0.2.0-1.al8	qpl-1.1.0-1.al8	Available via yum repo
samba	samba-4.19.4-6.1.al8	samba-4.19.4-9.1.al8	Available via yum repo
scap-security-guide	scap-security-guide-0.1.75-1.0.1.al8	scap-security-guide-0.1.77-1.0.1.al8	Available via yum repo
sos	sos-4.8.1-1.0.1.1.al8	sos-4.10.0-4.0.1.1.al8	Available via yum repo
strace	strace-5.18-2.0.4.al8	strace-5.18-2.1.0.1.al8	Included in image
xorg-x11-drv-libinput	xorg-x11-drv-libinput-1.0.1-3.al8	xorg-x11-drv-libinput-1.0.1-4.al8	Available via yum repo

Package name	CVE ID	Version
buildah	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	buildah-1.33.8-4.al8
containernetworking-plugins	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	containernetworking-plugins-1.4.0-5.0.1.al8
containers-common	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	containers-common-1-82.0.1.al8
podman	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	podman-4.9.4-12.0.1.al8
python-podman	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	python-podman-4.9.0-2.al8
runc	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	runc-1.1.12-4.0.1.al8
skopeo	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	skopeo-1.14.5-3.0.1.al8
httpd	CVE-2023-27522	httpd-2.4.37-65.0.1.al8.2
git-lfs	CVE-2023-45288 CVE-2023-45289 CVE-2023-45290 CVE-2024-24783	git-lfs-3.4.1-2.0.1.al8
bind	CVE-2024-1975 CVE-2024-1737	bind-9.11.36-16.0.1.al8
python-setuptools	CVE-2024-6345	python-setuptools-39.2.0-8.al8.1
less	CVE-2022-48624 CVE-2024-32487	less-530-3.0.1.al8
java-17-openjdk	CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147	java-17-openjdk-17.0.12.0.7-2.0.2.1.al8
java-11-openjdk	CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147	java-11-openjdk-11.0.24.0.8-3.0.2.1.al8
postgresql	CVE-2024-7348	postgresql-13.16-1.0.1.al8
flatpak	CVE-2024-42472	flatpak-1.12.9-3.al8
bubblewrap	CVE-2024-42472	bubblewrap-0.4.0-2.2.al8
java-1.8.0-openjdk	CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147	java-1.8.0-openjdk-1.8.0.422.b05-2.0.2.1.al8
fence-agents	CVE-2024-6345	fence-agents-4.10.0-62.0.2.al8.4
pcp	CVE-2024-45769 CVE-2024-45770	pcp-5.3.7-22.0.1.al8
delve	CVE-2024-24791 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	delve-1.21.2-4.0.1.al8
golang	CVE-2024-24791 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	golang-1.21.13-2.0.1.al8
go-toolset	CVE-2024-24791 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	go-toolset-1.21.13-1.al8
edk2	CVE-2023-45236 CVE-2023-45237 CVE-2024-1298	edk2-20220126gitbb1bba3d77-13.0.1.al8.2
curl	CVE-2024-2398	curl-7.61.1-35.0.2.al8
libvpx	CVE-2023-6349 CVE-2024-5197	libvpx-1.7.0-11.0.1.al8
resource-agents	CVE-2024-37891 CVE-2024-6345	resource-agents-4.9.0-54.al8.4
389-ds-base	CVE-2024-5953	389-ds-base-1.4.3.39-8.0.1.al8
python-urllib3	CVE-2024-37891	python-urllib3-1.24.2-8.al8
pcs	CVE-2024-41123 CVE-2024-41946 CVE-2024-43398	pcs-0.10.18-2.0.1.1.al8.2
grafana	CVE-2024-24788 CVE-2024-24789 CVE-2024-24790	grafana-9.2.10-17.0.1.al8
libuv	CVE-2024-24806	libuv-1.42.0-2.al8
c-ares	CVE-2024-25629	c-ares-1.13.0-11.al8
xmlrpc-c	CVE-2023-52425	xmlrpc-c-1.51.0-9.0.1.al8
yajl	CVE-2022-24795 CVE-2023-33460	yajl-2.1.0-13.0.1.al8
wpa_supplicant	CVE-2023-52160	wpa_supplicant-2.10-2.al8
cups	CVE-2024-35235	cups-2.2.6-60.0.1.al8
linux-firmware	CVE-2023-31346	linux-firmware-20240610-122.git90df68d2.al8
wget	CVE-2024-38428	wget-1.19.5-12.0.1.al8
poppler	CVE-2024-6239	poppler-20.11.0-12.0.1.al8
krb5	CVE-2024-37370 CVE-2024-37371	krb5-1.18.2-29.0.1.al8
git-lfs	CVE-2024-34156	git-lfs-3.4.1-3.0.1.al8
libreoffice	CVE-2024-3044 CVE-2024-6472	libreoffice-7.1.8.1-12.0.2.1.al8.1
orc	CVE-2024-40897	orc-0.4.28-4.al8
jose	CVE-2023-50967 CVE-2024-28176	jose-10-2.3.al8.3
openssh	CVE-2020-15778 CVE-2023-48795 CVE-2023-51385	openssh-8.0p1-25.0.1.1.al8
libnbd	CVE-2024-3446 CVE-2024-7383 CVE-2024-7409	libnbd-1.6.0-6.0.1.al8
qemu-kvm	CVE-2024-3446 CVE-2024-7383 CVE-2024-7409	qemu-kvm-6.2.0-53.0.1.al8
libvirt	CVE-2024-3446 CVE-2024-7383 CVE-2024-7409	libvirt-8.0.0-23.2.0.2.al8
osbuild-composer	CVE-2024-34156	osbuild-composer-101-2.0.1.al8
libreswan	CVE-2024-3652	libreswan-4.12-2.0.2.al8.4
mod_auth_openidc	CVE-2024-24814	mod_auth_openidc-2.4.9.4-6.al8
podman	CVE-2023-45290 CVE-2024-24783 CVE-2024-24784 CVE-2024-24788 CVE-2024-24791	podman-4.9.4-13.0.1.al8
ghostscript	CVE-2024-29510 CVE-2024-33869 CVE-2024-33870	ghostscript-9.54.0-18.al8
emacs	CVE-2024-39331	emacs-27.2-9.0.3.al8
dovecot	CVE-2024-23184 CVE-2024-23185	dovecot-2.3.16-5.0.1.al8
expat	CVE-2024-45490 CVE-2024-45491 CVE-2024-45492	expat-2.2.5-13.0.1.al8
glib2	CVE-2024-34397	glib2-2.68.4-14.0.2.al8
python-idna	CVE-2024-3651	python-idna-2.5-7.al8
openldap	CVE-2023-2953	openldap-2.4.46-19.al8
python-pillow	CVE-2024-28219	python-pillow-5.1.1-21.al8
nghttp2	CVE-2024-28182	nghttp2-1.33.0-6.0.1.al8.1
python-jinja2	CVE-2024-34064	python-jinja2-2.10.1-3.0.3.al8
opencryptoki	CVE-2024-0914	opencryptoki-3.22.0-3.al8
gdk-pixbuf2	CVE-2021-44648 CVE-2021-46829 CVE-2022-48622	gdk-pixbuf2-2.42.6-4.0.1.al8
rear	CVE-2024-23301	rear-2.6-13.0.1.al8
grub2	CVE-2023-4692 CVE-2023-4693 CVE-2024-1048	grub2-2.02-150.0.2.al8
