Alibaba Cloud Linux 3 image release notes - Alibaba Cloud Linux

Alibaba Cloud regularly releases updated versions of Alibaba Cloud Linux 3 images to provide the latest operating system features, functionality, and security patches. This topic describes the latest available versions and updates for Alibaba Cloud Linux 3 images.

Background information

Unless otherwise specified, the updates apply to all regions where Elastic Compute Service (ECS) is available.
Alibaba Cloud Linux 3 images support most instance families. However, some instance families can use only specific public images. The details are as follows:
ARM images, which can be identified by _arm64_ in their image IDs, are compatible with all ARM instances on Alibaba Cloud.

2025

Alibaba Cloud Linux 3 AI Extension Edition 0.5.2

Version	Image ID	Release date	Release content
Alibaba Cloud Linux 3 AI Extension Edition 0.5.2	aliyun_3_0_x64_20G_alibase_aiext_0.5.2_20250714.vhd	2025-07-14	Base image: Alibaba Cloud Linux 3 U11.1 The kernel is updated to 5.10.134-19.101.al8.x86_64. Content updates: For more information, see Content updates.

Content updates

Important updates

Using Alibaba Cloud Linux 3 AI Extension Edition 0.5.2 with standard community openclip/bevformer AI container images (AC2) improves training and inference performance compared with Ubuntu 22.04:
- For bevformer_base training, the average throughput per step increases by 13% for FP32 precision and by 12% to 18% for FP16 precision.
- For openclip (RN50), the average training throughput per step increases by 26%, and the average inference throughput increases by 26%.
When you replace the community openclip/bevformer AI container images with Alibaba Cloud-optimized openclip/bevformer AI container images, the final performance improvements are as follows:
- For bevformer_base training, the average throughput per step increases by 22% for FP32 precision and by 17% to 20% for FP16 precision.
- For openclip (RN50), the average training throughput per step increases by 46%, and the average inference throughput increases by 26%.

Kernel

The kernel is upgraded to version 5.10.134-19.101.al8.x86_64.

Scheduling
- This attribute specifies round-robin scheduling for the cluster.
- BVT configuration is supported for non-movable threads in the root group.
- Core scheduling supports independent configuration of special properties for each cookie.
  - Allows sharing a core with normal tasks that do not have a cookie.
  - Prevents the load balancer from automatically grouping tasks with the same cookie and instead distributes them across different cores.
Memory
- mmap() now supports THP-aligned address space allocation.
- virtio-mem now supports the memmap_on_memory feature, which enables fast scaling of container memory.
- A temporary file optimization feature is added, which is expected to improve performance in model training scenarios.
- A pagecache limit smoothing reclamation feature is added, which improves memory usage efficiency and is expected to enhance performance in model training scenarios.
- A page table page reclaim feature is added that improves memory usage efficiency and is expected to provide performance benefits for model training scenarios. To enable this feature, add reclaim_pt to the cmdline.
- A switch is added to control the delayed release of shmem file pages.
- Various bugs are fixed, including kfence stability issues and a THP counting issue for code enormous pages.
Network
- Various SMC issues are fixed, including link group and link use-after-free issues, and smc-r device lookup failures in container scenarios.
Storage
- erofs:
  - Several fixes for the erofs file system are merged from the mainline.
  - Support is added for file backup mounting and 48-bit layout.
  - Support is added for sub-page blocks for compressed files.
- Patches are merged from the mainline stable branch for components such as ext4, block, blk-mq, and io_uring.
- The virtio-blk passthrough feature is added, which provides passthrough capabilities for virtio-blk devices.
Driver
- The NVMe driver now supports batch processing of completed polled I/O commands.
- Differentiated configuration of NVMe driver parameters for cloud disks and local disks is supported.
- PCIe driver bugfix patches are merged to fix issues such as incorrect space size calculation and root bus allocation.
BPF
- Bugfix and CVE fix patches are merged from the community stable branch.

Packages

python3.12-3.12.7-1.al8.x86_64 is provided and installed by default, and is set as the default Python 3 version.
Intelligent tuning for AI scenarios is provided through keentuned-3.2.4-2.al8.x86_64.

Known issues

On ecs.ebmgn8t.32xlarge instances, the NetworkManager-wait-online service fails to start during instance startup.
The instance includes a USB network device, which extends the startup time of the NetworkManager service. This causes the NetworkManager-wait-online service to time out and fail to start. If you do not use the USB network device, you can configure NetworkManager to not manage usb0. To do this, you can edit the /etc/NetworkManager/conf.d/99-unmanaged-device.conf file and add the following content:
```
[device-usb0-unmanaged]
match-device=interface-name:usb0
managed=0
```
After you finish editing, restart the NetworkManager service for the changes to take effect immediately. NetworkManager will no longer manage the usb0 device. Restart the system to verify that the NetworkManager-wait-online service starts normally.
Using vhost-net may cause CPU usage to reach 100% and the network to become unavailable. You can resolve this issue by installing the following hotfix:
```
yum install kernel-hotfix-22577883-5.10.134-19.101 -y
```
After an NVMe hardware exception occurs, running the reboot command may cause a null pointer issue. To resolve this issue, you can install the following hotfix:
```
yum install kernel-hotfix-22584571-5.10.134-19.101 -y
```

Alibaba Cloud Linux 3.2104 U12

Version	Image ID	Release date	Release content
Alibaba Cloud Linux 3.2104 U12	aliyun_3_x64_20G_alibase_20250629.vhd	2025-06-29	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version The kernel is updated to kernel-5.10.134-19.1.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_dengbao_alibase_20250629.vhd	2025-06-29	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit MLPS 2.0 Level 3 Edition` base image to the latest software version. The kernel is updated to kernel-5.10.134-19.1.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_container_optimized_alibase_20250629.vhd	2025-06-29	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit Container Optimized Edition` base image to the latest software version The kernel is updated to kernel-5.10.134-19.1.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_alibase_20250629.vhd	2025-06-29	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit AMR version` base image to the latest software version. The kernel is updated to kernel-5.10.134-19.1.al8.aarch64. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_dengbao_alibase_20250629.vhd	2025-06-29	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM MLPS 2.0 Level 3` base image to the latest software version. The kernel is updated to kernel-5.10.134-19.1.al8.aarch64. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_container_optimized_alibase_20250629.vhd	2025-06-29	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit Container-Optimized for ARM` base image to the latest software version The kernel is updated to kernel-5.10.134-19.1.al8.aarch64. Content updates: For more information, see Content updates.

