[5.14.0-362.24.1.el9_3.OL9] - Update Oracle Linux certificates - Disable signing for aarch64 - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x64 = 15.3-1.0.5] - Remove nmap references from kernel [Orabug: 34313944] - Remove upstream reference during boot [Orabug: 34729535] - Disable unified kernel image package build - Add Oracle Linux IMA certificates [5.14.0-362.24.1.el9_3] - RDMA/mlx5: Fix assigning access flags to cache mkeys [RHEL-25242 RHEL-882] - drm/amdgpu: Fix potential fence use-after-free v2 [RHEL-24501 RHEL-24504 RHEL-22506 RHEL-22507] {CVE-2023-51042} - ceph: defer stopping mdsc delayed_work [RHEL-22256 RHEL-16415] - ceph: never send metrics if disable_send_metrics is set [RHEL-22256 RHEL-16415] - ceph: don"t let check_caps skip sending responses for revoke msgs [RHEL-22256 RHEL-16415] - ceph: issue a cap release immediately if no cap exists [RHEL-22256 RHEL-16415] - ceph: trigger to flush the buffer when making snapshot [RHEL-22256 RHEL-16415] - ceph: fix blindly expanding the readahead windows [RHEL-22256 RHEL-16415] - ceph: add a dedicated private data for netfs rreq [RHEL-22256 RHEL-16415] - ceph: voluntarily drop Xx caps for requests those touch parent mtime [RHEL-22256 RHEL-16415] - ceph: try to dump the msgs when decoding fails [RHEL-22256 RHEL-16415] - ceph: only send metrics when the MDS rank is ready [RHEL-22256 RHEL-16415] - x86/boot: Ignore NMIs during very early boot [RHEL-24449 RHEL-9380] - Documentation, mm/unaccepted: document accept_memory kernel parameter [RHEL-20808 RHEL-10059] - proc/kcore: do not try to access unaccepted memory [RHEL-20808 RHEL-10059] - efi/unaccepted: do not let /proc/vmcore try to access unaccepted memory [RHEL-20808 RHEL-10059] - x86/traps: Fix load_unaligned_zeropad handling for shared TDX memory [RHEL-20808 RHEL-10059] - efi/unaccepted: Fix off-by-one when checking for overlapping ranges [RHEL-20808 RHEL-10059] - x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro [RHEL-20808 RHEL-10059] - x86/kvm: Do not try to disable kvmclock if it was not enabled [RHEL-20808 RHEL-10059] - x86/tdx: Mark TSC reliable [RHEL-20808 RHEL-10059] - RHEL: kABI fixup for struct zone [RHEL-20808 RHEL-10059] - RHEL: introduce NR_VM_ZONE_STAT_ITEMS_ACTUAL for kABI-preserving zone stats [RHEL-20808 RHEL-10059] - RHEL: 9.3 kABI fixup for struct efi [RHEL-20808 RHEL-10059] - x86/mm: Fix enc_status_change_finish_noop [RHEL-20808 RHEL-10059] - x86/tdx: Fix race between set_memory_encrypted and load_unaligned_zeropad [RHEL-20808 RHEL-10059] - x86/mm: Allow guest.enc_status_change_prepare to fail [RHEL-20808 RHEL-10059] - x86/coco: Mark cc_platform_has and descendants noinstr [RHEL-20808 RHEL-10059] - virt: sevguest: Add CONFIG_CRYPTO dependency [RHEL-20808 RHEL-10059] - mm/page_alloc: make deferred page init free pages in MAX_ORDER blocks [RHEL-20808 RHEL-10059] - mm/page_alloc: fix obsolete comment in deferred_pfn_valid [RHEL-20808 RHEL-10059] - x86/sev: Change npages to unsigned long in snp_accept_memory [RHEL-20808 RHEL-10059] - efi/unaccepted: Fix soft lockups caused by parallel memory acceptance [RHEL-20808 RHEL-10059] - efi/unaccepted: Make sure unaccepted table is mapped [RHEL-20808 RHEL-10059] - x86/efi: Safely enable unaccepted memory in UEFI [RHEL-20808 RHEL-10059] - x86/sev: Add SNP-specific