nss	CVE-2023-5388 CVE-2023-6135	nss-3.101.0-7.0.1.al8
gnutls	CVE-2024-0553 CVE-2024-28834	gnutls-3.6.16-8.0.1.al8.3
python3	CVE-2024-4032 CVE-2024-6232 CVE-2024-6923	python3-3.6.8-67.0.1.2.al8
grafana	CVE-2024-24791	grafana-9.2.10-18.0.1.al8
cups-filters	CVE-2024-47076 CVE-2024-47175 CVE-2024-47176 CVE-2024-47850	cups-filters-1.20.0-35.0.1.al8
linux-firmware	CVE-2023-20584 CVE-2023-31315 CVE-2023-31356	linux-firmware-20240827-124.git3cff7109.al8
golang	CVE-2024-9355	golang-1.21.13-3.0.1.al8
openssl	CVE-2024-5535	openssl-1.1.1k-14.0.1.al8
nano	CVE-2024-5742	nano-2.9.8-2.0.1.al8
runc	CVE-2023-45290 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	runc-1.1.12-5.0.1.al8
OpenIPMI	CVE-2024-42934	OpenIPMI-2.0.32-5.0.1.al8
grafana	CVE-2024-47875 CVE-2024-9355	grafana-9.2.10-20.0.1.al8
java-11-openjdk	CVE-2023-48161 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235	java-11-openjdk-11.0.25.0.9-2.0.1.1.al8
java-1.8.0-openjdk	CVE-2023-48161 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235	java-1.8.0-openjdk-1.8.0.432.b06-2.0.2.1.al8
java-17-openjdk	CVE-2023-48161 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235	java-17-openjdk-17.0.13.0.11-3.0.2.1.al8
NetworkManager-libreswan	CVE-2024-9050	NetworkManager-libreswan-1.2.10-7.0.1.al8
ansible-core	CVE-2024-0690	ansible-core-2.16.3-2.0.1.al8
libtiff	CVE-2023-52356	libtiff-4.4.0-12.0.2.al8
krb5	CVE-2024-3596	krb5-1.18.2-30.0.1.al8
xorg-x11-server	CVE-2024-9632	xorg-x11-server-1.20.11-25.0.1.al8
xmlrpc-c	CVE-2024-45491	xmlrpc-c-1.51.0-10.0.1.al8
bzip2	CVE-2019-12900	bzip2-1.0.6-27.al8
bcc	CVE-2024-2314	bcc-0.25.0-9.0.1.al8
python3.11	CVE-2024-6232	python3.11-3.11.10-1.0.1.al8
buildah	CVE-2024-9341 CVE-2024-9407 CVE-2024-9675	buildah-1.33.10-1.al8
podman	CVE-2024-9341 CVE-2024-9407 CVE-2024-9675	podman-4.9.4-15.0.1.al8
libtiff	CVE-2024-7006	libtiff-4.4.0-12.0.3.al8
libsoup	CVE-2024-52530 CVE-2024-52532	libsoup-2.62.3-6.0.1.al8
gtk3	CVE-2024-6655	gtk3-3.24.31-5.0.2.1.al8
tigervnc	CVE-2024-9632	tigervnc-1.13.1-14.al8
emacs	CVE-2024-30203 CVE-2024-30204 CVE-2024-30205	emacs-27.2-10.0.1.al8
squid	CVE-2024-23638 CVE-2024-45802	squid-4.15-13.al8.3
gnome-shell-extensions	CVE-2024-36472	gnome-shell-extensions-40.7-19.0.1.al8
gnome-shell	CVE-2024-36472	gnome-shell-40.10-21.al8
osbuild-composer	CVE-2024-34156	osbuild-composer-118-2.0.1.al8
expat	CVE-2024-50602	expat-2.2.5-16.al8
iperf3	CVE-2023-7250 CVE-2024-26306	iperf3-3.9-13.al8
lldpd	CVE-2020-27827 CVE-2021-43612 CVE-2023-41910	lldpd-1.0.18-4.0.1.al8
xorg-x11-server-Xwayland	CVE-2024-31080 CVE-2024-31081 CVE-2024-31083	xorg-x11-server-Xwayland-23.2.7-1.al8
bpftrace	CVE-2024-2313	bpftrace-0.16.0-8.al8
perl-Convert-ASN1	CVE-2013-7488	perl-Convert-ASN1-0.27-17.1.0.1.al8
podman	CVE-2021-33198 CVE-2021-4024 CVE-2024-9676	podman-4.9.4-18.0.1.al8
grafana-pcp	CVE-2024-9355	grafana-pcp-5.1.1-9.0.1.al8
buildah	CVE-2021-33198 CVE-2021-4024 CVE-2024-9676	buildah-1.33.11-1.al8
python-podman	CVE-2021-33198 CVE-2021-4024 CVE-2024-9676	python-podman-4.9.0-3.al8
golang	CVE-2024-24790	golang-1.22.7-1.0.2.al8
delve	CVE-2024-24790	delve-1.22.1-1.0.2.al8
go-toolset	CVE-2024-24790	go-toolset-1.22.7-1.al8
pam	CVE-2024-10041 CVE-2024-10963	pam-1.3.1-36.al8
perl-App-cpanminus	CVE-2024-45321	perl-App-cpanminus-1.7044-6.al8
postgresql	CVE-2024-10976 CVE-2024-10978 CVE-2024-10979	postgresql-13.18-1.0.1.al8
python3	CVE-2024-11168 CVE-2024-9287	python3-3.6.8-69.0.1.1.al8
python3.11-cryptography	CVE-2023-49083	python3.11-cryptography-37.0.2-6.0.1.al8
python3.11-setuptools	CVE-2024-6345	python3.11-setuptools-65.5.1-3.al8
python3.11-pip	CVE-2007-4559	python3.11-pip-22.3.1-5.al8
python3.11	CVE-2024-9287	python3.11-3.11.11-1.0.1.al8
php	CVE-2023-0567 CVE-2023-0568 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-3096 CVE-2024-5458 CVE-2024-8925 CVE-2024-8927 CVE-2024-9026	php-7.4.33-2.0.1.al8
pcs	CVE-2024-21510	pcs-0.10.18-2.0.1.1.al8.3
gstreamer1-plugins-good	CVE-2024-47537 CVE-2024-47539 CVE-2024-47540 CVE-2024-47606 CVE-2024-47613	gstreamer1-plugins-good-1.16.1-5.al8
gstreamer1-plugins-base	CVE-2024-47538 CVE-2024-47607 CVE-2024-47615	gstreamer1-plugins-base-1.22.1-3.0.1.al8
libsndfile	CVE-2024-50612	libsndfile-1.0.28-16.0.1.al8
tuned	CVE-2024-52337	tuned-2.22.1-5.0.1.1.al8
edk2	CVE-2024-38796	edk2-20220126gitbb1bba3d77-13.0.1.al8.4
bluez	CVE-2023-45866	bluez-5.63-3.0.1.al8
fontforge	CVE-2024-25081 CVE-2024-25082	fontforge-20200314-6.0.1.al8
mpg123	CVE-2024-10573	mpg123-1.32.9-1.al8
webkit2gtk3	CVE-2024-23271 CVE-2024-27820 CVE-2024-27838 CVE-2024-27851 CVE-2024-40779 CVE-2024-40780 CVE-2024-40782 CVE-2024-40789 CVE-2024-40866 CVE-2024-44185 CVE-2024-44187 CVE-2024-44244 CVE-2024-44296 CVE-2024-4558	webkit2gtk3-2.46.3-2.0.1.al8
python-requests	CVE-2024-35195	python-requests-2.20.0-5.al8
cups-filters	CVE-2024-47076 CVE-2024-47175 CVE-2024-47176 CVE-2024-47850	cups-filters-1.20.0-35.0.2.al8
openssh	CVE-2020-15778 CVE-2023-48795 CVE-2023-51385	openssh-8.0p1-25.0.1.2.al8
pam	CVE-2024-10041 CVE-2024-10963	pam-1.3.1-36.1.al8