Content updates

Security updates

Package name	CVE ID	Updated version
buildah	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	buildah-1.33.8-4.al8
containernetworking-plugins	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	containernetworking-plugins-1.4.0-5.0.1.al8
containers-common	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	containers-common-1-82.0.1.al8
podman	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	podman-4.9.4-12.0.1.al8
python-podman	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	python-podman-4.9.0-2.al8
runc	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	runc-1.1.12-4.0.1.al8
skopeo	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	skopeo-1.14.5-3.0.1.al8
httpd	CVE-2023-27522	httpd-2.4.37-65.0.1.al8.2
git-lfs	CVE-2023-45288 CVE-2023-45289 CVE-2023-45290 CVE-2024-24783	git-lfs-3.4.1-2.0.1.al8
bind	CVE-2024-1975 CVE-2024-1737	bind-9.11.36-16.0.1.al8
python-setuptools	CVE-2024-6345	python-setuptools-39.2.0-8.al8.1
less	CVE-2022-48624 CVE-2024-32487	less-530-3.0.1.al8
java-17-openjdk	CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147	java-17-openjdk-17.0.12.0.7-2.0.2.1.al8
java-11-openjdk	CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147	java-11-openjdk-11.0.24.0.8-3.0.2.1.al8
postgresql	CVE-2024-7348	postgresql-13.16-1.0.1.al8
flatpak	CVE-2024-42472	flatpak-1.12.9-3.al8
bubblewrap	CVE-2024-42472	bubblewrap-0.4.0-2.2.al8
java-1.8.0-openjdk	CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147	java-1.8.0-openjdk-1.8.0.422.b05-2.0.2.1.al8
fence-agents	CVE-2024-6345	fence-agents-4.10.0-62.0.2.al8.4
pcp	CVE-2024-45769 CVE-2024-45770	pcp-5.3.7-22.0.1.al8
delve	CVE-2024-24791 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	delve-1.21.2-4.0.1.al8
golang	CVE-2024-24791 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	golang-1.21.13-2.0.1.al8
go-toolset	CVE-2024-24791 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	go-toolset-1.21.13-1.al8
edk2	CVE-2023-45236 CVE-2023-45237 CVE-2024-1298	edk2-20220126gitbb1bba3d77-13.0.1.al8.2
curl	CVE-2024-2398	curl-7.61.1-35.0.2.al8
libvpx	CVE-2023-6349 CVE-2024-5197	libvpx-1.7.0-11.0.1.al8
resource-agents	CVE-2024-37891 CVE-2024-6345	resource-agents-4.9.0-54.al8.4
389-ds-base	CVE-2024-5953	389-ds-base-1.4.3.39-8.0.1.al8
python-urllib3	CVE-2024-37891	python-urllib3-1.24.2-8.al8
pcs	CVE-2024-41123 CVE-2024-41946 CVE-2024-43398	pcs-0.10.18-2.0.1.1.al8.2
grafana	CVE-2024-24788 CVE-2024-24789 CVE-2024-24790	grafana-9.2.10-17.0.1.al8
libuv	CVE-2024-24806	libuv-1.42.0-2.al8
c-ares	CVE-2024-25629	c-ares-1.13.0-11.al8
xmlrpc-c	CVE-2023-52425	xmlrpc-c-1.51.0-9.0.1.al8
yajl	CVE-2022-24795 CVE-2023-33460	yajl-2.1.0-13.0.1.al8
wpa_supplicant	CVE-2023-52160	wpa_supplicant-2.10-2.al8
cups	CVE-2024-35235	cups-2.2.6-60.0.1.al8
linux-firmware	CVE-2023-31346	linux-firmware-20240610-122.git90df68d2.al8
wget	CVE-2024-38428	wget-1.19.5-12.0.1.al8
poppler	CVE-2024-6239	poppler-20.11.0-12.0.1.al8
krb5	CVE-2024-37370 CVE-2024-37371	krb5-1.18.2-29.0.1.al8
git-lfs	CVE-2024-34156	git-lfs-3.4.1-3.0.1.al8
libreoffice	CVE-2024-3044 CVE-2024-6472	libreoffice-7.1.8.1-12.0.2.1.al8.1
orc	CVE-2024-40897	orc-0.4.28-4.al8
jose	CVE-2023-50967 CVE-2024-28176	jose-10-2.3.al8.3
openssh	CVE-2020-15778 CVE-2023-48795 CVE-2023-51385	openssh-8.0p1-25.0.1.1.al8
libnbd	CVE-2024-3446 CVE-2024-7383 CVE-2024-7409	libnbd-1.6.0-6.0.1.al8
qemu-kvm	CVE-2024-3446 CVE-2024-7383 CVE-2024-7409	qemu-kvm-6.2.0-53.0.1.al8
libvirt	CVE-2024-3446 CVE-2024-7383 CVE-2024-7409	libvirt-8.0.0-23.2.0.2.al8
osbuild-composer	CVE-2024-34156	osbuild-composer-101-2.0.1.al8
libreswan	CVE-2024-3652	libreswan-4.12-2.0.2.al8.4
mod_auth_openidc	CVE-2024-24814	mod_auth_openidc-2.4.9.4-6.al8
podman	CVE-2023-45290 CVE-2024-24783 CVE-2024-24784 CVE-2024-24788 CVE-2024-24791	podman-4.9.4-13.0.1.al8
ghostscript	CVE-2024-29510 CVE-2024-33869 CVE-2024-33870	ghostscript-9.54.0-18.al8
emacs	CVE-2024-39331	emacs-27.2-9.0.3.al8
dovecot	CVE-2024-23184 CVE-2024-23185	dovecot-2.3.16-5.0.1.al8
expat	CVE-2024-45490 CVE-2024-45491 CVE-2024-45492	expat-2.2.5-13.0.1.al8
glib2	CVE-2024-34397	glib2-2.68.4-14.0.2.al8
python-idna	CVE-2024-3651	python-idna-2.5-7.al8
openldap	CVE-2023-2953	openldap-2.4.46-19.al8
python-pillow	CVE-2024-28219	python-pillow-5.1.1-21.al8
nghttp2	CVE-2024-28182	nghttp2-1.33.0-6.0.1.al8.1
python-jinja2	CVE-2024-34064	python-jinja2-2.10.1-3.0.3.al8
opencryptoki	CVE-2024-0914	opencryptoki-3.22.0-3.al8
gdk-pixbuf2	CVE-2021-44648 CVE-2021-46829 CVE-2022-48622	gdk-pixbuf2-2.42.6-4.0.1.al8
rear	CVE-2024-23301	rear-2.6-13.0.1.al8
grub2	CVE-2023-4692 CVE-2023-4693 CVE-2024-1048	grub2-2.02-150.0.2.al8
nss	CVE-2023-5388 CVE-2023-6135	nss-3.101.0-7.0.1.al8
gnutls	CVE-2024-0553 CVE-2024-28834	gnutls-3.6.16-8.0.1.al8.3
python3	CVE-2024-4032 CVE-2024-6232 CVE-2024-6923	python3-3.6.8-67.0.1.2.al8
grafana	CVE-2024-24791	grafana-9.2.10-18.0.1.al8
cups-filters	CVE-2024-47076 CVE-2024-47175 CVE-2024-47176 CVE-2024-47850	cups-filters-1.20.0-35.0.1.al8
linux-firmware	CVE-2023-20584 CVE-2023-31315 CVE-2023-31356	linux-firmware-20240827-124.git3cff7109.al8
golang	CVE-2024-9355	golang-1.21.13-3.0.1.al8
openssl	CVE-2024-5535	openssl-1.1.1k-14.0.1.al8
nano	CVE-2024-5742	nano-2.9.8-2.0.1.al8
runc	CVE-2023-45290 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	runc-1.1.12-5.0.1.al8
OpenIPMI	CVE-2024-42934	OpenIPMI-2.0.32-5.0.1.al8
grafana	CVE-2024-47875 CVE-2024-9355	grafana-9.2.10-20.0.1.al8
java-11-openjdk	CVE-2023-48161 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235	java-11-openjdk-11.0.25.0.9-2.0.1.1.al8
java-1.8.0-openjdk	CVE-2023-48161 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235	java-1.8.0-openjdk-1.8.0.432.b06-2.0.2.1.al8
java-17-openjdk	CVE-2023-48161 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235	java-17-openjdk-17.0.13.0.11-3.0.2.1.al8
NetworkManager-libreswan	CVE-2024-9050	NetworkManager-libreswan-1.2.10-7.0.1.al8
ansible-core	CVE-2024-0690	ansible-core-2.16.3-2.0.1.al8
libtiff	CVE-2023-52356	libtiff-4.4.0-12.0.2.al8
krb5	CVE-2024-3596	krb5-1.18.2-30.0.1.al8
xorg-x11-server	CVE-2024-9632	xorg-x11-server-1.20.11-25.0.1.al8
xmlrpc-c	CVE-2024-45491	xmlrpc-c-1.51.0-10.0.1.al8
bzip2	CVE-2019-12900	bzip2-1.0.6-27.al8
bcc	CVE-2024-2314	bcc-0.25.0-9.0.1.al8
python3.11	CVE-2024-6232	python3.11-3.11.10-1.0.1.al8
buildah	CVE-2024-9341 CVE-2024-9407 CVE-2024-9675	buildah-1.33.10-1.al8
podman	CVE-2024-9341 CVE-2024-9407 CVE-2024-9675	podman-4.9.4-15.0.1.al8
libtiff	CVE-2024-7006	libtiff-4.4.0-12.0.3.al8
libsoup	CVE-2024-52530 CVE-2024-52532	libsoup-2.62.3-6.0.1.al8
gtk3	CVE-2024-6655	gtk3-3.24.31-5.0.2.1.al8
tigervnc	CVE-2024-9632	tigervnc-1.13.1-14.al8
emacs	CVE-2024-30203 CVE-2024-30204 CVE-2024-30205	emacs-27.2-10.0.1.al8
squid	CVE-2024-23638 CVE-2024-45802	squid-4.15-13.al8.3
gnome-shell-extensions	CVE-2024-36472	gnome-shell-extensions-40.7-19.0.1.al8
gnome-shell	CVE-2024-36472	gnome-shell-40.10-21.al8
osbuild-composer	CVE-2024-34156	osbuild-composer-118-2.0.1.al8
expat	CVE-2024-50602	expat-2.2.5-16.al8
iperf3	CVE-2023-7250 CVE-2024-26306	iperf3-3.9-13.al8
lldpd	CVE-2020-27827 CVE-2021-43612 CVE-2023-41910	lldpd-1.0.18-4.0.1.al8
xorg-x11-server-Xwayland	CVE-2024-31080 CVE-2024-31081 CVE-2024-31083	xorg-x11-server-Xwayland-23.2.7-1.al8
bpftrace	CVE-2024-2313	bpftrace-0.16.0-8.al8
perl-Convert-ASN1	CVE-2013-7488	perl-Convert-ASN1-0.27-17.1.0.1.al8
podman	CVE-2021-33198 CVE-2021-4024 CVE-2024-9676	podman-4.9.4-18.0.1.al8
grafana-pcp	CVE-2024-9355	grafana-pcp-5.1.1-9.0.1.al8
buildah	CVE-2021-33198 CVE-2021-4024 CVE-2024-9676	buildah-1.33.11-1.al8
python-podman	CVE-2021-33198 CVE-2021-4024 CVE-2024-9676	python-podman-4.9.0-3.al8
golang	CVE-2024-24790	golang-1.22.7-1.0.2.al8
delve	CVE-2024-24790	delve-1.22.1-1.0.2.al8
go-toolset	CVE-2024-24790	go-toolset-1.22.7-1.al8
pam	CVE-2024-10041 CVE-2024-10963	pam-1.3.1-36.al8
perl-App-cpanminus	CVE-2024-45321	perl-App-cpanminus-1.7044-6.al8
postgresql	CVE-2024-10976 CVE-2024-10978 CVE-2024-10979	postgresql-13.18-1.0.1.al8
python3	CVE-2024-11168 CVE-2024-9287	python3-3.6.8-69.0.1.1.al8
python3.11-cryptography	CVE-2023-49083	python3.11-cryptography-37.0.2-6.0.1.al8
python3.11-setuptools	CVE-2024-6345	python3.11-setuptools-65.5.1-3.al8
python3.11-pip	CVE-2007-4559	python3.11-pip-22.3.1-5.al8
python3.11	CVE-2024-9287	python3.11-3.11.11-1.0.1.al8
php	CVE-2023-0567 CVE-2023-0568 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-3096 CVE-2024-5458 CVE-2024-8925 CVE-2024-8927 CVE-2024-9026	php-7.4.33-2.0.1.al8
pcs	CVE-2024-21510	pcs-0.10.18-2.0.1.1.al8.3
gstreamer1-plugins-good	CVE-2024-47537 CVE-2024-47539 CVE-2024-47540 CVE-2024-47606 CVE-2024-47613	gstreamer1-plugins-good-1.16.1-5.al8
gstreamer1-plugins-base	CVE-2024-47538 CVE-2024-47607 CVE-2024-47615	gstreamer1-plugins-base-1.22.1-3.0.1.al8
libsndfile	CVE-2024-50612	libsndfile-1.0.28-16.0.1.al8
tuned	CVE-2024-52337	tuned-2.22.1-5.0.1.1.al8
edk2	CVE-2024-38796	edk2-20220126gitbb1bba3d77-13.0.1.al8.4
bluez	CVE-2023-45866	bluez-5.63-3.0.1.al8
fontforge	CVE-2024-25081 CVE-2024-25082	fontforge-20200314-6.0.1.al8
mpg123	CVE-2024-10573	mpg123-1.32.9-1.al8
webkit2gtk3	CVE-2024-23271 CVE-2024-27820 CVE-2024-27838 CVE-2024-27851 CVE-2024-40779 CVE-2024-40780 CVE-2024-40782 CVE-2024-40789 CVE-2024-40866 CVE-2024-44185 CVE-2024-44187 CVE-2024-44244 CVE-2024-44296 CVE-2024-4558	webkit2gtk3-2.46.3-2.0.1.al8
python-requests	CVE-2024-35195	python-requests-2.20.0-5.al8
cups-filters	CVE-2024-47076 CVE-2024-47175 CVE-2024-47176 CVE-2024-47850	cups-filters-1.20.0-35.0.2.al8
openssh	CVE-2020-15778 CVE-2023-48795 CVE-2023-51385	openssh-8.0p1-25.0.1.2.al8
pam	CVE-2024-10041 CVE-2024-10963	pam-1.3.1-36.1.al8
webkit2gtk3	CVE-2024-23271 CVE-2024-27820 CVE-2024-27838 CVE-2024-27851 CVE-2024-40779 CVE-2024-40780 CVE-2024-40782 CVE-2024-40789 CVE-2024-40866 CVE-2024-44185 CVE-2024-44187 CVE-2024-44244 CVE-2024-44296 CVE-2024-44309 CVE-2024-4558	webkit2gtk3-2.46.5-1.0.1.al8
dpdk	CVE-2024-11614	dpdk-23.11-2.al8
cups	CVE-2024-47175	cups-2.2.6-62.0.1.al8
iperf3	CVE-2024-53580	iperf3-3.9-13.al8.1
cups	CVE-2024-47175	cups-2.2.6-62.0.2.al8
NetworkManager	CVE-2024-3661	NetworkManager-1.40.16-18.0.1.al8
raptor2	CVE-2024-57823	raptor2-2.0.15-17.0.1.al8
rsync	CVE-2024-12085	rsync-3.1.3-20.0.1.al8
fence-agents	CVE-2024-56201 CVE-2024-56326	fence-agents-4.10.0-76.0.1.al8.4
glibc	CVE-2022-23218 CVE-2022-23219	glibc-2.32-1.19.al8
glibc	CVE-2024-33602 CVE-2024-33601 CVE-2024-33600 CVE-2024-33599	glibc-2.32-1.20.al8
grafana	CVE-2025-21613 CVE-2025-21614	grafana-9.2.10-21.0.1.al8
redis	CVE-2022-24834 CVE-2022-35977 CVE-2022-36021 CVE-2023-22458 CVE-2023-25155 CVE-2023-28856 CVE-2023-45145 CVE-2024-31228 CVE-2024-31449 CVE-2024-46981	redis-6.2.17-1.0.1.1.al8
python-jinja2	CVE-2024-56326	python-jinja2-2.10.1-3.0.4.al8
bzip2	CVE-2019-12900	bzip2-1.0.6-28.al8
libsoup	CVE-2024-52531	libsoup-2.62.3-7.0.1.al8
git-lfs	CVE-2024-53263	git-lfs-3.4.1-4.0.1.al8
keepalived	CVE-2024-41184	keepalived-2.2.8-4.al8
unbound	CVE-2024-1488 CVE-2024-8508	unbound-1.16.2-8.al8
java-17-openjdk	CVE-2025-21502	java-17-openjdk-17.0.14.0.7-3.0.1.1.al8
galera	CVE-2023-22084 CVE-2024-21096	galera-26.4.20-1.al8
mariadb	CVE-2023-22084 CVE-2024-21096	mariadb-10.5.27-1.0.1.al8
doxygen	CVE-2020-11023	doxygen-1.8.14-13.al8
tbb	CVE-2020-11023	tbb-2018.2-10.al8.1
gcc-toolset-13-gcc	CVE-2020-11023	gcc-toolset-13-gcc-13.3.1-2.2.0.1.1.al8
nodejs	CVE-2025-22150 CVE-2025-23083 CVE-2025-23085	nodejs-20.18.2-1.1.al8
nodejs-packaging	CVE-2025-22150 CVE-2025-23083 CVE-2025-23085	nodejs-packaging-2021.06-4.al8
nodejs-nodemon	CVE-2025-22150 CVE-2025-23083 CVE-2025-23085	nodejs-nodemon-3.0.1-1.al8
podman	CVE-2024-11218	podman-4.9.4-19.0.1.al8
buildah	CVE-2024-11218	buildah-1.33.12-1.al8
libcap	CVE-2025-1390	libcap-2.48-6.0.2.al8
libxml2	CVE-2022-49043	libxml2-2.9.7-18.0.4.1.al8
bind	CVE-2024-11187	bind-9.11.36-16.0.1.al8.4
postgresql	CVE-2025-1094	postgresql-13.20-1.0.1.al8
libpq	CVE-2025-1094	libpq-13.20-1.0.1.al8
mecab-ipadic	CVE-2024-11053 CVE-2024-21193 CVE-2024-21194 CVE-2024-21196 CVE-2024-21197 CVE-2024-21198 CVE-2024-21199 CVE-2024-21201 CVE-2024-21203 CVE-2024-21212 CVE-2024-21213 CVE-2024-21218 CVE-2024-21219 CVE-2024-21230 CVE-2024-21231 CVE-2024-21236 CVE-2024-21237 CVE-2024-21238 CVE-2024-21239 CVE-2024-21241 CVE-2024-21247 CVE-2024-37371 CVE-2024-5535 CVE-2024-7264 CVE-2025-21490 CVE-2025-21491 CVE-2025-21494 CVE-2025-21497 CVE-2025-21500 CVE-2025-21501 CVE-2025-21503 CVE-2025-21504 CVE-2025-21505 CVE-2025-21518 CVE-2025-21519 CVE-2025-21520 CVE-2025-21521 CVE-2025-21522 CVE-2025-21523 CVE-2025-21525 CVE-2025-21529 CVE-2025-21531 CVE-2025-21534 CVE-2025-21536 CVE-2025-21540 CVE-2025-21543 CVE-2025-21546 CVE-2025-21555 CVE-2025-21559	mecab-ipadic-2.7.0.20070801-17.0.1.al8
mysql	CVE-2024-11053 CVE-2024-21193 CVE-2024-21194 CVE-2024-21196 CVE-2024-21197 CVE-2024-21198 CVE-2024-21199 CVE-2024-21201 CVE-2024-21203 CVE-2024-21212 CVE-2024-21213 CVE-2024-21218 CVE-2024-21219 CVE-2024-21230 CVE-2024-21231 CVE-2024-21236 CVE-2024-21237 CVE-2024-21238 CVE-2024-21239 CVE-2024-21241 CVE-2024-21247 CVE-2024-37371 CVE-2024-5535 CVE-2024-7264 CVE-2025-21490 CVE-2025-21491 CVE-2025-21494 CVE-2025-21497 CVE-2025-21500 CVE-2025-21501 CVE-2025-21503 CVE-2025-21504 CVE-2025-21505 CVE-2025-21518 CVE-2025-21519 CVE-2025-21520 CVE-2025-21521 CVE-2025-21522 CVE-2025-21523 CVE-2025-21525 CVE-2025-21529 CVE-2025-21531 CVE-2025-21534 CVE-2025-21536 CVE-2025-21540 CVE-2025-21543 CVE-2025-21546 CVE-2025-21555 CVE-2025-21559	mysql-8.0.41-1.0.1.1.al8
emacs	CVE-2025-1244	emacs-27.2-11.0.1.al8.1
webkit2gtk3	CVE-2024-54543 CVE-2025-24143 CVE-2025-24150 CVE-2025-24158 CVE-2025-24162	webkit2gtk3-2.46.6-1.0.1.al8
tigervnc	CVE-2025-26594 CVE-2025-26595 CVE-2025-26596 CVE-2025-26597 CVE-2025-26598 CVE-2025-26599 CVE-2025-26600 CVE-2025-26601	tigervnc-1.13.1-15.al8
rsync	CVE-2024-12087 CVE-2024-12088 CVE-2024-12747	rsync-3.1.3-21.0.1.al8
libxml2	CVE-2024-56171 CVE-2025-24928	libxml2-2.9.7-19.0.1.1.al8
krb5	CVE-2025-24528	krb5-1.18.2-31.0.1.al8
pcs	CVE-2024-52804	pcs-0.10.18-2.0.1.1.al8.4
webkit2gtk3	CVE-2025-24201	webkit2gtk3-2.46.6-2.0.1.al8
fence-agents	CVE-2025-27516	fence-agents-4.10.0-76.0.1.al8.6
podman	CVE-2025-22869	podman-4.9.4-20.0.1.al8
runc	CVE-2025-22869	runc-1.1.12-6.0.1.al8
grub2	CVE-2025-0624	libreoffice-7.1.8.1-15.0.1.1.al8.1
libreoffice	CVE-2025-1080	libreoffice-7.1.8.1-15.0.1.1.al8.1
freetype	CVE-2025-27363	freetype-2.10.4-10.al8
python-jinja2	CVE-2025-27516	python-jinja2-2.10.1-7.0.1.al8
libxslt	CVE-2024-55549 CVE-2025-24855	libxslt-1.1.32-6.1.0.1.al8
tomcat	CVE-2024-50379 CVE-2025-24813	tomcat-9.0.87-1.al8.3
expat	CVE-2024-8176	expat-2.2.5-17.al8
mod_auth_openidc	CVE-2025-31492	mod_auth_openidc-2.4.9.4-7.al8
xmlrpc-c	CVE-2024-8176	xmlrpc-c-1.51.0-11.0.1.al8
libtasn1	CVE-2024-12133	libtasn1-4.13-5.0.1.al8
bluez	CVE-2023-27349 CVE-2023-51589	bluez-5.63-5.0.1.al8

