MantisBT - Issues

0000678: webkit2gtk3 2.54.0 breaks Cisco Secure Client SAML/SSO authentication — window goes blank after credential submission (post-redi

Fri, 25 Sep 2026 16:29:33 +0000

The SAML/SSO login window opened by Cisco Secure Client's acwebhelper component fails partway through authentication.

OS: AlmaLinux 9.x (also reproduced on a fresh AlmaLinux 9 install)
Package: webkit2gtk3-2.54.0-1.el9_8.x86_64 / webkit2gtk3-jsc-2.54.0-1.el9_8.x86_64
Application: Cisco Secure Client 5.1.14.145 (Linux, RPM predeploy install)
Working reference system: AlmaLinux 8, webkit2gtk3-2.52.5-1.el8_10, same Cisco Secure Client version — works correctly

0000677: [AlmaLinux][PCI-HYPERV][Backport][Distros] PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip

Thu, 24 Sep 2026 16:26:44 +0000

Request backport of the following patches.

Summary
The Hyper-V vPCI MSI irqchip never installs an irq_retrigger() callback. On CPU hot-unplug fixup_irqs() migrates the interrupts which are affine to the outgoing CPU to a new target. If an interrupt still has its pending bit set in the outgoing CPU's IRR at that point, fixup_irqs() resends it on the new target through the irqchip's rq_retrigger() callback. As the Hyper-V PCI/MSI chip does not provide that callback, the pending interrupt is silently dropped, which can result in lost interrupts, stalls and "No irq handler for vector" messages during CPU hotplug.

Install irq_chip_retrigger_hierarchy() as the irq_retrigger() callback for the Hyper-V PCI/MSI irqchip, so that a pending interrupt is resent on its new target CPU via the parent x86 vector domain.

Patch URL's
https://lore.kernel.org/all/20260824002228.GF3566091@liuwe-devbox-debian-v2.local/
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/pci/controller/pci-hyperv.c?id=86bdd16e8f390d51bae9e77a4bc4164ca2f580fe

0000676: [AlmaLinux][hv_netvsc][Backport][Distros] 3 Patches: [Drivers: hv: decrypt netvsc buffers on contiguous direct-map addresses]

Thu, 24 Sep 2026 15:54:14 +0000

Request backport of the following patches.

Summary
These 3 patches fix the hv_netvsc driver for fully enlightened ARM CVMs on Cobalt 200 and NVIDIA VR.

Patch URL's
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f85e1cc5ecbbbb18ac68639f667c9de49b3ca986
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=73fe42af955a24b6cc792b9a4867e809196f05ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8f1da3536b8f8420988fe6e6ae15d58afa2ba2d8

0000671: [AlmaLinux][hv_netvsc][Backport][Distros] hv_netvsc: Advertise the SR-IOV capability for CoCo VMs

Wed, 23 Sep 2026 14:27:41 +0000

Request backport of the following patch.

Summary
ACC will enable AccelNet (AN) for CVMs (without TDISP) on Azure around Oct-Nov, 2026. A Linux NetVSC driver change is required in the Linux distros, e.g. Ubuntu, RHEL, AzLinux, etc.

Patch URL
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=922cc43c624330b9cf646d52fc82c820d9f699b3

Note:
For AN to work for Linux CVMs with MANA, the below dependant patchset is also required:

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=2e2a83b4998af4384e677d3b2ac08565274279bf
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=c72a0f09c57f92113df69f9b902d11c9e4b132f5

0000675: $realpath_root in fastcgi_param triggers fastcgi request length mismatch

Mon, 21 Sep 2026 19:28:52 +0000

Distribution: AlmaLinux 9.8

Package:
nginx-1.24.0-7.module_el9.8.0+307+7a7a3a71.5.alma.1.x86_64

PHP is executed through PHP-FPM.

Problem

After updating nginx to the package above, using the nginx variable $realpath_root as the value of a fastcgi_param causes nginx to abort the FastCGI request with:

[alert] ... fastcgi request length mismatch

The problem is reproducible with an otherwise unused FastCGI parameter, so it does not appear to be related to PHP's handling of DOCUMENT_ROOT or SCRIPT_FILENAME.