webkit2gtk3	CVE-2024-23271 CVE-2024-27820 CVE-2024-27838 CVE-2024-27851 CVE-2024-40779 CVE-2024-40780 CVE-2024-40782 CVE-2024-40789 CVE-2024-40866 CVE-2024-44185 CVE-2024-44187 CVE-2024-44244 CVE-2024-44296 CVE-2024-44309 CVE-2024-4558	webkit2gtk3-2.46.5-1.0.1.al8
dpdk	CVE-2024-11614	dpdk-23.11-2.al8
cups	CVE-2024-47175	cups-2.2.6-62.0.1.al8
iperf3	CVE-2024-53580	iperf3-3.9-13.al8.1
cups	CVE-2024-47175	cups-2.2.6-62.0.2.al8
NetworkManager	CVE-2024-3661	NetworkManager-1.40.16-18.0.1.al8
raptor2	CVE-2024-57823	raptor2-2.0.15-17.0.1.al8
rsync	CVE-2024-12085	rsync-3.1.3-20.0.1.al8
fence-agents	CVE-2024-56201 CVE-2024-56326	fence-agents-4.10.0-76.0.1.al8.4
glibc	CVE-2022-23218 CVE-2022-23219	glibc-2.32-1.19.al8
glibc	CVE-2024-33602 CVE-2024-33601 CVE-2024-33600 CVE-2024-33599	glibc-2.32-1.20.al8
grafana	CVE-2025-21613 CVE-2025-21614	grafana-9.2.10-21.0.1.al8
redis	CVE-2022-24834 CVE-2022-35977 CVE-2022-36021 CVE-2023-22458 CVE-2023-25155 CVE-2023-28856 CVE-2023-45145 CVE-2024-31228 CVE-2024-31449 CVE-2024-46981	redis-6.2.17-1.0.1.1.al8
python-jinja2	CVE-2024-56326	python-jinja2-2.10.1-3.0.4.al8
bzip2	CVE-2019-12900	bzip2-1.0.6-28.al8
libsoup	CVE-2024-52531	libsoup-2.62.3-7.0.1.al8
git-lfs	CVE-2024-53263	git-lfs-3.4.1-4.0.1.al8
keepalived	CVE-2024-41184	keepalived-2.2.8-4.al8
unbound	CVE-2024-1488 CVE-2024-8508	unbound-1.16.2-8.al8
java-17-openjdk	CVE-2025-21502	java-17-openjdk-17.0.14.0.7-3.0.1.1.al8
galera	CVE-2023-22084 CVE-2024-21096	galera-26.4.20-1.al8
mariadb	CVE-2023-22084 CVE-2024-21096	mariadb-10.5.27-1.0.1.al8
doxygen	CVE-2020-11023	doxygen-1.8.14-13.al8
tbb	CVE-2020-11023	tbb-2018.2-10.al8.1
gcc-toolset-13-gcc	CVE-2020-11023	gcc-toolset-13-gcc-13.3.1-2.2.0.1.1.al8
nodejs	CVE-2025-22150 CVE-2025-23083 CVE-2025-23085	nodejs-20.18.2-1.1.al8
nodejs-packaging	CVE-2025-22150 CVE-2025-23083 CVE-2025-23085	nodejs-packaging-2021.06-4.al8
nodejs-nodemon	CVE-2025-22150 CVE-2025-23083 CVE-2025-23085	nodejs-nodemon-3.0.1-1.al8
podman	CVE-2024-11218	podman-4.9.4-19.0.1.al8
buildah	CVE-2024-11218	buildah-1.33.12-1.al8
libcap	CVE-2025-1390	libcap-2.48-6.0.2.al8
libxml2	CVE-2022-49043	libxml2-2.9.7-18.0.4.1.al8
bind	CVE-2024-11187	bind-9.11.36-16.0.1.al8.4
postgresql	CVE-2025-1094	postgresql-13.20-1.0.1.al8
libpq	CVE-2025-1094	libpq-13.20-1.0.1.al8
mecab-ipadic	CVE-2024-11053 CVE-2024-21193 CVE-2024-21194 CVE-2024-21196 CVE-2024-21197 CVE-2024-21198 CVE-2024-21199 CVE-2024-21201 CVE-2024-21203 CVE-2024-21212 CVE-2024-21213 CVE-2024-21218 CVE-2024-21219 CVE-2024-21230 CVE-2024-21231 CVE-2024-21236 CVE-2024-21237 CVE-2024-21238 CVE-2024-21239 CVE-2024-21241 CVE-2024-21247 CVE-2024-37371 CVE-2024-5535 CVE-2024-7264 CVE-2025-21490 CVE-2025-21491 CVE-2025-21494 CVE-2025-21497 CVE-2025-21500 CVE-2025-21501 CVE-2025-21503 CVE-2025-21504 CVE-2025-21505 CVE-2025-21518 CVE-2025-21519 CVE-2025-21520 CVE-2025-21521 CVE-2025-21522 CVE-2025-21523 CVE-2025-21525 CVE-2025-21529 CVE-2025-21531 CVE-2025-21534 CVE-2025-21536 CVE-2025-21540 CVE-2025-21543 CVE-2025-21546 CVE-2025-21555 CVE-2025-21559	mecab-ipadic-2.7.0.20070801-17.0.1.al8
mysql	CVE-2024-11053 CVE-2024-21193 CVE-2024-21194 CVE-2024-21196 CVE-2024-21197 CVE-2024-21198 CVE-2024-21199 CVE-2024-21201 CVE-2024-21203 CVE-2024-21212 CVE-2024-21213 CVE-2024-21218 CVE-2024-21219 CVE-2024-21230 CVE-2024-21231 CVE-2024-21236 CVE-2024-21237 CVE-2024-21238 CVE-2024-21239 CVE-2024-21241 CVE-2024-21247 CVE-2024-37371 CVE-2024-5535 CVE-2024-7264 CVE-2025-21490 CVE-2025-21491 CVE-2025-21494 CVE-2025-21497 CVE-2025-21500 CVE-2025-21501 CVE-2025-21503 CVE-2025-21504 CVE-2025-21505 CVE-2025-21518 CVE-2025-21519 CVE-2025-21520 CVE-2025-21521 CVE-2025-21522 CVE-2025-21523 CVE-2025-21525 CVE-2025-21529 CVE-2025-21531 CVE-2025-21534 CVE-2025-21536 CVE-2025-21540 CVE-2025-21543 CVE-2025-21546 CVE-2025-21555 CVE-2025-21559	mysql-8.0.41-1.0.1.1.al8
emacs	CVE-2025-1244	emacs-27.2-11.0.1.al8.1
webkit2gtk3	CVE-2024-54543 CVE-2025-24143 CVE-2025-24150 CVE-2025-24158 CVE-2025-24162	webkit2gtk3-2.46.6-1.0.1.al8
tigervnc	CVE-2025-26594 CVE-2025-26595 CVE-2025-26596 CVE-2025-26597 CVE-2025-26598 CVE-2025-26599 CVE-2025-26600 CVE-2025-26601	tigervnc-1.13.1-15.al8
rsync	CVE-2024-12087 CVE-2024-12088 CVE-2024-12747	rsync-3.1.3-21.0.1.al8
libxml2	CVE-2024-56171 CVE-2025-24928	libxml2-2.9.7-19.0.1.1.al8
krb5	CVE-2025-24528	krb5-1.18.2-31.0.1.al8
pcs	CVE-2024-52804	pcs-0.10.18-2.0.1.1.al8.4
webkit2gtk3	CVE-2025-24201	webkit2gtk3-2.46.6-2.0.1.al8
fence-agents	CVE-2025-27516	fence-agents-4.10.0-76.0.1.al8.6
podman	CVE-2025-22869	podman-4.9.4-20.0.1.al8
runc	CVE-2025-22869	runc-1.1.12-6.0.1.al8
grub2	CVE-2025-0624	grub2-2.02-162.0.1.al8
libreoffice	CVE-2025-1080	libreoffice-7.1.8.1-15.0.1.1.al8.1
freetype	CVE-2025-27363	freetype-2.10.4-10.al8
python-jinja2	CVE-2025-27516	python-jinja2-2.10.1-7.0.1.al8
libxslt	CVE-2024-55549 CVE-2025-24855	libxslt-1.1.32-6.1.0.1.al8
tomcat	CVE-2024-50379 CVE-2025-24813	tomcat-9.0.87-1.al8.3
expat	CVE-2024-8176	expat-2.2.5-17.al8
mod_auth_openidc	CVE-2025-31492	mod_auth_openidc-2.4.9.4-7.al8
xmlrpc-c	CVE-2024-8176	xmlrpc-c-1.51.0-11.0.1.al8
libtasn1	CVE-2024-12133	libtasn1-4.13-5.0.1.al8
bluez	CVE-2023-27349 CVE-2023-51589	bluez-5.63-5.0.1.al8

