ctrliq · PlaidCat · Aug 14, 2026 · Aug 11, 2026 · Aug 13, 2026 · Aug 13, 2026
diff --git a/Makefile.rhelver b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 10
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 553.153.1
+RHEL_RELEASE = 553.155.1
 
 #
 # ZSTREAM

diff --git a/ciq/ciq_backports/kernel-4.18.0-553.154.1.el8_10/rebuild.details.txt b/ciq/ciq_backports/kernel-4.18.0-553.154.1.el8_10/rebuild.details.txt
@@ -0,0 +1,24 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v4.18~1..kernel-mainline: 625874
+Number of commits in rpm: 8
+Number of commits matched with upstream: 0 (0.00%)
+Number of commits in upstream but not in rpm: 625874
+Number of commits NOT found in upstream: 8 (100.00%)
+
+Rebuilding Kernel on Branch rocky8_10_rebuild_kernel-4.18.0-553.154.1.el8_10 for kernel-4.18.0-553.154.1.el8_10
+Clean Cherry Picks: 0 (0.00%)
+Empty Cherry Picks: 0 (0.00%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+
+__CHANGES NOT IN UPSTREAM________________
+Adding prod certs and changed cert date to 20210620
+Adding Rocky secure boot certs
+Fixing vmlinuz removal
+Fixing UEFI CA path
+Porting to 8.10, debranding and Rocky branding
+Fixing pesign_key_name values
+iio: event: Fix event FIFO reset race
+redhat: add kmap.py tool and kernel-kmap-internal package
diff --git a/ciq/ciq_backports/kernel-4.18.0-553.155.1.el8_10/08841b06.failed b/ciq/ciq_backports/kernel-4.18.0-553.155.1.el8_10/08841b06.failed
@@ -0,0 +1,58 @@
+udf: fix partition descriptor append bookkeeping
+
+jira KERNEL-1484
+cve CVE-2026-45991
+Rebuild_History Non-Buildable kernel-4.18.0-553.155.1.el8_10
+commit-author Seohyeon Maeng <bioloidgp@gmail.com>
+commit 08841b06fa64d8edbd1a21ca6e613420c90cc4b8
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-4.18.0-553.155.1.el8_10/08841b06.failed
+
+Mounting a crafted UDF image with repeated partition descriptors can
+trigger a heap out-of-bounds write in part_descs_loc[].
+
+handle_partition_descriptor() deduplicates entries by partition number,
+but appended slots never record partnum. As a result duplicate
+Partition Descriptors are appended repeatedly and num_part_descs keeps
+growing.
+
+Once the table is full, the growth path still sizes the allocation from
+partnum even though inserts are indexed by num_part_descs. If partnum is
+already aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep
+the old capacity and the next append writes past the end of the table.
+
+Store partnum in the appended slot and size growth from the next append
+count so deduplication and capacity tracking follow the same model.
+
+Fixes: ee4af50ca94f ("udf: Fix mounting of Win7 created UDF filesystems")
+	Cc: stable@vger.kernel.org
+	Signed-off-by: Seohyeon Maeng <bioloidgp@gmail.com>
+Link: https://patch.msgid.link/20260310081652.21220-1-bioloidgp@gmail.com
+	Signed-off-by: Jan Kara <jack@suse.cz>
+(cherry picked from commit 08841b06fa64d8edbd1a21ca6e613420c90cc4b8)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	fs/udf/super.c
+diff --cc fs/udf/super.c
+index 74b13347cd94,df2b62eddfc0..000000000000
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@@ -1596,9 -1694,10 +1596,14 @@@ static struct udf_vds_record *handle_pa
+  			return &(data->part_descs_loc[i].rec);
+  	if (data->num_part_descs >= data->size_part_descs) {
+  		struct part_desc_seq_scan_data *new_loc;
+- 		unsigned int new_size = ALIGN(partnum, PART_DESC_ALLOC_STEP);
++ 		unsigned int new_size;
+
+++<<<<<<< HEAD
+ +		new_loc = kcalloc(new_size, sizeof(*new_loc), GFP_KERNEL);
+++=======
++ 		new_size = data->num_part_descs + PART_DESC_ALLOC_STEP;
++ 		new_loc = kzalloc_objs(*new_loc, new_size);
+++>>>>>>> 08841b06fa64 (udf: fix partition descriptor append bookkeeping)
+  		if (!new_loc)
+  			return ERR_PTR(-ENOMEM);
+  		memcpy(new_loc, data->part_descs_loc,
+* Unmerged path fs/udf/super.c
diff --git a/ciq/ciq_backports/kernel-4.18.0-553.155.1.el8_10/rebuild.details.txt b/ciq/ciq_backports/kernel-4.18.0-553.155.1.el8_10/rebuild.details.txt
@@ -0,0 +1,23 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v4.18~1..kernel-mainline: 625874
+Number of commits in rpm: 8
+Number of commits matched with upstream: 2 (25.00%)
+Number of commits in upstream but not in rpm: 625872
+Number of commits NOT found in upstream: 6 (75.00%)
+
+Rebuilding Kernel on Branch rocky8_10_rebuild_kernel-4.18.0-553.155.1.el8_10 for kernel-4.18.0-553.155.1.el8_10
+Clean Cherry Picks: 1 (50.00%)
+Empty Cherry Picks: 1 (50.00%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+08841b06fa64d8edbd1a21ca6e613420c90cc4b8 udf: fix partition descriptor append bookkeeping
+
+__CHANGES NOT IN UPSTREAM________________
+Adding prod certs and changed cert date to 20210620
+Adding Rocky secure boot certs
+Fixing vmlinuz removal
+Fixing UEFI CA path
+Porting to 8.10, debranding and Rocky branding
+Fixing pesign_key_name values
diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
@@ -202,17 +202,16 @@ int iio_event_getfd(struct iio_dev *indio_dev)
 		goto unlock;
 	}
 