Package updates

New features

Confidential AI is added to provide enhanced data security based on confidential computing for scenarios such as AI model training and inference.
You can use ras-tools to inject PCIe faults.
26 external device drivers are added to meet hardware support requirements. These drivers are not installed by default.
- kmod-ast-5.10.134~19-1.14.4~1.al8.src.rpm
- kmod-bnxt-5.10.134~19-1.10.3_231.0.162.0~2.al8.src.rpm
- kmod-fic2-5.10.134~19-1.2.6~1.al8.src.rpm
- kmod-hinic-5.10.134~19-1.0~1.al8.src.rpm
- kmod-hns3-5.10.134~19-1.0~1.al8.src.rpm
- kmod-i40e-5.10.134~19-2.23.17~1.al8.src.rpm
- kmod-iavf-5.10.134~19-4.9.4~1.al8.src.rpm
- kmod-ice-5.10.134~19-1.12.13.4~2.al8.src.rpm
- kmod-igb-5.10.134~19-5.14.16~1.al8.src.rpm
- kmod-intel-QAT20-5.10.134~19-L.0.9.4__00004~1.al8.src.rpm
- kmod-irdma-5.10.134~19-1.13.43~1.al8.src.rpm
- kmod-ixgbe-5.10.134~19-5.19.6~1.al8.src.rpm
- kmod-ixgbevf-5.10.134~19-4.18.7~1.al8.src.rpm
- kmod-ixgbevf-5.10.134~19-4.18.7~1.al8.src.rpm
- kmod-kvdo-6.2.8.7-94.0.1.al8.src.rpm
- kmod-lpfc-5.10.134~19-14.2.673.37~1.al8.src.rpm
- kmod-mellanox-5.10.134~19-23.10~2.al8.src.rpm
- kmod-mpi3mr-5.10.134~19-8.11.1.0.0~1.al8.src.rpm
- kmod-mpt3sas-5.10.134~19-47.00.00.00~1.al8.src.rpm
- kmod-ngbevf-5.10.134~19-1.2.2~2.al8.src.rpm
- kmod-ps3stor-5.10.134~19-2.3.1.24~1.al8.src.rpm
- kmod-ps3stor-5.10.134~19-2.3.1.24~1.al8.src.rpm
- kmod-qla2xxx-5.10.134~19-10.02.09.00_k~1.al8.src.rpm
- kmod-sfc-5.10.134~19-5.3.16.1004~2.al8.src.rpm
- kmod-smartpqi-5.10.134~19-2.1.22_040~1.al8.src.rpm
- kmod-sxe-5.10.134~19-1.3.1.1~1.al8.src.rpm
- kmod-txgbevf-5.10.134~19-1.3.1~2.al8.src.rpm
- kmod-xscale-5.10.134~19-1.2.0_367~2.al8.src.rpm

Highlights

Kernel

The kernel is upgraded to kernel-5.10.134-19.1.al8.

Scheduling
- The cluster scheduling feature is merged.
- BVT configuration is supported for non-movable threads in the root group.
- Core scheduling supports independent configuration of special properties for each cookie.
  - Allows sharing a core with normal tasks that do not have a cookie.
  - Prevents the load balancer from automatically grouping tasks with the same cookie, which distributes them across different cores.
Memory
- kfence stability issues are fixed.
- A THP counting issue for large code pages is fixed.
- mmap() now supports THP-aligned address space allocation.
- virtio-mem supports the memmap_on_memory feature, which helps containers rapidly scale memory in and out.
- Other memory-related CVE patches are merged.
Network
- The link group and link use-after-free issues are fixed.
- An issue where smc-r device lookup failed in container scenarios is fixed.
Storage
- erofs
  - Several fixes for the erofs file system are merged from the mainline.
  - Support is added for file backup mounting and 48-bit layout.
  - Support is added for sub-page blocks for compressed files.
- Patches are merged from the mainline stable branch for components such as ext4, block, blk-mq, and io_uring.
- The virtio-blk passthrough feature is added to support the passthrough capability for virtio-blk devices.
  - A generic character device is added for each virtio-blk block device. The device is named /dev/vdXc0 and allows users to use the uring_cmd method provided by the io_uring framework to directly send read/write commands to the virtio-blk driver layer.
  - Based on this capability, bidirectional command support is added for virtio-blk devices. On the same sector base address, you can specify the number of write and read buffers in vector-like read/write operations. This allows a single I/O instruction to complete both read and write operations. Currently, only write-then-read is supported.
  - A virtio_ring extension named ring_pair is introduced based on virtio-blk. In this model, each virtio-blk request hardware queue corresponds to two virtio_ring queues: a submission queue (SQ) and a completion queue (CQ). After a request is submitted, the driver can proactively reclaim the slots occupied by the submitted I/O commands to submit other requests. When an I/O operation is complete, the backend fills the CQ, and the driver is responsible for reaping the responses. This feature requires that the backend supports the ring_pair operation mode. Currently, only the vring split_queue+Indirect descriptor mode is supported.
Driver
- The NVMe driver supports batch processing of completed polled I/O commands.
- Numerous issues in the HiSilicon SAS driver for SCSI and in libsas are fixed.
- PCIe driver bugfix patches are merged to fix issues such as incorrect space size calculation and root bus allocation.
BPF
Bugfix and CVE fix patches are merged from the community stable branch.
Architecture
x86 architecture-related CVEs are fixed.

Fixed issues

alinux-base-setup is updated to alinux-base-setup-3.2-8.al8 to fix issues where Kdump failed to generate and grubby parameters did not take effect on the ARM architecture.
gdm is updated to gdm-40.0-27.0.1.1.al8 to fix an issue where the desktop fails to wake up after the screen is locked.
The alinux-release package is updated to version alinux-release-3.2104.12-1.al8 and the EULA file for Alibaba Cloud Linux is updated.
dump is updated to dump-0.4-0.36.b46.3.al8 to fix an issue where the restore operation reported an error after an incremental backup was performed using dump.
maven is updated to version maven-3.6.2-9.1.al8 to fix an issue where the mvn command was not ready for use after installation on Alibaba Cloud Linux 3.
grub2 is updated to version grub2-2.02-165.0.2.al8 to fix a grub2 error in the tdx scenario on Alibaba Cloud Linux 3.

Known issues

Because virtio-blk passthrough introduces a generic character device for virtio-blk devices, user components may experience abnormalities in device detection.

Note

For devices such as /dev/vda, their partitions are numbered starting from 1. Therefore, /dev/vdac0 is the character device for /dev/vda and is not associated with /dev/vdac. In addition, the file type of /dev/vdac0 is a character device, not a block device, which serves as another distinguishing factor. If you have no specific need for this character channel, you can upgrade the kernel to kernel-5.10.134-19.1.al8 so that this interface is no longer exposed to virtio-blk disks.

Alibaba Cloud Linux 3.2104 U11.1

Version	Image ID	Release date	Release content
Alibaba Cloud Linux 3.2104 U11.1	aliyun_3_x64_20G_alibase_20250117.vhd	2025-01-17	Updated `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_dengbao_alibase_20250117.vhd	2025-01-17	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit MLPS 2.0 Level 3` base image to the latest software version. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_alibase_20250117.vhd	2025-01-17	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM Edition` base image to the latest software version Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_dengbao_alibase_20250117.vhd	2025-01-17	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM MLPS 2.0 Level 3` base image to the latest software version. Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_container_optimized_20250117.vhd	2025-01-17	Updated the `Alibaba Cloud Linux 3.2104 64-bit Container Optimized Edition` base image to the latest software version Content updates: For more information, see Content updates.

Content updates

Security updates

Package name	CVE ID
python-requests	CVE-2024-35195
cups	CVE-2024-47175
NetworkManager	CVE-2024-3661

Image

The loadmodules service is enabled by default.
The timedatex service is enabled by default.

2024

Alibaba Cloud Linux 3.2104 U11

Version	Image ID	Release date	Release content
Alibaba Cloud Linux 3.2104 U11	aliyun_3_x64_20G_alibase_20241218.vhd	2024-12-18	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version The kernel is updated to 5.10.134-18.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_dengbao_alibase_20241218.vhd	2024-12-18	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit MLPS 2.0 Level 3 Edition` base image to the latest software version. The kernel is updated to 5.10.134-18.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_alibase_20241218.vhd	2024-12-18	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM version` base image to the latest software version. The kernel is updated to 5.10.134-18.al8.aarch64. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_dengbao_alibase_20241218.vhd	2024-12-18	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit for ARM (MLPS 2.0 Level 3)` base image to the latest software version. The kernel is updated to 5.10.134-18.al8.aarch64. Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_container_optimized_20241226.vhd	2024-12-26	Added the `Alibaba Cloud Linux 3.2104 LTS 64-bit Container-Optimized Edition` image The kernel is updated to 5.10.134-18.al8.x86_64. Content updates: For more information, see Content updates.