unaccepted memory support [RHEL-20808 RHEL-10059] - x86/sev: Use large PSC requests if applicable [RHEL-20808 RHEL-10059] - x86/sev: Allow for use of the early boot GHCB for PSC requests [RHEL-20808 RHEL-10059] - x86/sev: Put PSC struct on the stack in prep for unaccepted memory support [RHEL-20808 RHEL-10059] - x86/sev: Fix calculation of end address based on number of pages [RHEL-20808 RHEL-10059] - x86/tdx: Wrap exit reason with hcall_func [RHEL-20808 RHEL-10059] - x86/tdx: Add unaccepted memory support [RHEL-20808 RHEL-10059] - x86/tdx: Refactor try_accept_one [RHEL-20808 RHEL-10059] - efi/unaccepted: Avoid load_unaligned_zeropad stepping into unaccepted memory [RHEL-20808 RHEL-10059] - efi: Add unaccepted memory support [RHEL-20808 RHEL-10059] - x86/boot/compressed: Handle unaccepted memory [RHEL-20808 RHEL-10059] - efi/unaccepted: Use ACPI reclaim memory for unaccepted memory table [RHEL-20808 RHEL-10059] - efi/libstub: Implement support for unaccepted memory [RHEL-20808 RHEL-10059] - efi/x86: Get full memory map in allocate_e820 [RHEL-20808 RHEL-10059] - memblock tests: Fix compilation errors. [RHEL-20808 RHEL-10059] - mm: Add support for unaccepted memory [RHEL-20808 RHEL-10059] - x86/boot: Centralize __pa/__va definitions [RHEL-20808 RHEL-10059] - x86/boot: Add an efi.h header for the decompressor [RHEL-20808 RHEL-10059] - x86/tdx: Make _tdx_hypercall and __tdx_module_call available in boot stub [RHEL-20808 RHEL-10059] - x86/tdx: Drop flags from __tdx_hypercall [RHEL-20808 RHEL-10059] - x86/tdx: Disable NOTIFY_ENABLES [RHEL-20808 RHEL-10059] - x86/tdx: Relax SEPT_VE_DISABLE check for debug TD [RHEL-20808 RHEL-10059] - x86/tdx: Use ReportFatalError to report missing SEPT_VE_DISABLE [RHEL-20808 RHEL-10059] - cpuidle, tdx: Make TDX code noinstr clean [RHEL-20808 RHEL-10059] - x86/tdx: Remove TDX_HCALL_ISSUE_STI [RHEL-20808 RHEL-10059] - mm: add pageblock_aligned macro [RHEL-20808 RHEL-10059] - efi: memmap: Disregard bogus entries instead of returning them [RHEL-20808 RHEL-10059] - efi: memmap: Move manipulation routines into x86 arch tree [RHEL-20808 RHEL-10059] - efi: memmap: Move EFI fake memmap support into x86 arch tree [RHEL-20808 RHEL-10059] - efi: libstub: install boot-time memory map as config table [RHEL-20808 RHEL-10059] - efi: libstub: remove DT dependency from generic stub [RHEL-20808 RHEL-10059] - efi: libstub: unify initrd loading between architectures [RHEL-20808 RHEL-10059] - efi: libstub: remove pointless goto kludge [RHEL-20808 RHEL-10059] - efi: libstub: simplify efi_get_memory_map and struct efi_boot_memmap [RHEL-20808 RHEL-10059] - efi: libstub: avoid efi_get_memory_map for allocating the virt map [RHEL-20808 RHEL-10059] - efi: libstub: drop pointless get_memory_map call [RHEL-20808 RHEL-10059] - efi/libstub: move efi_system_table global var into separate object [RHEL-20808 RHEL-10059] - efi/x86: libstub: remove unused variable [RHEL-20808 RHEL-10059] - efi: Correct comment on efi_memmap_alloc [RHEL-20808 RHEL-10059] - drivers: fix typo in firmware/efi/memmap.c [RHEL-20808 RHEL-10059] - netfilter: nf_tables: skip set commit for deleted/destroyed sets [RHEL-20683 RHEL-20686 RHEL-20214 RHEL-20217] {CVE-2024-0193} - redhat: add missing -rt JIRAs [5.14.0-362.23.1.el9_3] - iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range [RHEL-19382 RHEL-11590] - arm64/smmu: use TLBI ASID when invalidating entire range [RHEL-19382 RHEL-11590] - netfilter: nft_set_pipapo: skip inactive elements during set walk [RHEL-20701 RHEL-20709 RHEL-19722 RHEL-19961] {CVE-2023-6817} - netfilter: nf_tables: split async and sync catchall in two functions [RHEL-22131 RHEL-1720] - netfilter: nf_tables: remove catchall element in GC sync path [RHEL-22131 RHEL-1720] - netfilter: nf_tables: expose opaque set element as struct nft_elem_priv [RHEL-22131 RHEL-1720] - netfilter: nf_tables: set backend .flush always succeeds [RHEL-22131 RHEL-1720] - netfilter: nft_set_pipapo: no need to call pipapo_deactivate from flush [RHEL-22131 RHEL-1720] - netfilter: nf_tables: work around newrule after chain binding [RHEL-22131 RHEL-1720] - netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure [RHEL-22131 RHEL-1720] - netfilter: nf_tables: fix memleak when more than 255 elements expired [RHEL-22131 RHEL-1720] - netfilter: nf_tables: disable toggling dormant table state more than once [RHEL-22131 RHEL-1720] - netfilter: nf_tables: disallow element removal on anonymous sets [RHEL-22131 RHEL-1720] - netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration [RHEL-22131 RHEL-1720] - netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails [RHEL-22131 RHEL-1720] - netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention [RHEL-22131 RHEL-1720] - netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync in catchall GC [RHEL-22131 RHEL-1720] - netfilter: nf_tables: disallow rule removal from chain binding [RHEL-22131 RHEL-1720] - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction [RHEL-22131 RHEL-1720] - netfilter: nf_tables: defer gc run if previous batch is still pending [RHEL-22131 RHEL-1720] - netfilter: nf_tables: fix out of memory error handling [RHEL-22131 RHEL-1720] - netfilter: nf_tables: use correct lock to protect gc_list [RHEL-22131 RHEL-1720] - netfilter: nf_tables: GC transaction race with abort path [RHEL-22131 RHEL-1720] - netfilter: nf_tables: flush pending destroy work before netlink notifier [RHEL-22131 RHEL-1720] - netfilter: nft_dynset: disallow object maps [RHEL-22131 RHEL-1720] - netfilter: nf_tables: GC transaction race with netns dismantle [RHEL-22131 RHEL-1720] - netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path [RHEL-22131 RHEL-1720] - netfilter: nf_tables: don"t fail inserts if duplicate has expired [RHEL-22131 RHEL-1720] - netfilter: nf_tables: deactivate catchall elements in next generation [RHEL-22131 RHEL-1720] - netfilter: nf_tables: fix kdoc warnings after gc rework [RHEL-22131 RHEL-1720] - netfilter: nf_tables: fix false-positive lockdep splat [RHEL-22131 RHEL-1720] - netfilter: nf_tables: remove busy mark and gc batch API [RHEL-22131 RHEL-1720] - netfilter: nft_set_hash: mark set element as dead when deleting from packet path [RHEL-22131 RHEL-22134 RHEL-1720 RHEL-1721] {CVE-2023-4244} - netfilter: nf_tables: adapt set backend to use GC transaction API [RHEL-22131 RHEL-22134 RHEL-1720 RHEL-1721] {CVE-2023-4244} - netfilter: nft_set_rbtree: fix overlap expiration walk [RHEL-22131 RHEL-1720] - netfilter: nf_tables: GC transaction API to avoid race with control plane [RHEL-22131 RHEL-22134 RHEL-1720 RHEL-1721] {CVE-2023-4244} - netfilter: nf_tables: don"t skip expired elements during walk [RHEL-22131 RHEL-1720] - netfilter: nf_tables: skip bound chain in netns release path [RHEL-22131 RHEL-1720] - netfilter: nf_tables: fix spurious set element insertion failure [RHEL-22131 RHEL-1720] - netfilter: nf_tables: report use refcount overflow [RHEL-22131 RHEL-1720] - netfilter: nf_tables: fix underflow in chain reference counter [RHEL-22131 RHEL-1720] - netfilter: nf_tables: disallow timeout for anonymous sets [RHEL-22131 RHEL-1720] - netfilter: nf_tables: disallow updates of anonymous sets [RHEL-22131 RHEL-1720] - netfilter: nf_tables: reject unbound chain set before commit phase [RHEL-22131 RHEL-1720] - netfilter: nf_tables: reject unbound anonymous set before commit phase [RHEL-22131 RHEL-1720] - netfilter: nf_tables: disallow element updates of bound anonymous sets [RHEL-22131 RHEL-1720] - netfilter: nf_tables: fix underflow in object reference counter [RHEL-22131 RHEL-1720] - netfilter: nf_tables: drop map element references from preparation phase [RHEL-22131 RHEL-1720] - netfilter: nf_tables: validate variable length element extension [RHEL-22131 RHEL-1720] - netfilter: nft_set_pipapo: .walk does not deal with generations [RHEL-22131 RHEL-1720] - netfilter: nf_tables: relax set/map validation checks [RHEL-22131 RHEL-1720] - netfilter: nf_tables: integrate pipapo into commit protocol [RHEL-22131 RHEL-1720] - netfilter: nf_tables: upfront validation of data via nft_data_init [RHEL-22131 RHEL-1720] - rbd: don"t move requests to the running list on errors [RHEL-23863 RHEL-21939] - ASoC: SOF: intel: hda: Clean up link DMA for IPC3 during stop [RHEL-24033 RHEL-13724] - platform/x86/intel-uncore-freq: Return error on write frequency [RHEL-15751 2177013] - platform/x86: intel-uncore-freq: Add client processors [RHEL-15751 2177013] - platform/x86: intel-uncore-freq: add Emerald Rapids support [RHEL-15751 2177013] - platform/x86: intel-uncore-freq: Use sysfs_emit to instead of scnprintf [RHEL-15751 2177013] - platform/x86: intel-uncore-freq: Prevent driver loading in guests [RHEL-15751 2177013] - platform/x86: intel-uncore-freq: fix uncore_freq_common_init error codes [RHEL-15751 2177013] - Documentation: admin-guide: pm: Document uncore frequency scaling [RHEL-15751 2177013] - platform/x86/intel-uncore-freq: Split common and enumeration part [RHEL-15751 2177013] - platform/x86/intel/uncore-freq: Display uncore current frequency [RHEL-15751 2177013] - platform/x86/intel/uncore-freq: Use sysfs API to create attributes [RHEL-15751 2177013] - platform/x86/intel/uncore-freq: Move to uncore-frequency folder [RHEL-15751 2177013] - platform/x86: intel-uncore-frequency: use default_groups in kobj_type [RHEL-15751 2177013] - platform/x86: intel-uncore-frequency: Move to intel sub-directory [RHEL-15751 2177013] - Revert platform/x86: intel-uncore-freq: add Emerald Rapids support [RHEL-15751 2177013] - iommu/iova: Manage the depot list size [RHEL-21517 RHEL-11148] - iommu/iova: Make the rcache depot scale better [RHEL-21517 RHEL-11148] - drm/amd/pm: Fix error of MACO flag setting code [RHEL-16741 RHEL-16742 RHEL-14571 RHEL-15927] - drm/amd: Fix detection of _PR3 on the PCIe root port [RHEL-16741 RHEL-16742 RHEL-14571 RHEL-15927] [5.14.0-362.22.1.el9_3] - usb: typec: ucsi: Use GET_CAPABILITY