New features

• Added support for confidential computing features on AMD and NVIDIA GPUs.

• Added 72 ecosystem components to support the Inspur ecosystem.

• Improved the security of confidential computing.

• Added support for PCIe error injection through ras-tools.

• Added ancert to support the Alibaba Cloud Linux hardware test suite.

• Added 10 peripheral drivers to expand hardware support.

• Expanded hardware support to include models such as Feiteng S2500, Feiteng S5000C, intel-GRN, AMD-Turin, and domestically produced GPU cards.

• Updated util-linux-2.32.1-46.0.3.al8 to optimize the performance of the lscpu command in environments with many pcie devices.

• Updated erofs-utils-1.8.2-1.al8 to enable container storage.

• Updated java-11-alibaba-dragonwell-11.0.24.21.21-1.1.al8 to improve the performance of the BigDecimal class in big data scenarios.

• Updated java-21-alibaba-dragonwell-21.0.4.0.4-1.1.al8 and java-21-alibaba-jdk to improve Java performance.

• Added the system-rpm-config-129-1.0.2.1.al8 component for configuring system macro variables.

A new QCOW2-format image is available. It has the same content as the VHD-format image.

Drivers

The image includes 30 kmod driver packages, categorized as either installed by default or not installed by default.

• Installed by default

  • kmod-ast-5.10.134~012.1.ali5000.pro-1.14.4~1.al8.x86_64.rpm

  • kmod-lpfc-5.10.134~012.1.ali5000.pro-14.2.673.37~1.al8.x86_64.rpm

  • kmod-i40e-5.10.134~012.1.ali5000.pro-2.23.17~1.al8.x86_64.rpm

  • kmod-ice-5.10.134~012.1.ali5000.pro-1.12.13.4~1.al8.x86_64.rpm

  • kmod-igb-5.10.134~012.1.ali5000.pro-5.14.16~1.al8.x86_64.rpm

  • kmod-ixgbe-5.10.134~012.1.ali5000.pro-5.19.6~1.al8.x86_64.rpm

  • kmod-mellanox-ethernet-5.10.134~012.1.ali5000.pro-23.10~1.al8.x86_64.rpm

  • kmod-mpi3mr-5.10.134~012.1.ali5000.pro-8.11.1.0.0~1.al8.x86_64.rpm

  • kmod-ps3stor-5.10.134~012.1.ali5000.pro-2.3.1.24~1.al8.x86_64.rpm

  • kmod-qla2xxx-5.10.134~012.1.ali5000.pro-10.02.09.00_k~1.al8.x86_64.rpm

  • kmod-sfc-5.10.134~012.1.ali5000.pro-5.3.16.1004~1.al8.x86_64.rpm

  • kmod-smartpqi-5.10.134~012.1.ali5000.pro-2.1.22_040~1.al8.x86_64.rpm

  • kmod-sxe-5.10.134~012.1.ali5000.pro-1.3.1.1~1.al8.x86_64.rpm

  • kmod-hinic-5.10.134~012.1.ali5000.pro-1.0~1.al8.x86_64.rpm

  • kmod-xscale-5.10.134~012.1.ali5000.pro-1.2.0_367~1.al8.x86_64.rpm

  • kmod-bnxt_en-5.10.134~012.1.ali5000.pro-1.10.3_231.0.162.0~1.al8.x86_64.rpm

• Not installed by default

  • kmod-aoc_aliflash_sam-5.10.134~010.ali5000.pro-30.1.4.11~1.al8.x86_64.rpm

  • kmod-bnxt_re-5.10.134~012.1.ali5000.pro-1.10.3_231.0.162.0~1.al8.x86_64.rpm

  • kmod-devel-25-20.0.1.al8.x86_64.rpm

  • kmod-doc-25-20.0.1.al8.noarch.rpm

  • kmod-fic2-5.10.134~012.1.ali5000.pro-1.2.6~1.al8.x86_64.rpm

  • kmod-iavf-5.10.134~012.1.ali5000.pro-4.9.4~1.al8.x86_64.rpm

  • kmod-intel-QAT20-5.10.134~010.ali5000.pro-L.0.9.4__00004~1.al8.x86_64.rpm

  • kmod-intel_dlb2-5.10.134~010.ali5000.pro-8.2.0~1.al8.x86_64.rpm

  • kmod-irdma-5.10.134~012.1.ali5000.pro-1.13.43~1.al8.x86_64.rpm

  • kmod-ixgbevf-5.10.134~012.1.ali5000.pro-4.18.7~1.al8.x86_64.rpm

  • kmod-kvdo-6.2.3.114-74.1.al8.x86_64.rpm

  • kmod-libs-25-20.0.1.al8.x86_64.rpm

  • kmod-mellanox-5.10.134~012.1.ali5000.pro-23.10~1.al8.x86_64.rpm

  • kmod-mpt3sas-5.10.134~012.1.ali5000.pro-43.00.00.00~1.al8.x86_64.rpm

  • kmod-ngbevf-5.10.134~012.1.ali5000.pro-1.2.2~1.al8.x86_64.rpm

  • kmod-txgbevf-5.10.134~012.1.ali5000.pro-1.3.1~1.al8.x86_64.rpm

  • kmod-udma-5.10.134~010.ali5000.pro-0.1.0~3.al8.x86_64.rpm

Kernel

Upgraded the kernel to version kernel-5.10.134-012.1.ali5000.pro.al8.

• Scheduling

  • Added support for group balancer 2.0.

  • Optimized cluster scheduling support.

  • Added support for configuring identity for non-migratable threads in the root group.

  • Enhanced the core sched cookie feature with configurable options, enabling coexistence with normal tasks and task consolidation.

• Memory

  • Fixed a bug that could cause negative values for statistics in /proc/sys/vm/stat_refresh.

  • Fixed incorrect cache field statistics in parent-child memcg.

  • Fixed a compatibility issue between the page table sharing feature and hugetlb.

  • Backported patches that optimize per-CPU releases to prevent fragmentation from delaying the freeing of percpu space.

  • Fixed a kernel crash caused by hugetlb soft offline.

  • Fixed a kernel crash caused by zero-page splitting.

  • The hugetext feature now supports direct collapse to accelerate the generation of huge pages for code.