Content updates

Security updates

Package name	CVE ID	Version
grafana	CVE-2024-47875 CVE-2024-9355	grafana-9.2.10-20.0.1.al8
java-11-openjdk	CVE-2023-48161 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235	java-11-openjdk-11.0.25.0.9-2.0.1.1.al8
java-1.8.0-openjdk	CVE-2023-48161 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235	java-1.8.0-openjdk-1.8.0.432.b06-2.0.2.1.al8
java-17-openjdk	CVE-2023-48161 CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235	java-17-openjdk-17.0.13.0.11-3.0.2.1.al8
NetworkManager-libreswan	CVE-2024-9050	NetworkManager-libreswan-1.2.10-7.0.1.al8
ansible-core	CVE-2024-0690	ansible-core-2.16.3-2.0.1.al8
krb5	CVE-2024-3596	krb5-1.18.2-30.0.1.al8
xorg-x11-server	CVE-2024-9632	xorg-x11-server-1.20.11-25.0.1.al8
xmlrpc-c	CVE-2024-45491	xmlrpc-c-1.51.0-10.0.1.al8
bzip2	CVE-2019-12900	bzip2-1.0.6-27.al8
bcc	CVE-2024-2314	bcc-0.25.0-9.0.1.al8
buildah	CVE-2024-9341 CVE-2024-9407 CVE-2024-9675	buildah-1.33.10-1.al8
libtiff	CVE-2024-7006	libtiff-4.4.0-12.0.3.al8
libsoup	CVE-2024-52530 CVE-2024-52532	libsoup-2.62.3-6.0.1.al8
gtk3	CVE-2024-6655	gtk3-3.24.31-5.0.2.1.al8
tigervnc	CVE-2024-9632	tigervnc-1.13.1-14.al8
emacs	CVE-2024-30203 CVE-2024-30204 CVE-2024-30205	emacs-27.2-10.0.1.al8
squid	CVE-2024-23638 CVE-2024-45802	squid-4.15-13.al8.3
gnome-shell-extensions	CVE-2024-36472	gnome-shell-extensions-40.7-19.0.1.al8
gnome-shell	CVE-2024-36472	gnome-shell-40.10-21.al8
osbuild-composer	CVE-2024-34156	osbuild-composer-118-2.0.1.al8
expat	CVE-2024-50602	expat-2.2.5-16.al8
iperf3	CVE-2023-7250 CVE-2024-26306	iperf3-3.9-13.al8
lldpd	CVE-2020-27827 CVE-2021-43612 CVE-2023-41910	lldpd-1.0.18-4.0.1.al8
xorg-x11-server-Xwayland	CVE-2024-31080 CVE-2024-31081 CVE-2024-31083	xorg-x11-server-Xwayland-23.2.7-1.al8
bpftrace	CVE-2024-2313	bpftrace-0.16.0-8.al8
perl-Convert-ASN1	CVE-2013-7488	perl-Convert-ASN1-0.27-17.1.0.1.al8
podman	CVE-2021-33198 CVE-2021-4024 CVE-2024-9676	podman-4.9.4-18.0.1.al8
grafana-pcp	CVE-2024-9355	grafana-pcp-5.1.1-9.0.1.al8
buildah	CVE-2021-33198 CVE-2021-4024 CVE-2024-9676	buildah-1.33.11-1.al8
python-podman	CVE-2021-33198 CVE-2021-4024 CVE-2024-9676	python-podman-4.9.0-3.al8
golang	CVE-2024-24790	golang-1.22.7-1.0.2.al8
delve	CVE-2024-24790	delve-1.22.1-1.0.2.al8
go-toolset	CVE-2024-24790	go-toolset-1.22.7-1.al8
pam	CVE-2024-10041 CVE-2024-10963	pam-1.3.1-36.al8
perl-App-cpanminus	CVE-2024-45321	perl-App-cpanminus-1.7044-6.al8
postgresql	CVE-2024-10976 CVE-2024-10978 CVE-2024-10979	postgresql-13.18-1.0.1.al8
python3	CVE-2024-11168 CVE-2024-9287	python3-3.6.8-69.0.1.1.al8
python3.11-cryptography	CVE-2023-49083	python3.11-cryptography-37.0.2-6.0.1.al8
python3.11-setuptools	CVE-2024-6345	python3.11-setuptools-65.5.1-3.al8
python3.11-pip	CVE-2007-4559	python3.11-pip-22.3.1-5.al8
python3.11	CVE-2024-9287	python3.11-3.11.11-1.0.1.al8
php	CVE-2023-0567 CVE-2023-0568 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-3096 CVE-2024-5458 CVE-2024-8925 CVE-2024-8927 CVE-2024-9026	php-7.4.33-2.0.1.al8
pcs	CVE-2024-21510	pcs-0.10.18-2.0.1.1.al8.3

Package updates

New features

Support is added for AMD GPU and NVIDIA GPU-based confidential computing features.
With util-linux-2.32.1-46.0.3.al8, the performance of the lscpu command is optimized for systems with a very large number of pcie devices.
Container storage is provided by erofs-utils-1.8.2-1.al8.
java-11-alibaba-dragonwell-11.0.24.21.21-1.1.al8 is updated, which optimizes the BigDecimal class to improve performance in big data scenarios.
java-21-alibaba-dragonwell-21.0.4.0.4-1.1.al8 is updated to improve Java performance.
The system-rpm-config-129-1.0.2.1.al8 component is added to provide configuration for system macro variables.

Important Updates

Kernel

The kernel is upgraded to version 5.10.134-18.al8.

New hardware support
- Official support is added for the Intel GNR platform.
- Official support is added for the AMD Turin platform.
Scheduling
cgroup v2 now supports cpu sli, which includes container-level data such as cpuusage and loadavg.
Memory
- Multiple memory-related issues are fixed and multiple memory bugfixes patches are backported from the kernel-5.10 stable branch.
- The pgtable_share feature is disabled by default.
- Code segment enormous pages now support the direct collapse mode, which quickly consolidates them into enormous pages during a page fault.
- The percpu chunk release optimization patch set is backported to prevent percpu fragmentation from causing chunks to be un-releasable.
Network
- The RSS logic for virtio_net is optimized to ensure the RSS configuration is consistent with the device and updates correctly with the number of queues.
- Support for 200 G and 400 G rates is added for bond 3ad mode.
Storage
- io_uring
  - A race condition in the concurrent creation of percpu sqthread is fixed.
  - The validity of the CPU is checked for the configuration to enable percpu sqthread.
  - Patches are backported from the community stable branch to improve code quality.
- fuse/virtio-fs
  - Support is added for resend pending requests.
  - Support is added for multiple queues and fuse performance is optimized.
  - Read/write splitting is optimized to prevent many write requests from blocking read requests.
  - Support is added for the failover feature, which allows a fuse daemon to reconnect to the original fuse connection using an attach operation, resend requests, and perform other operations to complete fault recovery after an abnormal recovery.
  - Support is added for 4 MB write alignment to optimize performance.
  - An issue where virtio-fs caused an IO hang when loading a module larger than 4 MB is fixed.
  - The tag and queue mapping sysfs interfaces are added to virtio-fs.
  - Community patches are backported to the stable branch to improve code quality.
- erofs
  - The UUID issue in erofs_statfs() is fixed and the DEFLATE stream allocation logic is optimized.
  - Patches are backported from the community stable branch to improve code quality.
- ext4
  - The EXT4_GROUP_INFO_WAS_TRIMMED_BIT cleanup logic is optimized.
  - Patches are backported from the community stable branch to improve code quality.
- xfs
  - reflink performance jitter caused by potential blocking for tens of milliseconds in xfs_log_force() is optimized.
  - A compilation error caused by disabling CONFIG_FS_DAX is fixed.
  - i_blocks is now correctly checked when the atomic write feature is enabled.
- block
  - The mq-deadline scheduler, which caused an IO hang on devices with multiple hardware queues, is fixed.
  - An issue is fixed where updating the block throttling configuration could cause unexpected throttling due to a negative value in the bps throttling calculation.
  - The blk-mq "running from the wrong CPU" alert is removed.
  - Patches are backported from the community stable branch to improve code quality.
- misc
  Patches are backported from the community stable branches for modules such as vfs, quota, overlayfs, nfs, cifs, ceph, dm/md, null_blk, nbd, loop, and virtio-blk to enhance code quality.
Driver
- Patches for the watchdog driver in kernel-5.10 LTS are backported to improve stability.
- The NVMe driver supports the latest Alibaba Cloud disk activation solution.
- NVMe driver patches are backported from kernel-5.10 LTS to improve stability.
- SCSI-related patches are backported to kernel-5.10 LTS to enhance stability.
- ATA-related fix patches for kernel-5.10 LTS are merged to improve stability.
- The sig_enforce_subsys parameter is introduced to support mandatory verification of module signatures in the block, net, and GPU realms.
- The NetXen NIC driver integrates numerous patches for txgbe and txgbevf, enhancing code quality and stability.
Perf
A pointer memory leak in the perf tool caused by a patch for the stable branch is fixed. This resolves coredump failures.
BPF
- Support for atomic operations in Berkeley Packet Filter (BPF) programs is added.
- stable and bugfix patches are backported from the community.
x86 architecture
- Support is added for C-states on the Intel GNR platform.
- Support is added for p-states on EMR and GNR platforms.
- intel-speed-select is updated to v1.20 to support new platforms.
- Support is added for Processor Event-Based Sampling (PEBS) feature pass-through to virtual machines.
- x86 bugfix for ACPI, APIC, power consumption, and PMU are applied to other architectures or systems.
- turbostate is upgraded to the 2023.11.07 version to support more features.
- Support is added for Compute Express Link (CXL) Performance Monitor (PMON) on SPR and EMR.
- Support is added for AMD c2c.
- Support is added for AMD Host System Management Port (HSMP).
- AMD Indirect Branch Restricted Speculation (IBRS) enhancements are added.
- Support is added for AMD Automatic BCLK/MEMCLK Control (ABMC).

Fixed issues

Packages

An issue with systemd-239-82.0.3.4.al8.2 is fixed where systemd reclaimed non-device cgroup subgroups within 20 seconds when Delegate=yes was set. This caused pods to exit abnormally and deployments to fail.
A memory leak in ledmon-0.97-1.0.2.al8 is fixed.
Data access efficiency on the Yitian platform is improved with the tuned-2.22.1-5.0.1.1.al8 package.
Installation failures for several components on the mirror are fixed.

Images

The crashkernel value for x86 images is modified to fix an issue where vmcore files could not be generated.
The default parameter in /sys/kernel/mm/transparent_hugepage/defrag is changed to defer to improve memory reclamation speed in scenarios that use Transparent Enormous Pages (THP).

Alibaba Cloud Linux 3.2104 U10.1

Version number	Image ID	Release date	Release notes
Alibaba Cloud Linux 3.2104 U10.1	aliyun_3_x64_20G_alibase_20241103.vhd	2024-11-03	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Upgraded the kernel version to 5.10.134-17.3.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_dengbao_alibase_20241103.vhd	2024-11-03	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit MLPS 2.0 Level 3 Edition` base image to the latest software version. Upgraded the kernel version to 5.10.134-17.3.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_alibase_20241103.vhd	2024-11-03	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM Edition` base image to the latest software version. Upgraded the kernel version to 5.10.134-17.3.al8.aarch64. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_dengbao_alibase_20241103.vhd	2024-11-03	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM MLPS 2.0 Level 3 Edition` base image to the latest software version. Upgraded the kernel version to 5.10.134-17.3.al8.aarch64. Content updates: For more information, see Content updates.