+	kfifo_reset_out(&ev_int->det_events);
+
 	iio_device_get(indio_dev);
 
 	fd = anon_inode_getfd("iio:event", &iio_event_chrdev_fileops,
 				indio_dev, O_RDONLY | O_CLOEXEC);
 	if (fd < 0) {
 		clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags);
 		iio_device_put(indio_dev);
-	} else {
-		kfifo_reset_out(&ev_int->det_events);
 	}
-
 unlock:
 	mutex_unlock(&indio_dev->mlock);
 	return fd;

diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -2294,6 +2294,9 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_tx_ring *tx_ring)
 
 	ice_trace(xmit_frame_ring, tx_ring, skb);
 
+	/* record the location of the first descriptor for this packet */
+	first = &tx_ring->tx_buf[tx_ring->next_to_use];
+
 	count = ice_xmit_desc_count(skb);
 	if (ice_chk_linearize(skb, count)) {
 		if (__skb_linearize(skb))
@@ -2319,8 +2322,6 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_tx_ring *tx_ring)
 
 	offload.tx_ring = tx_ring;
 
-	/* record the location of the first descriptor for this packet */
-	first = &tx_ring->tx_buf[tx_ring->next_to_use];
 	first->skb = skb;
 	first->bytecount = max_t(unsigned int, skb->len, ETH_ZLEN);
 	first->gso_segs = 1;
@@ -2382,6 +2383,7 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_tx_ring *tx_ring)
 out_drop:
 	ice_trace(xmit_frame_ring_drop, tx_ring, skb);
 	dev_kfree_skb_any(skb);
+	first->skb = NULL;
 	return NETDEV_TX_OK;
 }
 

diff --git a/fs/udf/super.c b/fs/udf/super.c
@@ -1596,8 +1596,9 @@ static struct udf_vds_record *handle_partition_descriptor(
 			return &(data->part_descs_loc[i].rec);
 	if (data->num_part_descs >= data->size_part_descs) {
 		struct part_desc_seq_scan_data *new_loc;
-		unsigned int new_size = ALIGN(partnum, PART_DESC_ALLOC_STEP);
+		unsigned int new_size;
 
+		new_size = data->num_part_descs + PART_DESC_ALLOC_STEP;
 		new_loc = kcalloc(new_size, sizeof(*new_loc), GFP_KERNEL);
 		if (!new_loc)
 			return ERR_PTR(-ENOMEM);
@@ -1607,6 +1608,7 @@ static struct udf_vds_record *handle_partition_descriptor(
 		data->part_descs_loc = new_loc;
 		data->size_part_descs = new_size;
 	}
+	data->part_descs_loc[data->num_part_descs].partnum = partnum;
 	return &(data->part_descs_loc[data->num_part_descs++].rec);
 }
 

diff --git a/kernel.sbat b/kernel.sbat
@@ -1,2 +1,2 @@
 sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-kernel.rocky,1,RESF,kernel-core,4.18.0-553.153.1.el8_10.x86_64,mailto:security@rockylinux.org
+kernel.rocky,1,RESF,kernel-core,4.18.0-553.155.1.el8_10.x86_64,mailto:security@rockylinux.org