  • Fixed an accounting issue in memcg when pre_oom is enabled.

• Network

  • virtio-net: Optimized the virtio_net RSS logic to align the RSS configuration with the device and ensure it updates correctly with the number of queues.

  • bond: Added support for 200 Gbps/400 Gbps bond_3ad.

  • geneve: Added support for inner IPv4/IPv6 protocols.

  • AliCDN newack: Added the newack (synproxy) feature for AliCDN.

  • Backported several bug fixes from the 5.10-stable branch.

• BPF

  Backported stability patches from the upstream stable community.

• Storage

  • io_uring

    Enhanced the validity check for the CPU specified when creating a percpu sqthread.

    Improved the io_uring passthrough mechanism to support bio-based polling and batch completion.

  • fuse

    Refactored and optimized fuse, reducing the overhead of its temporary pages to improve writeback performance.

  • virtio-blk

    Added support for polling I/O and for configuring a separate queue depth per device.

  • Key module stability patches

    Covering io_uring, VFS, ext4, fuse/virtio-fs, NFS, and block.

• Driver

  • Fixed an issue on HyGon No.4 machines where a disk device remained for 10 seconds after unplugging a USB drive.

  • Fixed a startup race condition in the intel_th module that caused a kernel crash.

  • Kunpeng model support

    • Added support for huawei hisi sas disks.

    • Added support for the SPI bus on Kunpeng models.

    • Added support for the Kunpeng PMU.

    • Added support for the clocksource time management driver on Kunpeng models.

  • SW model support: Fixed several bugs in the SW interrupt controller driver.

  • Backported numerous stability fixes from LTS branches for the dm/md modules.

• x86 platform

  • Optimized interrupt allocation

    You can now configure the managed_irq_per_node parameter to control the amount of interrupt vector space used by managed IRQs. This configuration enables a higher density of physical devices, such as NVMe solid-state drives or network interface cards, and virtual devices, such as virtio-blk.

  • HyGon platform support

    • Fixed an issue that prevented CPUs on the HyGon platform from being taken offline.

    • Set CONFIG_CRYPTO_DEV_CCP_DD and CONFIG_TCG_HYGON to y to fix an issue that prevented IMA from finding the HyGon TPM during startup.

  • Intel platform support

    Added support for the IFS feature on the GNR platform.

• ARM platform

  Kunpeng 920b platform: Added support for core enabling, hccs, way-ca, mpam, smmuv3, gic, its, kvm, perf-pmu, and ras.

• Perf

  • Added support for the DesignWare PCIe PMU driver, enabling Perf to collect PCIe rootport bandwidth traffic.

  • Added support for Hisilicon uncore PMU drivers, including PCIe, HNS3, PA, SLLC, L3C, and LLA PMU drivers.

• Version alinux-base-setup-3.2-6.2.al8 fixed an issue where kdump could not be generated on Hygon and Kunpeng machines.

• Version gdm-40.0-27.0.1.1.al8 fixed an issue on Hygon machines where the desktop failed to wake up after the screen was locked.

• The numactl-2.0.18-2.0.4.al8 version fixed an issue where speccpu performance on Hygon machines did not meet the factory standard.

• The EULA file for Alibaba Cloud Linux was updated in version alinux-release-3.2104.12-1.al8.

• Version activation_agent-0.2.0-3.al8 fixes a duplicate registration issue that occurred when an agent was activated after the registration phase.

• Version systemd-239-82.0.3.4.al8.2 fixes the issue of abnormal pod exits, as well as an issue where deployments failed because non-device cgroup subgroups were reclaimed by systemd within 20 seconds when Delegate=yes.

• Version dump-0.4-0.36.b46.3.al8 fixed an issue where restore reports an error after a dump incremental backup.

• The memory leak was fixed in version ledmon-0.97-1.0.2.al8.

• Version tuned-2.22.1-5.0.1.1.al8 improves data access efficiency on Yitian.

• Fixed an issue where components failed to install from the mirror.

• Optimized process management technology.

  The new, self-developed async-fork component provides targeted optimizations for the fork operation of large-memory processes, significantly reducing processing time and improving system responsiveness.

• Kernel-state network monitoring.

  Adds the tcprt component to provide TCP monitoring for request-response communication patterns.

• BaseOS enhancements.

  • Self-maintained core components, including gcc 10, gcc-toolset-12, and binutils 2.35.