attributes data to set power supply scope [RHEL-21838 RHEL-14573] - KVM: SVM: Do not use user return MSR support for virtualized TSC_AUX [RHEL-20415 RHEL-16384] - KVM: SVM: Fix TSC_AUX virtualization setup [RHEL-20415 RHEL-16384] - KVM: SVM: INTERCEPT_RDTSCP is never intercepted anyway [RHEL-20415 RHEL-16384] - net: tls, update curr on splice as well [RHEL-22094 RHEL-22097 RHEL-19066 RHEL-19067] {CVE-2024-0646} - smb: client: fix OOB in smbCalcSize [RHEL-21664 RHEL-21669 RHEL-18992 RHEL-18993] {CVE-2023-6606} - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server [RHEL-22284 RHEL-7936] - NFSv4.1: fix zero value filehandle in post open getattr [RHEL-22284 RHEL-7936] - NFSv4.1: fix pnfs MDS=DS session trunking [RHEL-22284 RHEL-7936] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server [RHEL-22284 RHEL-7936] - nvmet-tcp: Fix the H2C expected PDU len calculation [RHEL-22290 RHEL-22292 RHEL-22627 RHEL-22629 RHEL-22632 RHEL-22636 RHEL-19150 RHEL-19153 RHEL-19156 RHEL-19159 RHEL-19162 RHEL-19165] {CVE-2023-6356 CVE-2023-6535 CVE-2023-6536} - nvmet-tcp: remove boilerplate code [RHEL-22290 RHEL-22292 RHEL-22627 RHEL-22629 RHEL-22632 RHEL-22636 RHEL-19150 RHEL-19153 RHEL-19156 RHEL-19159 RHEL-19162 RHEL-19165] {CVE-2023-6356 CVE-2023-6535 CVE-2023-6536} - nvmet-tcp: fix a crash in nvmet_req_complete [RHEL-22290 RHEL-22292 RHEL-22627 RHEL-22629 RHEL-22632 RHEL-22636 RHEL-19150 RHEL-19153 RHEL-19156 RHEL-19159 RHEL-19162 RHEL-19165] {CVE-2023-6356 CVE-2023-6535 CVE-2023-6536} - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length [RHEL-22290 RHEL-22292 RHEL-22627 RHEL-22629 RHEL-22632 RHEL-22636 RHEL-19150 RHEL-19153 RHEL-19156 RHEL-19159 RHEL-19162 RHEL-19165] {CVE-2023-6356 CVE-2023-6535 CVE-2023-6536} - ice: dpll: fix phase offset value [RHEL-17652 RHEL-15789] - dpll: netlink/core: change pin frequency set behavior [RHEL-17652 RHEL-15789] - ice: dpll: implement phase related callbacks [RHEL-17652 RHEL-15789] - dpll: netlink/core: add support for pin-dpll signal phase offset/adjust [RHEL-17652 RHEL-15789] - dpll: spec: add support for pin-dpll signal phase offset/adjust [RHEL-17652 RHEL-15789] - dpll: docs: add support for pin signal phase offset/adjust [RHEL-17652 RHEL-15789] - netlink: specs: remove redundant type keys from attributes in subsets [RHEL-17652 RHEL-15789] - md/raid6: use valid sector values to determine if an I/O should wait on the reshape [RHEL-20933 RHEL-17276] [5.14.0-362.21.1.el9_3] - x86/microcode: do not cache microcode if it will not be used [RHEL-21567 RHEL-16225] - x86/hyperv: Move the code in ivm.c around to avoid unnecessary ifdef"s [RHEL-21441 2176350] - x86/hyperv: Remove hv_isolation_type_en_snp [RHEL-21441 2176350] - x86/hyperv: Use TDX GHCI to access some MSRs in a TDX VM with the paravisor [RHEL-21441 2176350] - Drivers: hv: vmbus: Bring the post_msg_page back for TDX VMs with the paravisor [RHEL-21441 2176350] - x86/hyperv: Introduce a global variable hyperv_paravisor_present [RHEL-21441 2176350] - x86/hyperv: Add missing "inline" to hv_snp_boot_ap stub [RHEL-21441 2176350] - x86/hyperv: Mark hv_ghcb_terminate as noreturn [RHEL-21441 2176350] - Drivers: hv: vmbus: Support 64 VPs for a fully enlightened TDX/SNP VM [RHEL-21441 2176350] - x86/hyperv: Fix serial console interrupts for fully enlightened