Content updates

Security updates

Package name	CVE ID	Version
buildah	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	buildah-1.33.8-4.al8
containernetworking-plugins	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	containernetworking-plugins-1.4.0-5.0.1.al8
containers-common	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	containers-common-1-82.0.1.al8
podman	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	podman-4.9.4-12.0.1.al8
python-podman	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	python-podman-4.9.0-2.al8
runc	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	runc-1.1.12-4.0.1.al8
skopeo	CVE-2023-45290 CVE-2024-1394 CVE-2024-3727 CVE-2024-6104 CVE-2024-24783 CVE-2024-24784 CVE-2024-24789 CVE-2024-37298	skopeo-1.14.5-3.0.1.al8
httpd	CVE-2023-27522	httpd-2.4.37-65.0.1.al8.2
git-lfs	CVE-2023-45288 CVE-2023-45289 CVE-2023-45290 CVE-2024-24783	git-lfs-3.4.1-2.0.1.al8
bind	CVE-2024-1975 CVE-2024-1737	bind-9.11.36-16.0.1.al8
python-setuptools	CVE-2024-6345	python-setuptools-39.2.0-8.al8.1
less	CVE-2022-48624 CVE-2024-32487	less-530-3.0.1.al8
java-17-openjdk	CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147	java-17-openjdk-17.0.12.0.7-2.0.2.1.al8
java-11-openjdk	CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147	java-11-openjdk-11.0.24.0.8-3.0.2.1.al8
postgresql	CVE-2024-7348	postgresql-13.16-1.0.1.al8
flatpak	CVE-2024-42472	flatpak-1.12.9-3.al8
bubblewrap	CVE-2024-42472	bubblewrap-0.4.0-2.2.al8
java-1.8.0-openjdk	CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147	java-1.8.0-openjdk-1.8.0.422.b05-2.0.2.1.al8
fence-agents	CVE-2024-6345	fence-agents-4.10.0-62.0.2.al8.4
pcp	CVE-2024-45769 CVE-2024-45770	pcp-5.3.7-22.0.1.al8
delve	CVE-2024-24791 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	delve-1.21.2-4.0.1.al8
golang	CVE-2024-24791 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	golang-1.21.13-2.0.1.al8
go-toolset	CVE-2024-24791 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	go-toolset-1.21.13-1.al8
edk2	CVE-2023-45236 CVE-2023-45237 CVE-2024-1298	edk2-20220126gitbb1bba3d77-13.0.1.al8.2
curl	CVE-2024-2398	curl-7.61.1-35.0.2.al8
libvpx	CVE-2023-6349 CVE-2024-5197	libvpx-1.7.0-11.0.1.al8
resource-agents	CVE-2024-37891 CVE-2024-6345	resource-agents-4.9.0-54.al8.4
389-ds-base	CVE-2024-5953	389-ds-base-1.4.3.39-8.0.1.al8
python-urllib3	CVE-2024-37891	python-urllib3-1.24.2-8.al8
pcs	CVE-2024-41123 CVE-2024-41946 CVE-2024-43398	pcs-0.10.18-2.0.1.1.al8.2
grafana	CVE-2024-24788 CVE-2024-24789 CVE-2024-24790	grafana-9.2.10-17.0.1.al8
libuv	CVE-2024-24806	libuv-1.42.0-2.al8
c-ares	CVE-2024-25629	c-ares-1.13.0-11.al8
xmlrpc-c	CVE-2023-52425	xmlrpc-c-1.51.0-9.0.1.al8
yajl	CVE-2022-24795 CVE-2023-33460	yajl-2.1.0-13.0.1.al8
wpa_supplicant	CVE-2023-52160	wpa_supplicant-2.10-2.al8
cups	CVE-2024-35235	cups-2.2.6-60.0.1.al8
linux-firmware	CVE-2023-31346	linux-firmware-20240610-122.git90df68d2.al8
wget	CVE-2024-38428	wget-1.19.5-12.0.1.al8
poppler	CVE-2024-6239	poppler-20.11.0-12.0.1.al8
krb5	CVE-2024-37370 CVE-2024-37371	krb5-1.18.2-29.0.1.al8
git-lfs	CVE-2024-34156	git-lfs-3.4.1-3.0.1.al8
libreoffice	CVE-2024-3044 CVE-2024-6472	libreoffice-7.1.8.1-12.0.2.1.al8.1
orc	CVE-2024-40897	orc-0.4.28-4.al8
jose	CVE-2023-50967 CVE-2024-28176	jose-10-2.3.al8.3
openssh	CVE-2020-15778 CVE-2023-48795 CVE-2023-51385	openssh-8.0p1-25.0.1.1.al8
libnbd	CVE-2024-3446 CVE-2024-7383 CVE-2024-7409	libnbd-1.6.0-6.0.1.al8
qemu-kvm	CVE-2024-3446 CVE-2024-7383 CVE-2024-7409	qemu-kvm-6.2.0-53.0.1.al8
libvirt	CVE-2024-3446 CVE-2024-7383 CVE-2024-7409	libvirt-8.0.0-23.2.0.2.al8
osbuild-composer	CVE-2024-34156	osbuild-composer-101-2.0.1.al8
libreswan	CVE-2024-3652	libreswan-4.12-2.0.2.al8.4
mod_auth_openidc	CVE-2024-24814	mod_auth_openidc-2.4.9.4-6.al8
podman	CVE-2023-45290 CVE-2024-24783 CVE-2024-24784 CVE-2024-24788 CVE-2024-24791	podman-4.9.4-13.0.1.al8
ghostscript	CVE-2024-29510 CVE-2024-33869 CVE-2024-33870	ghostscript-9.54.0-18.al8
emacs	CVE-2024-39331	emacs-27.2-9.0.3.al8
dovecot	CVE-2024-23184 CVE-2024-23185	dovecot-2.3.16-5.0.1.al8
expat	CVE-2024-45490 CVE-2024-45491 CVE-2024-45492	expat-2.2.5-13.0.1.al8
glib2	CVE-2024-34397	glib2-2.68.4-14.0.2.al8
python-idna	CVE-2024-3651	python-idna-2.5-7.al8
openldap	CVE-2023-2953	openldap-2.4.46-19.al8
python-pillow	CVE-2024-28219	python-pillow-5.1.1-21.al8
nghttp2	CVE-2024-28182	nghttp2-1.33.0-6.0.1.al8.1
python-jinja2	CVE-2024-34064	python-jinja2-2.10.1-3.0.3.al8
opencryptoki	CVE-2024-0914	opencryptoki-3.22.0-3.al8
gdk-pixbuf2	CVE-2021-44648 CVE-2021-46829 CVE-2022-48622	gdk-pixbuf2-2.42.6-4.0.1.al8
rear	CVE-2024-23301	rear-2.6-13.0.1.al8
grub2	CVE-2023-4692 CVE-2023-4693 CVE-2024-1048	grub2-2.02-150.0.2.al8
nss	CVE-2023-5388 CVE-2023-6135	nss-3.101.0-7.0.1.al8
gnutls	CVE-2024-0553 CVE-2024-28834	gnutls-3.6.16-8.0.1.al8.3
python3	CVE-2024-4032 CVE-2024-6232 CVE-2024-6923	python3-3.6.8-67.0.1.2.al8
grafana	CVE-2024-24791	grafana-9.2.10-18.0.1.al8
cups-filters	CVE-2024-47076 CVE-2024-47175 CVE-2024-47176 CVE-2024-47850	cups-filters-1.20.0-35.0.1.al8
linux-firmware	CVE-2023-20584 CVE-2023-31315 CVE-2023-31356	linux-firmware-20240827-124.git3cff7109.al8
golang	CVE-2024-9355	golang-1.21.13-3.0.1.al8
openssl	CVE-2024-5535	openssl-1.1.1k-14.0.1.al8
nano	CVE-2024-5742	nano-2.9.8-2.0.1.al8
runc	CVE-2023-45290 CVE-2024-34155 CVE-2024-34156 CVE-2024-34158	runc-1.1.12-5.0.1.al8
OpenIPMI	CVE-2024-42934	OpenIPMI-2.0.32-5.0.1.al8

Package updates

New features

The libyang2 component is added.
keentuned and keentune-target are updated to version 3.1.1.
- A tuning option to modify the number of network interface card queues is added.
- A tuning option to modify priority control is added.
- The file-max and scheduler tuning options are removed.
- The execution of unsafe commands is removed.
Four API components are added for keentuned: keentune-bench, keentune-brain, keentune-ui, and keenopt.
tcprt is updated to version 1.1.0 to enhance TCP monitoring capabilities.
Node.js is updated to 20.16 to provide version 20 baseline capabilities for the ACR Artifact Center.
erofs-utils is upgraded to 1.8.2. This version fixes some issues and provides a better EROFS.

Important updates

Kernel

The kernel is upgraded to version 5.10.134-17.3.al8.

Anolis-developed features
- SMC
  - The AutoSplit feature is introduced to optimize the transmission delay for large packages.
  - Connections in an SMC Link Group are allowed to exclusively occupy an RDMA QP.
  - Shared memory water level control is introduced.
  - Data dump at the SMC layer is introduced.
- swiotlb
  swiotlb=any cmdline is introduced to support reserving swiotlb in the entire memory space.
Community features
- The sysctl related to SMC Limited Handshake is backported.
- The shared memory usage statistics for SMC LGR and net namespace dimensions are backported.
TDX
- The TDX Guest RTMR update interface is introduced. You can add custom measurement values for remote attestation.
- The ECDSA algorithm module is introduced.

Fixed issues

An issue where the lscpu command took a long time to run when searching for many pci devices in a cluster is fixed. This fix is included in util-linux-2.32.1-46.0.3.al8.
An issue where some time zone files were missing during migration is fixed. This fix is included in tzdata-2024a-1.0.1.6.al8.
Issues in the SMC module, such as division-by-zero errors and memory leaks, are fixed.
An issue where a bug in the ftrace subsystem could cause the system to break down when multiple security software products coexist is fixed.
A potential out-of-bounds memory access issue when using uprobe is fixed.

Alibaba Cloud Linux 3.2104 U10

Version number	Image ID	Release date	Release notes
Alibaba Cloud Linux 3.2104 U10	aliyun_3_x64_20G_alibase_20240819.vhd	2024-08-19	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Upgraded the kernel to version 5.10.134-17.2.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_dengbao_alibase_20240819.vhd	2024-08-19	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit MLPS 2.0 Level 3 Edition` base image to the latest software version. Upgraded the kernel to version 5.10.134-17.2.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_alibase_20240819.vhd	2024-08-19	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM Edition` base image to the latest software version. Upgraded the kernel to version 5.10.134-17.2.al8.aarch64. Content updates: For more information, see Content updates.
	aliyun_3_arm64_20G_dengbao_alibase_20240819.vhd	2024-08-19	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM Edition MLPS 2.0 Level 3 Edition` base image to the latest software version. Upgraded the kernel to version 5.10.134-17.2.al8.aarch64. Content updates: For more information, see Content updates.