  • Adds support for multiple Python versions through modularization.

• Enhanced standards compliance.

  Built-in support for GB18030-2022 encoding ensures compliance with the latest Chinese encoding standards.

• Programming environment and performance optimizations.

  • Adds the java-1.8.0-alibaba-jdk and java-11-alibaba-jdk components.

  • Adds the Alibaba-cloud-compiler component, a C/C++ compiler based on Clang/LLVM developed for large-scale cloud service scenarios.

• Intelligent system tuning tool.

  Includes the keentune intelligent full-stack tuning tool by default. This tool automates operating system tuning to achieve expert-level performance enhancements with a single click.

Kernel

Upgrades the kernel to version kernel-5.10.134-010.ali5000.pro.al8.

• Backports the dynamic kernel preemption feature from the upstream community. You can switch preemption models through the cmdline or sysfs interface.

• Backports the core scheduling security feature from the upstream community. This feature only allows trusted processes from the same group to run concurrently on Hyper-Threading siblings of the same physical core. This feature is incompatible with Group Identity. Do not enable both features simultaneously.

• Introduces the Group Identity 2.0 fine-grained priority feature.

  • Calibrates the CPU share ratio for Group Identity 2.0.

  • Adds the Group Identity 2.0 force idled time metric.

  • Optimizes Group Identity to enhance load control for tasks with different priorities.

• Introduces cgroup v2 IO SLI.

• Adds support for Assess CPU (ACPU). ACPU measures the idle time of a Hyper-Threading peer while a task is running and provides per-cgroup statistics. This can be used to evaluate hardware resource contention on a shared CPU core when tasks are running.

• Adds the in-house HT-aware-quota feature, which uses cfs bandwidth control and core scheduling to provide a compute power stability solution for hybrid deployment scenarios. It calibrates the quota by detecting whether the Hyper-Threading peer is idle, ensuring that tasks receive relatively stable compute power in each scheduling cycle. This is suitable for compute-intensive tasks.

• Adds a cgroup-level SCHED_IDLE feature. You can set the cpu.idle property of a target cgroup to change its scheduling policy to SCHED_IDLE. This feature is suitable for batch management of offline tasks.

• In hybrid deployment scenarios with both offline and online services, dynamic CPU isolation technology, combined with scheduling optimizations in G11.0/2.0, ensures that online service latency remains within a reasonable range.

• Enhances Kfence to support dynamic enabling/disabling, full capture, targeted monitoring, and Order-0 Page monitoring. This improves its ability to diagnose memory issues in production environments.

• Improves the on-demand loading performance of Nydus container images by combining EROFS (Enhanced Read-Only File System) and Fscache (File System Cache).

• Optimizes memory access across processor nodes.

• Improves performance in database scenarios by using io-uring.

Memory

• Adds a slab memory isolation feature for Out-Of-Tree (OOT) modules to quickly locate issues like out-of-bounds memory access or resource leaks.

• Adds a fast OOM feature to prevent prolonged system unresponsiveness due to memory pressure in multi-core, large-memory environments. This feature helps services increase memory deployment density and enhance the performance stability of online services during periods of high memory usage.

• Adds support for batch TLB flushing. The Batch migration feature performs batch TLB flushing and page copy operations during memory page migration, which improves the performance of kernel page migration. This version refactors and optimizes the original Batch migration feature based on upstream code. Key changes to the refactored backend include:

  • Removes the cmdline parameter batch_migrate and the /sys/kernel/mm/migrate/batch_migrate_enabled interface. Batch migration is now the default for page migration.

  • Adds the /sys/kernel/mm/migrate/dma_migration_min_pages interface with a default value of 32. This interface applies only when the DMA page copy feature is enabled. The DMA page copy feature is used only when /sys/kernel/mm/migrate/dma_migrate_enabled is enabled and the number of migrate pages reaches the value set in /sys/kernel/mm/migrate/dma_migration_min_pages.

• Backports the cachestat feature. This feature introduces the cachestat system call to the kernel, which allows you to view detailed page cache statistics for a specified file.

• Introduces a memcg THP control interface to disable THP allocation for a specified memcg.

• Adds support for page table affinity, which provides cross-die page table statistics. Page table affinity allows the page tables of QoS-sensitive services to be allocated to the current NUMA node whenever possible during memory pressure, reducing memory access latency and achieving faster, more efficient memory access.

• KFence enhancements and fixes.

  • Adds an in-house KFence enhancement for the arm64 architecture. This feature allows you to dynamically enable or disable KFence and fully capture memory corruption issues, facilitating both online detection and offline debugging.

  • Adds a feature to trigger an immediate system panic when a memory issue is captured, helping developers analyze issues more effectively in debugging environments. You can enable this feature by setting the boot cmdline "kfence.fault=panic" or by running the echo panic > /sys/module/kfence/xparameters/fault command.

  • Fixed a kernel panic that occurred when KFence was used with cgroup kmem statistical counting enabled.

BPF

• New features and helpers.

  • bpf_for_each_map_elem: A helper to iterate over BPF map elements.

  • bpf_snprintf: A helper to format strings.

  • bpf_timer: A timer that can trigger a callback function at a specified time.

  • bpf_loop: Overcomes the limitation of constant-bounded loops and allows for more flexible loop implementation.

  • bpf_strncmp: A helper to compare strings.

  • bpf_ktime_get_tai_ns: Gets the time of the CLOCK_TAI type.

  • bpf_skb_load_bytes: Adds support for the raw_tp type, allowing programs of the raw_tp type to read skb data, including non-linear data.

• The arm64 architecture now supports fentry, fexit, fmod_ret, bpf_lsm, and other trampoline-related features, providing enhanced tracing, diagnostics, and security capabilities. bpf_trampoline is compatible with livepatch.

Network

• New virtio-net features

  • virtio now supports a control vq timeout mechanism, which prevents high CPU polling load on the virtual machine when a device becomes unresponsive. The default timeout is seven days.

  • Adds support for virtio-net device statistics, which allows the kernel to retrieve device statistics to improve fault localization and issue diagnosis.

  • Adds a queue reset feature that allows you to adjust the queue size of a virtual machine to reduce packet loss and optimize latency.

  • Dynamic interrupt moderation (netdim) intelligently adjusts interrupt aggregation parameters based on real-time traffic to optimize data reception performance.

  • Optimizes virtio checksum. Fixed an issue where the virtio NIC validation of the checksum was controlled by a specific feature. In XDP application scenarios, the guest OS no longer needs to re-verify the checksum, which significantly reduces CPU usage.

• SMC

  • Synchronizes with community bug fixes related to buffers.

  • Optimizes the return values for SMC fallback reasons.

  • Fixes a conflict with the upstream IPPROTO_SMC definition.

  • Optimizes the SMC reachability check in eRDMA scenarios.

  • Fixed a low-probability kernel panic.

  • Adds the SMC-D loopback feature to accelerate local inter-process and inter-container TCP communication.

• TCP

  The data path has new tracepoints: one tracepoint is added for each of the send, recv, and ack operations on TCP data.