TDX guests [RHEL-21441 2176350] - Drivers: hv: vmbus: Support fully enlightened TDX guests [RHEL-21441 2176350] - x86/hyperv: Support hypercalls for fully enlightened TDX guests [RHEL-21441 2176350] - x86/hyperv: Add hv_isolation_type_tdx to detect TDX guests [RHEL-21441 2176350] - x86/hyperv: Fix undefined reference to isolation_type_en_snp without CONFIG_HYPERV [RHEL-21441 2176350] - x86/hyperv: Add hyperv-specific handling for VMMCALL under SEV-ES [RHEL-21441 2176350] - x86/hyperv: Add smp support for SEV-SNP guest [RHEL-21441 2176350] - x86/hyperv: Add VTL specific structs and hypercalls [RHEL-21441 2176350] - clocksource: hyper-v: Mark hyperv tsc page unencrypted in sev-snp enlightened guest [RHEL-21441 2176350] - x86/hyperv: Use vmmcall to implement Hyper-V hypercall in sev-snp enlightened guest [RHEL-21441 2176350] - drivers: hv: Mark percpu hvcall input arg page unencrypted in SEV-SNP enlightened guest [RHEL-21441 2176350] - Drivers: hv: vmbus: Remove the per-CPU post_msg_page [RHEL-21441 2176350] - x86/hyperv: Mark Hyper-V vp assist page unencrypted in SEV-SNP enlightened guest [RHEL-21441 2176350] - x86/hyperv: Set Virtual Trust Level in VMBus init message [RHEL-21441 2176350] - x86/hyperv: Add sev-snp enlightened guest static key [RHEL-21441 2176350] - x86/tdx: Do not corrupt frame-pointer in __tdx_hypercall [RHEL-21441 2176350] - x86/tdx: Expand __tdx_hypercall to handle more arguments [RHEL-21441 2176350] - x86/tdx: Refactor __tdx_hypercall to allow pass down more arguments [RHEL-21441 2176350] - x86/tdx: Add more registers to struct tdx_hypercall_args [RHEL-21441 2176350] - x86/tdx: Fix typo in comment in __tdx_hypercall [RHEL-21441 2176350] - blk-mq: don"t count completed flush data request as inflight in case of quiesce [RHEL-19105 RHEL-18054] - NFS: Use parent"s objective cred in nfs_access_login_time [RHEL-22147 RHEL-16024] - s390/qeth: Don"t call dev_close/dev_open [RHEL-17887 RHEL-2412] - smb: client: fix potential OOB in smb2_dump_detail [RHEL-19146 RHEL-21679 RHEL-19147 RHEL-21677] {CVE-2023-6610} - smb: client: fix potential OOB in cifs_dump_detail [RHEL-19146 RHEL-21679 RHEL-19147 RHEL-21677] {CVE-2023-6610} - x86/sev: Do not handle #VC for DR7 read/write [RHEL-21885 RHEL-15069] - x86/sev: Use the GHCB protocol when available for SNP CPUID requests [RHEL-21885 RHEL-15069] [5.14.0-362.20.1.el9_3] - s390/dasd: print copy pair message only for the correct error [RHEL-11980 RHEL-2833] - x86/microcode/AMD: Rip out static buffers [RHEL-14590 RHEL-10030] - x86/microcode/AMD: Load late on both threads too [RHEL-14590 RHEL-10030] - x86/microcode/amd: Remove unneeded pointer arithmetic [RHEL-14590 RHEL-10030] - x86/microcode/AMD: Get rid of __find_equiv_id [RHEL-14590 RHEL-10030] - docs: move x86 documentation into Documentation/arch/ [RHEL-14590 RHEL-10030] - x86/microcode/AMD: Handle multiple glued containers properly [RHEL-14590 RHEL-10030] - mm: Fix copy_from_user_nofault. [RHEL-18946 RHEL-18440] - redhat: rewrite genlog and support Y- tags [5.14.0-362.19.1.el9_3] - redhat: fix kernel changelog entry for RHEL-16560 - perf/core: Fix potential NULL deref [RHEL-18087 RHEL-18088 RHEL-14984 RHEL-14985] {CVE-2023-5717} - perf: Disallow mis-matched inherited group reads [RHEL-18087 RHEL-18088 RHEL-14984 RHEL-14985] {CVE-2023-5717}