Content updates

Security updates

Package name	CVE ID	Version
adwaita-qt	CVE-2023-32573 CVE-2023-33285 CVE-2023-34410 CVE-2023-37369 CVE-2023-38197	1.4.2-1.al8
apr	CVE-2022-24963	1.7.0-12.al8
avahi	CVE-2021-3468 CVE-2023-1981 CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473	0.7-21.0.1.al8.1
bind	CVE-2023-4408 CVE-2023-50387 CVE-2023-50868	9.11.36-14.0.1.al8
c-ares	CVE-2020-22217 CVE-2023-31130	1.13.0-9.al8.1
cockpit	CVE-2024-2947	310.4-1.al8
cups	CVE-2023-32324 CVE-2023-34241	2.2.6-54.0.1.al8
cups-filters	CVE-2023-24805	1.20.0-32.0.1.al8
curl	CVE-2023-38546	7.61.1-34.0.1.al8
device-mapper-multipath	CVE-2022-41973	0.8.4-39.0.2.al8
dhcp	CVE-2023-4408 CVE-2023-50387 CVE-2023-50868	4.3.6-50.0.1.al8
dnsmasq	CVE-2023-50387 CVE-2023-50868	2.79-32.0.1.al8
edk2	CVE-2022-36763 CVE-2022-36764 CVE-2022-36765 CVE-2023-3446 CVE-2023-45229 CVE-2023-45230 CVE-2023-45231 CVE-2023-45232 CVE-2023-45233 CVE-2023-45234 CVE-2023-45235	20220126gitbb1bba3d77-13.0.1.al8
expat	CVE-2023-52425	2.2.5-13.al8
evolution-mapi	CVE-2022-1615 CVE-2022-2127 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968	3.40.1-6.al8
flatpak	CVE-2023-28100 CVE-2023-28101 CVE-2024-32462	1.12.9-1.al8
frr	CVE-2023-31490 CVE-2023-41358 CVE-2023-41909 CVE-2023-46752 CVE-2023-46753	7.5.1-16.0.4.al8
fwupd	CVE-2022-3287	1.7.8-2.0.1.al8
ghostscript	CVE-2024-33871	9.54.0-16.al8
git	CVE-2024-32002 CVE-2024-32004 CVE-2024-32020 CVE-2024-32021 CVE-2024-32465	2.43.5-1.0.1.al8
glib2	CVE-2023-29499 CVE-2023-32611 CVE-2023-32665	2.68.4-11.al8
gmp	CVE-2021-43618	6.2.0-13.0.1.al8
gnutls	CVE-2023-5981	3.6.16-8.0.2.al8
grafana	CVE-2024-1313 CVE-2024-1394	9.2.10-16.0.1.al8
grafana-pcp	CVE-2024-1394	5.1.1-2.0.1.al8
gstreamer1-plugins-bad-free	CVE-2023-40474 CVE-2023-40475 CVE-2023-40476 CVE-2023-50186	1.22.1-4.0.1.al8
gstreamer1-plugins-base	CVE-2023-37328	1.22.1-2.0.1.al8
gstreamer1-plugins-good	CVE-2023-37327	1.16.1-4.al8
harfbuzz	CVE-2023-25193	2.7.4-10.0.1.al8
httpd	CVE-2023-31122 CVE-2023-45802 CVE-2024-27316	2.4.37-64.0.1.al8
mod_http2	CVE-2023-31122 CVE-2023-45802 CVE-2024-27316	1.15.7-10.al8
java-1.8.0-openjdk	CVE-2024-20918 CVE-2024-20919 CVE-2024-20921 CVE-2024-20926 CVE-2024-20945 CVE-2024-20952 CVE-2024-21011 CVE-2024-21068 CVE-2024-21085 CVE-2024-21094	1.8.0.412.b08-2.0.1.1.al8
java-11-openjdk	CVE-2024-20918 CVE-2024-20919 CVE-2024-20921 CVE-2024-20926 CVE-2024-20945 CVE-2024-20952 CVE-2024-21011 CVE-2024-21012 CVE-2024-21068 CVE-2024-21085 CVE-2024-21094	11.0.23.0.9-3.0.1.1.al8
libfastjson	CVE-2020-12762	0.99.9-5.al8
libjpeg-turbo	CVE-2021-29390	2.0.90-7.0.1.al8
liblouis	CVE-2023-26767 CVE-2023-26768 CVE-2023-26769	3.16.1-5.al8
libmicrohttpd	CVE-2023-27371	0.9.59-3.al8
libpq	CVE-2022-41862	13.11-1.0.1.al8
librabbitmq	CVE-2023-35789	0.11.0-7.0.1.al8
libreoffice	CVE-2022-26305 CVE-2022-26306 CVE-2022-26307 CVE-2022-3140 CVE-2022-38745 CVE-2023-0950 CVE-2023-1183 CVE-2023-2255 CVE-2023-6185 CVE-2023-6186	7.1.8.1-12.0.1.1.al8.1
libreswan	CVE-2023-2295 CVE-2023-30570 CVE-2023-38710 CVE-2023-38711 CVE-2023-38712	4.12-2.0.2.al8
libsndfile	CVE-2022-33065	1.0.28-13.0.2.al8
libssh	CVE-2023-48795 CVE-2023-6004 CVE-2023-6918	0.9.6-12.al8
libtiff	CVE-2022-2056 CVE-2022-2057 CVE-2022-2058 CVE-2022-2519 CVE-2022-2520 CVE-2022-2521 CVE-2022-2867 CVE-2022-2868 CVE-2022-2953 CVE-2022-3627 CVE-2022-3970 CVE-2022-48281 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799 CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804 CVE-2023-26965 CVE-2023-26966 CVE-2023-2731 CVE-2023-3316 CVE-2023-3576 CVE-2022-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175 CVE-2023-6228	4.4.0-12.0.1.al8
libvirt	CVE-2021-3750 CVE-2023-3019 CVE-2023-3301 CVE-2023-3255 CVE-2023-5088 CVE-2023-6683 CVE-2023-6693 CVE-2024-2494	8.0.0-23.1.0.1.al8
qemu-kvm	CVE-2021-3750 CVE-2023-3019 CVE-2023-3301 CVE-2023-3255 CVE-2023-5088 CVE-2023-6683 CVE-2023-6693 CVE-2024-2494	6.2.0-49.0.1.al8
libX11	CVE-2023-43785 CVE-2023-43786 CVE-2023-43787 CVE-2023-3138	1.7.0-9.al8
libxml2	CVE-2023-39615 CVE-2024-25062	2.9.7-18.0.3.al8
libXpm	CVE-2023-43788 CVE-2023-43789	3.5.13-10.0.1.al8
linux-firmware	CVE-2022-46329 CVE-2023-20569 CVE-2023-20592	20240111-121.gitb3132c18.al8
motif	CVE-2023-43788 CVE-2023-43789	2.3.4-20.al8
openchange	CVE-2022-2127 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968	2.3-32.0.1.al8
opensc	CVE-2023-40660 CVE-2023-40661 CVE-2023-5992 CVE-2023-2977	0.20.0-7.0.1.al8
openssh	CVE-2023-51385	8.0p1-20.0.1.al8
openssl	CVE-2023-3446 CVE-2023-3817 CVE-2023-5678	1.1.1k-12.0.1.al8
pam	CVE-2024-22365	1.3.1-28.al8
pcp	CVE-2024-3019	5.3.7-20.0.1.al8
perl-HTTP-Tiny	CVE-2023-31486	0.074-2.0.1.al8.1
pixman	CVE-2022-44638	0.40.0-6.al8
pmix	CVE-2023-41915	3.2.3-5.al8
poppler	CVE-2020-36024	20.11.0-10.0.2.al8
postgresql-jdbc	CVE-2024-1597	42.2.14-3.al8
procps-ng	CVE-2023-4016	3.3.15-14.0.1.al8
protobuf-c	CVE-2022-48468	1.3.0-7.al8
python-cryptography	CVE-2023-23931	3.2.1-7.al8
python-dns	CVE-2023-29483	1.15.0-12.al8
python-pillow	CVE-2023-50447 CVE-2023-44271	5.1.1-20.al8
python-pip	CVE-2007-4559	9.0.3-23.0.1.al8.1
python3	CVE-2007-4559 CVE-2022-48560 CVE-2022-48564 CVE-2023-27043 CVE-2023-40217 CVE-2023-6597 CVE-2024-0450	3.6.8-62.0.1.2.al8
qt5-qtbase	CVE-2023-33285 CVE-2023-34410 CVE-2023-37369 CVE-2023-38197 CVE-2023-51714 CVE-2024-25580	5.15.3-5.0.3.al8
qt5-qtsvg	CVE-2023-32573	5.15.3-2.al8
rpm	CVE-2021-35937 CVE-2021-35938 CVE-2021-35939	4.14.3-27.0.5.2.al8
samba	CVE-2023-3961 CVE-2023-4091 CVE-2023-42669	4.18.6-3.0.1.1.al8
shadow-utils	CVE-2023-4641	4.6-19.0.1.al8
shim	CVE-2023-40546 CVE-2023-40547 CVE-2023-40548 CVE-2023-40549 CVE-2023-40550 CVE-2023-40551	15.8-2.0.1.1.al8
sqlite	CVE-2023-7104	3.26.0-19.al8
squashfs-tools	CVE-2021-40153 CVE-2021-41072	4.3-20.1.0.3.al8
sssd	CVE-2023-3758	2.9.4-3.al8
sudo	CVE-2023-28486 CVE-2023-28487 CVE-2023-42465	1.9.5p2-1.0.1.al8
sysstat	CVE-2023-33204	11.7.3-11.0.1.al8
tang	CVE-2023-1672	7-8.al8
tcpdump	CVE-2021-41043	4.9.3-4.0.1.al8
tigervnc	CVE-2023-5380 CVE-2023-6816 CVE-2024-0229 CVE-2024-21885 CVE-2024-21886 CVE-2024-31080 CVE-2024-31081 CVE-2024-31083	1.13.1-10.0.1.al8
tpm2-tss	CVE-2023-22745	2.3.2-5.0.2.al8
traceroute	CVE-2023-46316	2.1.0-6.2.0.3.al8
unbound	CVE-2024-1488	1.16.2-7.al8
util-linux	CVE-2024-28085	2.32.1-45.0.1.1.al8.1
webkit2gtk3	CVE-2014-1745 CVE-2023-32359 CVE-2023-39928 CVE-2023-40414 CVE-2023-41983 CVE-2023-42852 CVE-2023-42883 CVE-2023-42890 CVE-2024-23206 CVE-2024-23213	2.42.5-1.0.1.al8
wireshark	CVE-2023-0666 CVE-2023-2856 CVE-2023-2858 CVE-2023-2952	2.6.2-17.al8
xorg-x11-server	CVE-2023-1393 CVE-2024-31080 CVE-2024-31081 CVE-2024-31083	1.20.11-16.0.4.al8
xorg-x11-server-Xwayland	CVE-2022-3550 CVE-2022-3551 CVE-2022-4283 CVE-2022-46340 CVE-2022-46341 CVE-2022-46342 CVE-2022-46343 CVE-2022-46344 CVE-2023-0494 CVE-2023-1393 CVE-2023-5367 CVE-2023-6377 CVE-2023-6478 CVE-2023-6816 CVE-2024-0229 CVE-2024-0408 CVE-2024-0409 CVE-2024-21885 CVE-2024-21886	22.1.9-5.al8
yajl	CVE-2023-33460	2.1.0-12.0.1.al8
zziplib	CVE-2020-18770	0.13.71-11.al8
buildah	CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180 CVE-2024-28176	1.33.7-2.al8
cockpit-podman	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	84.1-1.al8
conmon	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	2.1.10-1.al8
container-selinux	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	2.229.0-2.al8
containernetworking-plugins	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	1.4.0-2.0.1.al8
containers-common	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	1-81.0.1.al8
criu	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	3.18-5.0.1.al8
fuse-overlayfs	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	1.13-1.0.1.al8
podman	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180 CVE-2024-28176	4.9.4-3.0.1.al8
runc	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	1.1.12-1.0.1.al8
slirp4netns	CVE-2022-27191 CVE-2022-2989 CVE-2022-3064 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-25173 CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2023-29400 CVE-2023-29406 CVE-2023-3978 CVE-2024-21626 CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	1.2.3-1.al8
libslirp	CVE-2018-25091 CVE-2021-33198 CVE-2021-34558 CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-39326 CVE-2023-45287 CVE-2023-45803 CVE-2023-48795 CVE-2024-1753 CVE-2024-23650 CVE-2024-24786 CVE-2024-28180	4.4.0-2.al8

Package updates

New features

The elastic Remote Direct Memory Access (eRDMA) feature is enabled for rdma-core.
rasdaemon now supports memory Correctable Error (CE) isolation.
nginx now uses OpenSSL 3.
aliyun-cli is upgraded to version 3.0.210.

Important updates

Kernel

The kernel is upgraded to version 5.10.134-17.2.al8.