0000674: [AlmaLinux][mana][Backport] backport mana patch for capping number of MSI reported by PCI

Thu, 17 Sep 2026 16:38:26 +0000

Request backport of the following patches.

Summary
The driver needs to be hardened on checking lower MSI-X sizes again GDMA reported size:

Patch URL's
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=2c7493f980140a5c40eb4f98f97c557193a2c330

0000673: [AlmaLinux][MANA][Backport][Distros] Avoid DMA queue allocation failure under memory fragmentation

Thu, 17 Sep 2026 16:12:58 +0000

Request backport of the following patches.

Summary
The MANA driver can fail to bring up its queues on systems with high memory utilization because every GDMA queue ring is allocated as a single dma_alloc_coherent() of the whole power-of-2 ring size. Under memory fragmentation these high-order allocations may fail, preventing the driver from creating queues when opening the interface, after a VF reset, or when reconfiguring channels, ring parameters or MTU.

Patch URL's
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=1da1a037bc60c3744a6cdcb7610917a20ba1a318
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=23adfc77c22cb959ac84e08dc8a77bac656f1caa

0000672: [AlmaLinux][L1VH][Backport][Distros]Linux L1VH Patches

Thu, 17 Sep 2026 15:49:25 +0000

Request backport of the attached list of patches for Direct Virutalization Driver Model in the kernel a.k.a (L1VH)

Summary
This feature will allow to gain access to GPU's, networking storage for example. The patches listed may have changes to userspace as well as kernel changes.

Patch URL's
Included as attachment.

Note: New Feature.

0000670: [AlmaLinux][MANA][Backport][Distros] net: mana: Return error code from mana_create_rxq()

Thu, 17 Sep 2026 12:58:14 +0000

Request backport of the following patch.

Summary
This feature adds a debug knob to disable ndo_tx_timeout and add a dmesg log for correlation with hardware telemetry

Patch URL
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=922cc43c624330b9cf646d52fc82c820d9f699b3

0000669: [AlmaLinux][MANA][Backport][Distros] net: mana: Extend RX CQE coalescing up to 8 packets

Mon, 14 Sep 2026 07:22:57 +0000

Request backport of the following patch. This is the final Cobalt 200 patch. Thanks.

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=55d20f50a221bdd7b19befc6e3685a2ef5d4c07b

New udev rule for CQE x8: (replacing the previous rule for CQE x4)
# cat /etc/udev/rules.d/10-mana-cqe.rules

SUBSYSTEM=="net", ACTION!="remove", DRIVERS=="mana", RUN+="/sbin/ethtool -C %k rx-cqe-frames 4", RUN+="/sbin/ethtool -C %k rx-cqe-frames 8"

0000668: OOM on kernel 6.12.0-211.x: CephFS clients with path-restricted MDS caps leak unreclaimable slab (CVE-2024-56563,CVE-2025-21737)

Wed, 09 Sep 2026 13:15:16 +0000

AlmaLinux 10 kernels 6.12.0-211.38.1 and 6.12.0-211.49.1 (and 6.12.0-211.50.1, per its
changelog) leak kernel memory on every file open/setattr/rename on a CephFS mount when the
client key carries an MDS cap of the form `allow rw path=/something` and the mount is that
subpath. Two upstream bugs in fs/ceph/mds_client.c, both introduced by 596afb0b8933
("ceph: add ceph_mds_check_access() helper", v6.10), both still present in the el10 source:

* CVE-2024-56563 — ceph_mds_check_access() calls get_current_cred() and never put_cred().
Fixed upstream in c5cf420303256dcd6ff175643e9e9558543c2047 (v6.13, stable v6.12.4).
* CVE-2025-21737 — ceph_mds_auth_match() kmallocs the "/" string for the
cap comparison and frees it only on the two mismatch branches; the match path leaks it.
Fixed upstream in 3b7d93db450e9d8ead80d75e2a303248f1528c35 (v6.13.3, stable v6.12.14).