Storage

• erofs

  • Adds support for passing a zero-length iovec in rafsv6 mode.

  • In rafsv6 mode, dax mappings can now be reclaimed to prevent issues such as OOM and fuse hang caused by fixed memory usage.

  • Uses kconfig to restrict rafsv6 for use in secure container scenarios only. fscache now supports failover in on-demand loading mode.

  • Synchronizes with stability patches from the community mainline.

• ext4

  • Fixed a semantic issue with O_DIRECT and O_SYNC that has existed since the introduction of the iomap framework. The issue occurred because generic_write_sync() is called within the iomap framework, while the i_disksize update happens after iomap_dio_rw(). This caused the on-disk file length to not be updated in time during append write operations, preventing the written data from being read after an unexpected power failure.

  • Synchronizes with stability patches from the community Stable branch.

• XFS

  • Adds support for the FSDAX, Reflink, and Dedupe features for the XFS file system. This release also includes specific optimizations for Tair PMEM instances, such as ensuring the contiguity of snapshot source files, improving dirty page writeback efficiency, and removing the dependency on the reverse map btree to optimize Page Fault latency.

  • Backports the delayed inode inactivation feature. This feature delegates reclamation operations to a background kworker process, reducing frontend application stalls caused by deletion operations. This feature also optimizes the snapshot cleanup scenario for Tair PMEM instances.

• fuse

  • Adds support for shared mmap in cache=none mode.

  • Adds a dynamic switch for the strict limit feature. The fuse module sets a strict limit that could cause extremely slow or stalled writebacks in certain scenarios. The new sysfs knobs can dynamically resolve this issue.

  • Synchronizes with stability patches from the community Stable branch.

• cgroup writeback

  Fixed an issue where the memory cgroup persisted for an extended period when lazytime was enabled. This issue could cause the number of memory cgroups in containerized deployment environments to remain high, leading to increased memory usage and high system load when traversing cgroups.

• io_uring

  • Fixed an issue with io_uring percpu sqthread after updating the io_uring codebase to version 5.15.85.

  • Synchronizes with stability patches from the community Stable branch.

• block

  • Adds IO SLI for blkio cgroup v2, including wait time, service time, completion time, io queued, and bytes queued.

  • Simplifies the BDI logic to fix a BDI reference counting bug.

  • Adds support for 2 MB I/O. In extreme cases where each bio_vec contains only one 4 KB page, the current 5.10 kernel supports a maximum of 1 MB I/O. The additional splitting logic can impact performance in certain business scenarios.

  • Made blk-iocost and writeback throttling mutually exclusive to resolve an issue where iocost and wbt could not work together.

  • Fixed an ABBA deadlock issue caused by a race condition when setting blk-iocost QoS.

  • Avoids pre-allocating large SGL buffers to optimize I/O memory usage for virtio-blk devices. This is especially important in high-density secure container scenarios.

  • Synchronizes with stability patches from the community Stable branch.

• nvme

  Fixed a null pointer dereference that occurred when nvme_reset and nvme_rescan were executed concurrently.

• tcmu

  The tcmu_loop device now supports configurable parameters, including can_queue, nr_hw_queues, cmd_per_lun, and sg_tablesize. When the backend device has sufficient capabilities, appropriately increasing these parameters can significantly improve performance.

• Optimizes kernfs global lock contention to reduce the impact of increased loadD caused by concurrent access from monitoring programs.

Security

• Enables TDX Guest-related configurations to support TDX confidential virtual machine scenarios.

• Adds support for a generic API for TDX Guests to retrieve the attestation quota.

• Adds support for event notification interrupts for TDX Guests.

Configuration

Enables CONFIG_IPMI_HANDLER and CONFIG_IPMI_PANIC_EVENT for crash monitoring and diagnostics.

x86

• Provides basic support and bug fixes for the Zhaoxin KH-40000 platform.

• HyGon platform

  • Adds full support for various features of Hygon No. 4 processors (749X, 748X, 34XX), including a new CPU topology, x2APIC, microcode loading, MCA RA, DDR5, SR-IOV, QoS, L3 Perf/PMU, and temperature monitoring.

  • Fixes the dependency between the KVM and CCP modules.

  • Adds support for CSV3 secure virtual machines, including live migration, hardware-protected virtual machine page tables, and hardware-isolated virtual machine memory. This update also fixes an issue where the host VMM could not read or write to virtual machine memory. Additionally, CSV3 shared page management is optimized by merging consecutive pages and using an rbtree to manage pages.

  • Adds two generic APIs for encrypting and decrypting user space process pages.

  • Adds support for Hygon Key Management (TKM) virtualization.

  • Adds support for passing through Hygon DCUs to virtual machines.

• Intel platform

  • Adds support for Intel-idle GNR/SRF.

  • Adds support for Sched change for GNR/SRF (extra L2 domain).

  • Adds support for AMX 2.0 with FP16 data type.

  • Adds support for GNR/SRF RAS EDAC.

  • Adds support for IOMMU Perf.

  • Adds support for GNR/PEBS Enhancements - Timed PEBS.

  • Adds support for the LBR event logging feature.

  • Adds support for GNR PMU Core/uncore events.

  • Adds support for RDT: L2/L3 Non-contiguous way masks.

  • Enhances the IDXD (DSA/IAA 2.0) feature.

  • Adds support for Icelake HWDRC.

• AMD platform

  • Fully fixes CVE-2023-20569 on the AMD platform.

  • Adds support for AMD LBRv2 and related bug fixes.

  • Adds support for AMD Perf UMC and related bug fixes.

  • Adds support for AMD Perf DF.

  • Adds support for AMD Perf ibrs and other related bug fixes.

  • Adds support for AMD QoS BMEC.

  • Adds support for AMD IOMMU io page table.

  • Adds support for AMD IOMMU PCI segment.

  • Adds support for AMD IOMMU X2AVIC and related IOMMU bug fixes.

ARM platform

• Adjusts the default cmdline settings to enable the irqtime_account feature.

• Adds a switch to control the early reservation of crashkernel.

• Adds MPAM virtualization support.

• Adds support for the Perf Metric feature for CMN and DDR PMUs.

Fixed 273 known vulnerabilities.