New features

Support is added for fuse failover. This feature provides native kernel-level fuse fault recovery to ensure uninterrupted file access for users.
Support is added for dynamic kernel preemption. This feature aligns with the upstream community's design and lets users switch the preemption model using cmdline or sysfs. The available models are none and voluntary. The full model is not currently supported.
perf is enhanced to support perf metrics for Coherent Mesh Network (CMN) and Double Data Rate (DDR) Performance Monitoring Units (PMUs).
New BPF features
- New BPF helpers are added.
  - bpf_for_each_map_elem: A helper to traverse BPF maps.
  - bpf_snprintf: A helper for string formatting.
  - bpf_timer: A timer that can trigger a callback function after a specified time.
  - bpf_loop: A helper that removes the limitation of constant-bounded loops, allowing for flexible loop creation.
  - bpf_strncmp: A helper for string comparison.
  - bpf_ktime_get_tai_ns: A helper to get the time of the CLOCK_TAI type.
  - bpf_skb_load_bytes: Support for the raw_tp type is added. This lets you read skb data, including non-linear data, in raw_tp type programs.
- The arm64 architecture now supports attaching trampoline-related features, such as fentry, fexit, fmod_ret, and bpf_lsm. This provides more powerful tracing, diagnostics, and security capabilities.
- bpf_trampoline can now coexist with livepatch.
Support is added for virtio-net features.
- Support is added for virtio-net device statistics. The kernel can now obtain device statistics, which improves fault location and issue diagnosis.
- A queue reset feature is introduced. This feature lets you adjust the size of virtual machine queues to reduce packet loss and optimize latency.
- Dynamic interrupt moderation (netdim) is added. This feature intelligently adjusts interrupt aggregation parameters based on real-time traffic to optimize data reception performance.
- virtio checksum is optimized. This fixes an issue where virtio network interface cards performed checksum validation under specific feature controls. When you use eXpress Data Path (XDP) applications, you no longer need to re-validate the checksum in the guest operating system. This significantly reduces CPU utilization.
The EROFS on-demand loading mode now supports failover.
An issue with O_DIRECT + O_SYNC semantics in ext4 is fixed. This issue has existed since the introduction of the iomap framework. It occurred because `generic_write_sync()` was called within the iomap framework, but `i_disksize` was updated after `iomap_dio_rw()`. In append-write scenarios, this caused the on-disk file length to not be updated promptly. As a result, written data could not be read after an unexpected power failure.
The XFS file system now supports the delayed inode invalidation feature. This feature moves reclamation operations to a background kworker process. This reduces stuttering in foreground applications caused by delete operations.
fuse-related support is added.
- Support is added for shared memory mapping (shared mmap) in `cache=none` mode.
- A dynamic switch for the strict limit feature is added. The fuse module sets a strict limit, which can cause slow write-backs or even stuttering in certain scenarios. This new sysfs knob lets you dynamically resolve such issues.
kernfs global lock contention is optimized to reduce the impact of increased load average caused by concurrent access from monitoring programs.
Group Identity-related features are added.
The fine-grained priority feature is provided for Group Identity 2.0.
- In Shared Memory Communications over RDMA (SMC-R) + eRDMA application scenarios, support is added for the smc_pnet feature.
- Reachability checks in Shared Memory Communications (SMC) + eRDMA scenarios are optimized to fix a low-probability kernel crash issue.
The CPU share ratio for Group Identity 2.0 is calibrated.
The `force idled time` metric for Group Identity 2.0 is added.
Group Identity is optimized to enhance load control for tasks with different priorities.
Basic features for Group Balancer are provided.
- Support is added for passing zero-length iovec in rafsv6 mode.
- In rafsv6 mode, the reclamation of dax mappings is allowed to avoid issues such as OOM and fuse hangs caused by pinning.
- kconfig is used to restrict rafsv6 for use only in secure container scenarios.
Optimizations and support for SMC.
A timeout mechanism is added for the control vq in virtio. This prevents the virtual machine CPU from continuous high-load polling when a device is unresponsive. The default timeout is 7 days.
A feature to isolate slab memory used by out-of-tree (OOT) modules is added. This helps to delimit problems after an OOT module corrupts memory.
A fast OOM feature is added to prevent long periods of machine unresponsiveness due to memory pressure in multi-core, large-memory environments. This feature helps services increase memory deployment density and improves the performance stability of online services during high-watermark runtime.
Support and optimizations for EROFS.
xfs now supports fsdax reflink and dedupe. It includes specific optimizations for Tair PMEM instances, such as ensuring the continuity of snapshot source files, improving dirty page write-back efficiency, and removing the dependency on the reverse map btree to optimize page fault latency.
Support is added for cgroup writeback to fix an issue where memory cgroups were not released for a long time when lazytime was enabled. This issue could cause the number of memory cgroups to remain high in containerized environments, consuming memory and leading to high system time when traversing cgroups.
cgroup v2 IO Service Level Indicators (SLIs) are provided. IO SLIs are added for blkio cgroup v2, including wait time, service time, complete time, io queued, and bytes queued.
In extreme cases, when supporting 2 MB IO, each bio_vec contains only one 4 KB page. Therefore, the current 5.10 kernel can support a maximum of 1 MB IO. The additional splitting logic might affect performance in some scenarios.
An ABBA deadlock issue caused by a race condition when setting blk-iocost QoS is fixed.
The tcmu_loop device now supports configurable parameters, including `can_queue`, `nr_hw_queues`, `cmd_per_lun`, and `sg_tablesize`. When the backend device is powerful enough, increasing these parameters can significantly improve performance.

Image updates

Operating system images
- The `spec_rstack_overflow=off` boot parameter is added.
- The `kfence.sample_interval=100 kfence.booting_max=0-2G:0,2G-32G:2M,32G-:32M` boot parameter is added.
- `net.ipv4.tcp_retries2` is changed to 8.
- `net.ipv4.tcp_syn_retries` is changed to 4.
- The NTP server configuration for classic networks is removed.
Container image
alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3:3.2104U10

Fixed issues

Kernel
- A linked list corruption issue caused by incorrect scheduling of the `credits_announce_work` work element in the smc kernel module is fixed.
- A race condition in `perf_cgroup_switch` is fixed.
- An issue where the `Queue other time` statistic for Group Identity 2.0 could be negative is fixed.
- A runtime statistics issue in `cfs_rq` is fixed.
- An issue where `cfs_rq->core` could be NULL is fixed.
- Sound card-related drivers (CONFIG_SND) are enabled.
- A kernel breakdown caused by kfence when cgroup kmem statistics counting was enabled is fixed.
- Issues related to the LoongArch architecture are fixed.
- Stability issues in EROFS compression mode are fixed.
- Stability issues for EROFS over fscache are fixed.
- Stability issues related to SMC are fixed.
- A write-back performance degradation issue that occurred when a Backing Device Info (BDI) used the STRICTLIMIT feature and its share was 0 is fixed.
- A seccomp memory leak is fixed.
- An issue where user operations could lead to an incorrect reference count for ZERO_PAGE is fixed.
- A potential recursive memory reclamation issue in TCMU is fixed.
- A kernel crash that occurred when the ioasids subsystem migrated kernel threads is fixed.
- An issue of duplicate I/O statistics when no rate-limiting rules were configured is fixed.
- An issue where unexpected hardware signal hangs occurred during frequent communication between Phytium S2500 and certain Baseboard Management Controller (BMC) chips in a short period is fixed.
- A kernel panic that occurred when Group Identity and core scheduling were enabled at the same time is fixed.
- The rate-limiting mechanism for Completely Fair Scheduler (CFS) bandwidth control is changed from synchronous to asynchronous mode. This optimizes bandwidth control efficiency in scenarios with many CPUs.
- A potential race condition when disabling the main switch for core scheduling is fixed.
- An issue of inaccurate Sibling Idle (SIB Idle) statistics under high Interrupt Request (IRQ) load is fixed.
- Patches from newer versions of NVMe over RDMA are backported to improve system stability.
- A deadlock hang that occurred when `nvme_reset` and `nvme_rescan` were executed concurrently is fixed.
- A kernel crash caused by a Use-After-Free (UAF) issue triggered by the PCIe driver's Active State Power Management (ASPM) is fixed.
- A screen corruption issue on monitors connected to AST2600 graphics devices on Phytium S5000C is fixed.
- A warning caused by asynchronous unthrottle is fixed to prevent a scheduling deadlock triggered by the warning.
- CVE-2023-52445
- CVE-2023-6817
- CVE-2024-0646
- CVE-2023-20569
- CVE-2023-51042
- CVE-2023-6915
- CVE-2023-6546
- CVE-2022-38096
- CVE-2024-0565
- CVE-2024-26589
- CVE-2024-23307
- CVE-2024-22099
- CVE-2024-24860
- CVE-2024-1086
- CVE-2023-51779
- CVE-2024-26597
- CVE-2024-24855
- CVE-2023-52438
- CVE-2023-4622
- CVE-2023-6932
- CVE-2023-20588
- CVE-2023-5717
- CVE-2023-6931
- CVE-2023-28464
- CVE-2023-39192
- CVE-2023-6176
- CVE-2023-45863
- CVE-2023-5178
- CVE-2023-45871
- CVE-2023-4155
- CVE-2023-20593
- CVE-2023-3567
- CVE-2023-3358
- CVE-2023-0615
- CVE-2023-31083
- CVE-2023-4015
- CVE-2023-42753
- CVE-2023-4623
- CVE-2023-4921
- CVE-2023-2860
- CVE-2023-1206
- CVE-2023-3772
- CVE-2023-42755
- CVE-2023-3863
- CVE-2022-3114
- CVE-2023-31085
- CVE-2023-4132
- CVE-2022-3424
- CVE-2022-3903
- CVE-2022-45887
- CVE-2023-3006
- CVE-2023-42754
- CVE-2023-0160
Images
- The debuginfo repository names are unified. You can now directly use the command dnf debuginfo-install <package_name> to install the corresponding debuginfo.
- The active interval for the dnf-makecache service has been extended from 1 hour to 1 day to reduce its impact on disk and network resources.
- The virtio_blk module is now in-tree in the kernel. Therefore, its related configuration has been removed from initramfs.
Package
A bug in dnf-plugin-releasever-adapter that could cause dnf commands to fail is fixed.

Alibaba Cloud Linux 3.2104 U9.1

Version number	Image ID	Release date	Release notes
Alibaba Cloud Linux 3.2104 U9.1	aliyun_3_x64_20G_alibase_20240528.vhd	2024-05-28	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Updated the kernel version to 5.10.134-16.3.al8.x86_64. Content updates: For more information, see Content updates.
Alibaba Cloud Linux 3.2104 U9.1	aliyun_3_arm64_20G_alibase_20240528.vhd	2024-05-28	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit for ARM` base image to the latest software version. Updated the kernel version to 5.10.134-16.3.al8.aarch64. Content updates: For more information, see Content updates.

Content updates

Security updates

Package name	CVE ID	Package version
kernel	CVE-2024-22099 CVE-2024-24860 CVE-2024-1086 CVE-2023-51779 CVE-2024-26597 CVE-2024-24855 CVE-2023-52438 CVE-2023-4622 CVE-2023-6932 CVE-2023-20588 CVE-2023-5717 CVE-2023-6931 CVE-2023-28464 CVE-2023-39192 CVE-2023-6176 CVE-2023-45863 CVE-2023-5178 CVE-2023-45871	5.10.134-16.3.al8
bind	CVE-2022-3094	9.11.36-11.0.1.al8
buildah	CVE-2023-25173 CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400	1.31.3-1.al8
dnsmasq	CVE-2023-28450	2.79-31.0.1.al8
edk2-20220126gitbb1bba3d77	CVE-2019-14560	6.0.2.al8
frr	CVE-2023-38406 CVE-2023-38407 CVE-2023-47235 CVE-2023-47234	7.5.1-16.0.2.al8
grafana	CVE-2023-3128 CVE-2023-39325 CVE-2023-44487	9.2.10-7.0.1.al8
grafana	CVE-2024-1394	9.2.10-7.0.1.al8
grafana-pcp	CVE-2024-1394	5.1.1-1.0.1.al8
gstreamer1-plugins-bad-free	CVE-2023-44429	1.22.1-2.0.1.al8
tigervnc	CVE-2023-44446	1.13.1-2.al8
unbound	CVE-2023-50387 CVE-2023-50868	1.16.2-6.al8
webkit2gtk3	CVE-2023-42917	2.40.5-1.0.2.al8.1
glibc	CVE-2024-2961	2.32-1.16.al8
python2-setuptools	CVE-2022-40897	39.0.1-13.1.module+al8+9+77049424

Package updates

Package name	Published version
cloud-init	23.2.2
container-selinux	2.229.0
ethtool	6.6
iproute	6.2.0
iptables	1.8.5
keentuned	2.4.0
keentune-target	2.4.0
rng-tools	6.16
sssd	2.9.1
sudo	1.9.5p2
sysak	2.4.0

Important updates

Kernel updates
- The kernel is upgraded to 5.10.134-16.3.al8.
- Support is added for the smc_pnet feature in SMC-R + elastic Remote Direct Memory Access (eRDMA) scenarios.
- Support is added for HWDRC, an RDT-based dynamic memory bandwidth control technology. This allows for more precise control over resources such as memory bandwidth and cache.
- Group Identity is optimized to enhance payload control for tasks with different priorities.
New package features
- aliyun-cli is upgraded to 3.0.204. You can now use the `yum` or `dnf` command to install and update aliyun-cli.
- cloud-init is upgraded to 23.2.2. It now supports accessing instance metadata in hardened mode.
- ethtool is upgraded to 6.6. It now supports the CMIS protocol.
- sysak is upgraded to 2.4.0. This version optimizes diagnostic features, provides node monitoring, adds node-side support for sysom observability features, and fixes some bugs.
- keentune is upgraded to 2.4.0.

Image updates

Container images
- alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3:3.9.1
- alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3:latest
  Note
  After this release, the `latest` tag no longer pulls the 3.9.1 image version.
Virtual machine images
The image type is switched to UEFI-Preferred. It now supports a dual-boot mode with UEFI and Legacy.

Fixed issues

Kernel
- A stability issue in the erofs compression mode is fixed.
- A stability issue with erofs over fscache is fixed.
- SMC-related stability issues are fixed.
- A write back performance degradation issue that occurred when a BDI used the STRICTLIMIT attribute and its share was set to 0 is fixed.
- A seccomp memory leak is fixed.
- An issue where user operations could cause an incorrect reference count for ZERO_PAGE is fixed.
- A potential memory recursion revoke issue in TCMU is fixed.
- A kernel crash that occurred when the ioasids subsystem migrated a kernel thread is fixed.
- An issue of duplicate I/O statistics when no traffic-limiting rules were configured is fixed.
- An issue where frequent communication between Phytium S2500 and certain BMC chips in a short period caused an unexpected hardware signal hang is fixed.
- A kernel panic that occurred when Group Identity and core scheduling were enabled at the same time is fixed.
- The CFS bandwidth control throttling release is changed from synchronous to asynchronous. This optimizes bandwidth control efficiency in scenarios with many CPUs.
- A potential race condition that occurred when disabling the main switch for core scheduling is fixed.
- An issue of inaccurate sibidle statistics in high IRQ scenarios is fixed.
Image
An issue where installing a different kernel version did not take effect after a restart is fixed.