Red Hat lists these as "Fix deferred" and "Affected" for RHEL 10 respectively, so they will
not arrive via a rebase. RHEL 9's 5.14 kernel predates the code and is unaffected. Debian 13
(6.12.85) carries both. AlmaLinux 6.12.0-211.50.1 backported the neighbouring
ceph_mdsc_build_path leak (CVE-2026-43419) but not these two.

Observed in production: three Dovecot IMAP backends (8 GB RAM, CephFS mount :/mail, key with
`mds allow rw path=/mail`) grow SUnreclaim by 130-300 MB/day — cred, kmalloc-64/96/128 and
kmalloc-cg-32 — until the OOM killer loops. One host logged 161 OOM kills in a day, killing
dovecot workers, node_exporter and zabbix_agent2, while `free` showed userspace nearly empty.
Only a reboot recovers the memory, so each host needs rebooting every 6-8 weeks. Any
AlmaLinux 10 CephFS client with a path-restricted key is affected.

0000663: python3-argcomplete not completing

Sun, 06 Sep 2026 17:13:50 +0000

On AlmaLinux10, python3 scripts in the PATH that utilized the `argcomplete` module and are registered with `register-python-argcomplete` are not auto-completing.

Package version is 3.2.2-4.el10.

0000667: glibc misses backport of commit to support multiple namespaces in gdb

Fri, 04 Sep 2026 19:43:59 +0000

Glibc has in 9.8 has version 2.34, and backported a patch from 2.35: commit a93d9e03a3 ("Extend struct r_debug to support multiple namespaces [BZ #15971]").

However it's missing a backport of related commit 88361b408b ("elf: Copy l_addr/l_ld when adding ld.so to a new namespace").

Consequently, gdb is not able to track multiple namespaces.

I proposed a workaround in gdb ( https://sourceware.org/pipermail/gdb-patches/2026-August/229549.html ) but it was not deemed acceptable.

0000666: DNF allows removal of lvm2 on LVM root installations, causing unbootable initramfs during kernel updates

Fri, 28 Aug 2026 08:52:06 +0000

Description:
On systems installed with the root filesystem on an LVM Logical Volume (e.g. /dev/mapper/almalinux-root), the `lvm2` package is not guarded under `/etc/dnf/protected.d/`.

If `lvm2` is removed (manually or transitively via dependency resolution / autoremove), DNF proceeds without verifying whether the active root filesystem depends on LVM. Once `lvm2` is removed:
1. `/usr/sbin/lvm` and LVM dracut module dependencies are wiped.
2. The next kernel update or `dracut -f --regenerate-all` invocation builds initramfs images without LVM support.
3. Upon reboot, Dracut cannot assemble the volume group and fails to locate the root device (`/dev/mapper/almalinux-root not found`), dropping into the emergency shell and rendering all updated kernels unbootable.

Proposed Solution:
1. Anaconda or base configuration should automatically place a protection entry (e.g. `/etc/dnf/protected.d/lvm2.conf` containing `lvm2`, `lvm2-libs`, `device-mapper`, `device-mapper-libs`) if the root partition is located on an LVM volume.
2. Dracut should emit a fatal error or warning when root in `/etc/fstab` is on `/dev/mapper/*` but `lvm` binaries/modules are absent.

Environment:
- OS: AlmaLinux 10.2 (x86_64)
- Kernel: 6.12.0-211.49.1.el10_2.x86_64
- dnf: dnf-4.20.0-22.el10_2.alma.1.noarch
- dracut: dracut-107-9.el10_2.x86_64
- lvm2: lvm2-2.03.36-2.el10.x86_64

0000622: Request to backport recent GVE patches for Google Cloud overcommited Gen3+ VMs for AlmaLinux 9

Wed, 26 Aug 2026 12:53:25 +0000

Currently, the maximum queue depth supported for gVNIC on overcommited Gen3+ VMs such as N4 is 1K, whereas the maximum queue depth supported on Gen1/Gen2 VMs is 2K. Customers who are migrating their workloads from N2 to N4 have requested higher queue depth support on N4 VMs.