Category	CVE
Kernel security vulnerabilities	CVE-2022-3176, CVE-2022-2602, CVE-2021-4037, CVE-2022-34918, CVE-2022-32250, CVE-2021-4037, CVE-2022-0171, CVE-2022-1679, CVE-2022-2585, CVE-2022-2586, CVE-2022-2588, CVE-2022-2602, CVE-2022-26373, CVE-2022-2663, CVE-2022-2905, CVE-2022-2978, CVE-2022-3028, CVE-2022-3061, CVE-2022-3169, CVE-2022-3176, CVE-2022-3435, CVE-2022-3521, CVE-2022-3524, CVE-2022-3534, CVE-2022-3535, CVE-2022-3542, CVE-2022-3545, CVE-2022-3564, CVE-2022-3565, CVE-2022-3566, CVE-2022-3567, CVE-2022-3586, CVE-2022-3594, CVE-2022-3621, CVE-2022-3623, CVE-2022-3625, CVE-2022-3628, CVE-2022-3629, CVE-2022-3633, CVE-2022-3635, CVE-2022-3646, CVE-2022-3649, CVE-2022-36946, CVE-2022-39189, CVE-2022-39190, CVE-2022-39842, CVE-2022-40307, CVE-2022-40768, CVE-2022-41222, CVE-2022-41674, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721, CVE-2022-42722, CVE-2022-42895, CVE-2022-42896, CVE-2022-43750, CVE-2022-4378, CVE-2022-4696, CVE-2023-1076, CVE-2022-41849, CVE-2023-1077, CVE-2023-1073, CVE-2022-3707, CVE-2022-4095, CVE-2022-4744, CVE-2023-1095, CVE-2023-1074, CVE-2022-47521, CVE-2023-23000, CVE-2022-4662, CVE-2023-1118, CVE-2023-23004, CVE-2023-0590, CVE-2023-1281, CVE-2021-3759, CVE-2023-0461, CVE-2021-33061, CVE-2023-0597, CVE-2022-3523, CVE-2022-42703, CVE-2022-4129, CVE-2022-42328, CVE-2022-42329, CVE-2023-23454, CVE-2023-0394, CVE-2023-23455, CVE-2023-23559, CVE-2022-45934, CVE-2022-47520, CVE-2022-47519, CVE-2022-47518, CVE-2022-47946, CVE-2022-2196, CVE-2022-3643, CVE-2022-4139, CVE-2022-1184, CVE-2022-41218, CVE-2022-3303, CVE-2023-0266, CVE-2022-4696, CVE-2023-0179, CVE-2022-42719, CVE-2022-39190, CVE-2022-0171, CVE-2022-4378, CVE-2022-39189, CVE-2022-3566, CVE-2022-3535, CVE-2022-3633, CVE-2022-3435, CVE-2022-3534, CVE-2022-3564, CVE-2022-3524, CVE-2022-3567, CVE-2022-3586, CVE-2022-3521, CVE-2022-42720, CVE-2022-42721, CVE-2022-42722, CVE-2022-41674, CVE-2022-2663, CVE-2022-3028, CVE-2022-1679, CVE-2022-42895, CVE-2022-42896, CVE-2022-3565, CVE-2022-3545, CVE-2022-3629, CVE-2022-40307, CVE-2022-2905, CVE-2022-3594, CVE-2022-3061, CVE-2022-3628, CVE-2022-3635, CVE-2022-39842, CVE-2022-3169, CVE-2022-3623, CVE-2022-40768, CVE-2023-1380, CVE-2023-28466, CVE-2023-26545, CVE-2023-1075, CVE-2022-47929, CVE-2023-30456, CVE-2023-32233, CVE-2023-0386, CVE-2023-2124, CVE-2023-2162, CVE-2023-35001, CVE-2023-31248, CVE-2023-0459, CVE-2023-3117, CVE-2023-1382, CVE-2023-35825, CVE-2023-3268, CVE-2023-3220, CVE-2023-28327, CVE-2023-32269, CVE-2023-2483, CVE-2023-2177, CVE-2023-1859, CVE-2023-2002, CVE-2022-39188, CVE-2023-22995, CVE-2023-35788, CVE-2023-33288, CVE-2023-20938, CVE-2023-0045, CVE-2022-36280, CVE-2023-2194, CVE-2022-4382, CVE-2023-1670, CVE-2023-1989, CVE-2023-20928, CVE-2023-1855, CVE-2023-30772, CVE-2023-0458, CVE-2023-1990, CVE-2023-1829, CVE-2022-4379, CVE-2023-26607, CVE-2023-2985, CVE-2022-42432, CVE-2023-1078, CVE-2023-2269, CVE-2023-1380, CVE-2023-28466, CVE-2023-26545, CVE-2023-1075, CVE-2023-32233, CVE-2022-47929, CVE-2023-30456, CVE-2023-0386, CVE-2022-3606, CVE-2023-25012, CVE-2023-1611, CVE-2023-1076, CVE-2022-41849, CVE-2023-1077, CVE-2023-1073, CVE-2022-3707, CVE-2022-4095, CVE-2022-4744, CVE-2023-1095, CVE-2023-1074, CVE-2022-47521, CVE-2023-23000, CVE-2022-4662, CVE-2023-1118, CVE-2023-23004, CVE-2023-0590, CVE-2023-1281, CVE-2021-3759, CVE-2023-0461, CVE-2021-33061, CVE-2023-0597, CVE-2022-3108, CVE-2023-2006, CVE-2023-2156, CVE-2023-3090, CVE-2023-31084, CVE-2023-3111, CVE-2023-3117, CVE-2023-3161, CVE-2023-3212, CVE-2023-35823, CVE-2023-35824, CVE-2023-35828, CVE-2023-35829, CVE-2023-3609, CVE-2023-3610, CVE-2023-3611, CVE-2023-3773, CVE-2023-3776, CVE-2023-3812, CVE-2023-4004, CVE-2023-4128, CVE-2023-4147.
BaseOS security vulnerabilities	CVE-2024-1975, CVE-2024-1737, CVE-2023-45290, CVE-2024-1394, CVE-2024-3727, CVE-2024-6104, CVE-2024-24783, CVE-2024-24784, CVE-2024-24789, CVE-2024-37298, CVE-2023-27522, CVE-2024-3596, CVE-2023-45288, CVE-2023-45289, CVE-2023-41419, CVE-2024-6345, CVE-2023-23934, CVE-2023-25577, CVE-2024-29510, CVE-2024-5564, CVE-2023-1729, CVE-2024-39936, CVE-2022-48624, CVE-2024-32487, CVE-2024-21131, CVE-2024-21138, CVE-2024-21140, CVE-2024-21144, CVE-2024-21145, CVE-2024-21147, CVE-2024-7348, CVE-2024-42472, CVE-2024-45769, CVE-2024-45770.

• Fixed stability issues in erofs compression mode.

• Fixed stability issues in erofs over fscache.

• Fixed a writeback performance degradation issue that occurred when BDI used the STRICTLIMIT feature and the BDI share was 0.

• Fixed a seccomp memory leak.

• Fixed an issue where user operations could lead to an incorrect reference count for ZERO_PAGE.

• Fixed a potential recursive memory reclamation issue in TCMU.

• Fixed a kernel panic that occurred when the ioasids subsystem migrated kernel threads.

• Fixed an issue where I/O statistics were double-counted when no throttling rules were configured.

• Fixed a kernel panic caused by enabling both Group Identity and core scheduling.

• Changed the CFS bandwidth control throttling release mechanism from synchronous to asynchronous to optimize bandwidth control efficiency in environments with a large number of CPUs.

• Fixed a potential race condition when disabling the global switch for core sched.

• Fixed inaccurate sibidle statistics under high IRQ loads.