GVE driver changes to support greater than 1K queue depth for overcommitted Gen3+ have been upstreamed to Linux kernel recently:

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=a2f19184014f
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=07993df56091

0000621: Request to backport recent GVE patches for Google Cloud overcommited Gen3+ VMs for AlmaLinux 10

Tue, 11 Aug 2026 09:54:29 +0000

0000637: [AlmaLinux][Mana][Backport] Cobalt 200 mana networking performance patch to use full 4k page rx buffers (disable page fragmentat

Tue, 11 Aug 2026 05:59:44 +0000

Request backport of the following patch.

Primary Patch

https://lore.kernel.org/all/20260602202801.1873742-1-dipayanroy@linux.microsoft.com/

Prerequisite Patches
https://lore.kernel.org/all/acLUhLpLum6qrD%2fN@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net/
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=17bfe0a8c014
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=5b05aa36ee24

Dependencies
All prerequisite patches must be applied before enabling the ethtool flag patch
Requires existing MANA RX path implementation with page_pool support

0000662: /usr/lib/systemd/system/fwupd.service Unknown lvalues

Wed, 05 Aug 2026 16:54:28 +0000

Aug 04 09:39:07 systemd[1]: /usr/lib/systemd/system/fwupd-refresh.service:20: Unknown lvalue 'ProtectHostname' in section 'Service'
Aug 04 09:39:07 systemd[1]: /usr/lib/systemd/system/fwupd-refresh.service:22: Unknown lvalue 'ProtectKernelLogs' in section 'Service'
Aug 04 09:39:07 systemd[1]: /usr/lib/systemd/system/fwupd.service:22: Unknown lvalue 'ProtectClock' in section 'Service'
Aug 04 09:39:07 systemd[1]: /usr/lib/systemd/system/fwupd.service:25: Unknown lvalue 'ProtectHostname' in section 'Service'
Aug 04 09:39:07 systemd[1]: /usr/lib/systemd/system/fwupd.service:26: Unknown lvalue 'ProtectKernelLogs' in section 'Service'
Aug 04 09:39:07 systemd[1]: /usr/lib/systemd/system/fwupd.service:29: Unknown lvalue 'ProtectProc' in section 'Service'

0000661: systemd-networkd is not renewing IPv6 default route got from ISP

Tue, 04 Aug 2026 21:50:31 +0000

On my current AlmaLinux 10.2 I moved to systemd-networkd. I use it on a Protectli VP4650 as my Internet Firewall. Works perfect, except the issue with IPv6 default route. What happens:
enp1s0 is connected to WAN, getting the IPs via DHCP and DHCP6 (networkd), but also SLAAC. systemd-networkd is configuring everything correctly. The ISP router is giving a default route with a lifetime of 30 minutes. Now the issue begins. After this 30 minutes, the route is simply removed. Done. systemd-networkd is not renewing, not sending any router solicitation. On the other hand, ISP router is not sending router advertisement. Many ISPs behave like this. So, networkd should track this and manage to renew.
The result is just that IPv6 is not working (for ever, or the router is sending an RA for any other reason) from a clients perspective.

I have not found any hint on github that this will be solved, just a similar bug report, but different use case.

0000478: TCP connection/socket gets stuck and the messages delayed

Fri, 31 Jul 2026 14:00:02 +0000

Hi,

We have a client/server application which was developed a long time ago. It has been running in production for more than 10 years. The client is a Windows application written in C++, and the server-side component is written in Java 8.

This client/server software has been working fine for a long time on Linux servers. Currently, we use AlmaLinux 9. It was working on AlmaLinux 9 until updating the kernel.

So, when we update the Linux kernel from “5.14.0-362.13.1.el9_3.x86_64” to “kernel-5.14.0-427.31.1.el9_4.x86_64” the application gets unstable: The client drops the connection based due to not receiving messages in the proper time. We notice delays, the client just waiting for the response from the server. We can notice that all messages from the client are delayed on the server-side, the Java application gets the messages with a delay of several seconds. The issue is always reproducible with the new kernel. And if we go back to the old kernel, the problem is gone. We kept running the test for hours in both cases.

Even if we restart clients as well as the server application, the issue does not disappear. Only the full OS reboot can solve the problem.

I can provide PCAP files created by tcpdump tool in both cases: working and non-working scenarios. You can see the delay in the PCAP file and also lot of TCP Window Full messages.

Please investigate the issue that what happened between these two kernel versions. It seems there is an issue in the new kernel. Let us know what has been changed since "5.14.0-362.13.1.el9_3.x86_64" kernel version. An application that was working for a long time on Linux, now gets unstable due to kernel update.

I already reported a bug on the kernel.org website. Link: https://bugzilla.kernel.org/show_bug.cgi?id=219221

You find the PCAP files in the attachment.

Please analyze it and help us to determine why the new kernel behaves differently and causes this weird behaviour. How it can be fixed either in our application or maybe fx is required in the kernel?

Thanks a lot!

Regards,

Zoltan

0000660: mirrorlist option in url kickstart command broken

Wed, 29 Jul 2026 19:10:31 +0000

https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#url suggest that, like with the `repo` command, the `url` command allows a `mirrorlist` option, but it fails every time.

0000659: dnf/rpm segfault via use-after-free in sqlite log callback (history.sqlite)

Wed, 29 Jul 2026 15:38:15 +0000

`dnf` intermittently segfaults when opening `/var/lib/dnf/history.sqlite` (and potentially any other sqlite database opened after the rpmdb) with a `Segmentation fault (core dumped)`. This is caused by a known upstream rpm bug:
rpm registers a **process-global** sqlite log callback (`sqlite3_config(SQLITE_CONFIG_LOG, errCb, rdb)`)
tied to a specific `rpmdb` handle. If that handle is later freed and a *different* sqlite database (e.g. `history.sqlite`) triggers a log message (commonly a WAL-recovery notice), sqlite invokes the stale callback and dereferences freed memory, causing a crash.

Upstream rpm fixed this by removing the callback entirely:
https://github.com/rpm-software-management/rpm/commit/ea3187cfcf9cac87e5bc5e7db79b0338da9e355e

This fix does not appear to be present in `rpm-4.16.1.3-40.el9` (see "Verification" below).

## Environment

- OS: AlmaLinux 9 (AlmaLinux release 9.8 (Olive Jaguar))
- `rpm -q rpm`: `rpm-4.16.1.3-40.el9.x86_64`
- `rpm -q sqlite-libs`: `sqlite-libs-3.46.1-1.el9.x86_64`
- `rpm -q dnf python3-libdnf`: `libdnf-0.69.0-18.el9.alma.1`, dnf version (dnf-0:4.14.0-34.el9_8.alma.1.noarch)

Related thread: https://forums.almalinux.org/t/dnf-segmentation-fault-core-dumped/5528/3

0000658: [AlmaLinux][MANA][Backport][Distros] net: mana: Add handler for sriov configure

Tue, 28 Jul 2026 12:39:13 +0000

Request backport of the following patch to all kernel versions accepting new features.

Summary:
This adds PF/SRIOV feature.

Patch URL:

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=ce6b4d3216b63f902bb8e9695ee6c10c83415f65

0000657: [AlmaLinux][MANA][Backport][Distros] porting patch: RDMA: Change capability fields in ib_device_attr from int to u32

Tue, 28 Jul 2026 11:33:31 +0000

Request backport of the following patch.

Summary:
It is an optimization in the code flow.
Updates incorrect assignments of int -> u32 across the code.

Patch URL:

https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?id=eebd08d91ddbd6

0000643: [AlmaLinux][Backport][MANA] net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0

Tue, 28 Jul 2026 10:54:10 +0000

Request backport of the following bug fix patch.

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=6bd81a5b4e0d