2023

Alibaba Cloud Linux 3.2104 U9

Version number	Image ID	Release date	Release content
Alibaba Cloud Linux 3.2104 U9	aliyun_3_9_x64_20G_alibase_20231219.vhd	2023-12-19	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Updated the kernel to version 5.10.134-16.1.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_9_arm64_20G_alibase_20231219.vhd	2023-12-19	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit for ARM` base image to the latest software version. Updated the kernel to version 5.10.134-16.1.al8.aarch64. Content updates: For more information, see Content updates.
	aliyun_3_9_x64_20G_uefi_alibase_20231219.vhd	2023-12-19	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit UEFI Edition` base image to the latest software version. Updated the kernel to version 5.10.134-16.1.al8.x86_64. Content updates: For more information, see Content updates.

Content updates

Security updates

Package name	CVE number	Package version
kernel	CVE-2022-3108 CVE-2022-3114 CVE-2022-3424 CVE-2022-36280 CVE-2022-3903 CVE-2022-39188 CVE-2022-41850 CVE-2022-42432 CVE-2022-4379 CVE-2022-4382 CVE-2022-45887 CVE-2023-0045 CVE-2023-0160 CVE-2023-0458 CVE-2023-0459 CVE-2023-0615 CVE-2023-1078 CVE-2023-1206 CVE-2023-1382 CVE-2023-1670 CVE-2023-1829 CVE-2023-1855 CVE-2023-1859 CVE-2023-1989 CVE-2023-1990 CVE-2023-2002 CVE-2023-2006 CVE-2023-20569 CVE-2023-20593 CVE-2023-20928 CVE-2023-20938 CVE-2023-2124 CVE-2023-2156 CVE-2023-2162 CVE-2023-2177 CVE-2023-2194 CVE-2023-22995 CVE-2023-2483 CVE-2023-26607 CVE-2023-28327 CVE-2023-2860 CVE-2023-2985 CVE-2023-3006 CVE-2023-30772 CVE-2023-3090 CVE-2023-31083 CVE-2023-31084 CVE-2023-31085 CVE-2023-3111 CVE-2023-3117 CVE-2023-31248 CVE-2023-3161 CVE-2023-3212 CVE-2023-3220 CVE-2023-32269 CVE-2023-3268 CVE-2023-33288 CVE-2023-3358 CVE-2023-35001 CVE-2023-3567 CVE-2023-35788 CVE-2023-35823 CVE-2023-35824 CVE-2023-35825 CVE-2023-35828 CVE-2023-35829 CVE-2023-3609 CVE-2023-3610 CVE-2023-3611 CVE-2023-3772 CVE-2023-3773 CVE-2023-3776 CVE-2023-3812 CVE-2023-3863 CVE-2023-4004 CVE-2023-4015 CVE-2023-40283 CVE-2023-4128 CVE-2023-4132 CVE-2023-4147 CVE-2023-4155 CVE-2023-42753 CVE-2023-42754 CVE-2023-42755 CVE-2023-4563 CVE-2023-4623 CVE-2023-4921	5.10.134-16.1.al8
java-1.8.0-openjdk	CVE-2022-40433 CVE-2023-22067 CVE-2023-22081	1.8.0.392.b08-4.0.3.al8
java-11-openjdk	CVE-2023-22081	11.0.21.0.9-2.0.3.al8
mariadb	CVE-2022-32081 CVE-2022-32082 CVE-2022-32084 CVE-2022-32089 CVE-2022-32091 CVE-2022-38791 CVE-2022-47015 CVE-2023-5157	10.5.22-1.0.1.al8
open-vm-tools	CVE-2023-34058 CVE-2023-34059	12.2.5-3.al8.1
bind	CVE-2023-3341	9.11.36-8.al8.2
dmidecode-doc	CVE-2023-30630	3.3-5.0.2.al8
frr	CVE-2023-38802	7.5.1-8.0.1.al8
ghostscript	CVE-2023-28879 CVE-2023-38559 CVE-2023-4042 CVE-2023-43115	9.54.0-14.al8
glibc	CVE-2023-4911	2.32-1.12.al8
grafana	CVE-2023-39325 CVE-2023-44487	7.5.15-5.0.1
libvpx	CVE-2023-44488 CVE-2023-5217	1.7.0-10.0.1.al8
linux-firmware	CVE-2023-20593	20230404-117.git2e92a49f.al8
ncurses	CVE-2023-29491	6.1-10.20180224.0.1.al8
nghttp2	CVE-2023-44487	1.33.0-4.0.1.al8.1
qemu-kvm seabios	CVE-2022-40284 CVE-2023-3354	6.2.0-33.0.2.al8 1.16.0-4.al8
tracker-miners	CVE-2023-5557	3.1.2-4.0.1.al8

Package updates

Package name	Published Version
ca-certificates	2023.2.60_v7.0.306
firewalld	0.9.11
java-1.8.0-openjdk	1.8.0.392.b08
java-11-openjdk	11.0.21.0.9
libbpf	0.6.0
lz4	1.9.4
mariadb	10.5.22
nmstate	2.2.15
nspr	4.35.0
nss	3.90.0
open-vm-tools	12.2.5
openscap	1.3.8
scap-security-guide	0.1.69
sos	4.6.0
xz	5.4.4

Important updates

Kernel

New features
- Support is added for core scheduling.
  The core scheduling security feature is backported from the upstream community. This feature ensures that only trusted processes in the same group can run on the hyper-threads of the same physical core. This feature is incompatible with group identity. Do not enable them at the same time. This feature is disabled by default. To enable it, you can run the sysctl -w kernel.sched_core=1 command.
- Support is added for the eBPF trampoline feature on Arm64.
  The eBPF trampoline feature on Arm64 is backported to support the bpf struct ops feature. Note: The bpf fentry features are still unavailable because the related ftrace features for Arm64 have not been backported.
- Support is added for the multi-generational LRU (mglru) feature.
  The mglru feature improves memory page reclamation. In big data scenarios, it improves the speed and accuracy of memory reclamation and enhances end-to-end (e2e) performance.
- Support is added for batch TLB flushing.
  The batch migration feature implements batch Translation Lookaside Buffer (TLB) flushing and page copy operations during memory page migration. This improves the performance of kernel page migration.
  This version refactors and optimizes the original batch migration feature based on upstream code. The main changes include removing the `batch_migrate` cmdline parameter and the /sys/kernel/mm/migrate/batch_migrate_enabled interface. Batch migration is now the default configuration for page migration.
  The `/sys/kernel/mm/migrate/dma_migration_min_pages` interface is added, with a default value of 32. This interface applies only when the DMA page copy feature is enabled. The DMA page copy feature is used only when /sys/kernel/mm/migrate/dma_migrate_enabled is enabled and the number of migrated pages reaches the value set in /sys/kernel/mm/migrate/dma_migration_min_pages.
- The Cachestat feature
  The cachestat system call is introduced in the kernel. This system call lets you view detailed page cache statistics for a specified file.
- RAS event triggering in kernel mode for Arm64 is enhanced.
  Error recovery capabilities are added for Reliability, Availability, and Serviceability (RAS) issues in various scenarios, such as `copy_{from/to}_user`, `{get/put}_user`, Copy on Write (COW), and pagecache reading.
- Support is added for the SMC-D loopback feature (self-developed).
  The Shared Memory Communications over RDMA, Direct Memory Access (SMC-D) loopback feature is introduced to accelerate TCP communication between local processes and containers.
- Support is added for binding page tables to CPU cores and statistics are provided for cross-die page tables (self-developed).
  The ability to bind page tables to CPU cores allows the page tables of Quality of Service (QoS)-sensitive services to be allocated to the current Non-Uniform Memory Access (NUMA) node when memory is under pressure. This reduces memory access latency and enables faster, more efficient memory access.
- The code multi-copy feature is enhanced (self-developed).
  An asynchronous task is used to retry applying code multi-copy if it fails during process startup. The `memory.duptext_nodes` kernel interface is added to restrict memory allocation nodes for duptext.
- kfence is enhanced (self-developed).
  - A self-developed enhanced kfence feature is added for the Arm64 architecture. It allows kfence to be dynamically enabled or disabled and captures all memory corruption issues, supporting both online detection and offline debugging.
  - A feature is added that immediately triggers a system crash when a memory issue is captured. This helps developers better analyze issues in a debugging environment. To enable this feature, set the boot cmdline "kfence.fault=panic" or run echo panic > /sys/module/kfence/parameters/fault. The default value is report, which only outputs logs without crashing the system.
- A memcg THP control interface is provided (self-developed).
  A memory cgroup (memcg) Transparent Enormous Pages (THP) control interface is provided to disable THP requests for specified memcgs.
- Support is added for ACPU (Assess CPU) (self-developed).
  ACPU can collect statistics on the idle time of the hyper-threading (HT) peer when a task is running and provides per-cgroup statistics. This can be used to evaluate hardware resource competition on shared CPU cores during task execution.
- Support is added for the HT-aware-quota feature (self-developed).
  This is a computing power stabilization solution based on Completely Fair Scheduler (CFS) bandwidth control and core scheduling. In mixed deployment scenarios, it calibrates the quota by detecting whether the hyper-threading (HT) peer is idle. This ensures that tasks receive relatively stable computing power in each scheduling cycle. It is suitable for compute-intensive tasks.
- Support is added for group identity 2.0 (self-developed).
  A cgroup-level SCHED_IDLE feature is introduced. You can set the scheduling policy of a target cgroup to SCHED_IDLE by setting its `cpu.idle` property. This is suitable for batch management of offline tasks.
Behavior changes
- Module signing
  Signing for kernel modules is added. This helps developers identify and reject unsigned kernel modules.
- Spectre-BHB and Variant 4 vulnerability fixes are disabled by default on Arm64.
  Analysis shows that the Spectre-BHB and Variant 4 vulnerabilities have been addressed by fixing the Spectre v2 security vulnerability, disabling unprivileged eBPF, using Site-Isolation technology, and disabling SharedArrayBuffer. No additional fixes for Spectre-BHB and Variant 4 are needed. Therefore, the `nospectre_bhb ssbd=force-off` parameters are added to the default cmdline for Arm64. This reduces unnecessary overhead and improves performance while ensuring security.
- TDX guest configurations are enabled to support TDX confidential VM scenarios.

New package features

erofs-utils-1.7.1 is provided through the software repository.
erofs-utils is a tool for creating, checking, and compressing EROFS. It supports compression algorithms such as LZ4, LZMA, and DEFLATE, and supports converting tar files to the EROFS format.
stress-ng-0.15.00 is provided through the software repository.
alibaba-cloud-compiler-13.0.1.4 is provided through the software repository.
Alibaba Cloud Compiler is a C/C++ compiler developed by Alibaba Cloud. It is based on the open-source Clang/LLVM-13 community version and inherits all options and parameters from the open-source version. In addition, Alibaba Cloud Compiler is deeply optimized for Alibaba Cloud infrastructure, providing unique features and optimizations to offer a better C/C++ compiler experience for Alibaba Cloud users.
A patch is added to glibc to support GB18030-2022 encoding.
Dragonwell 17 is updated to 17.0.9.0.10.9: The JIT compiler improves inlining performance by removing the logic that bases inlining decisions on the absolute number of calls.
Dragonwell 8 is updated to 8.15.16.372: Supports multiple coroutines waiting for read and write events on the same socket and fixes a bug in okhttp scenarios.
plugsched-1.3 is provided through the software repository.
plugsched is an SDK for scheduler hot upgrades. It is intended for kernel scheduler developers. Users can install this tool to develop scheduler modules.
sysak is updated to 2.2.0: An application observation feature is added that supports metric observation and diagnosis for MySQL and Java applications. Monitoring metrics related to container monitoring and cluster monitoring are added. A local monitoring feature is added.
keentune is updated to 2.3.0: x264/265 related scripts are updated to support the latest ffmpeg. The CPU core binding issue for XPS and RPS is fixed. The default elastic Remote Direct Memory Access (eRDMA) settings in the profile are updated.
The software chain for Intel QAT, DLB, and IAA accelerators is updated: Bugs in the QAT driver are fixed, the DLB driver is upgraded, bugs in the user-mode components of QAT and IAA are fixed, and a unified management solution for user-mode DMA memory across architectures is added.
smc-tools is updated: The `smc-ebpf` command is added. This command supports controlling the effective scope of `smc_run` at the port granularity. The control mode supports whitelist and blacklist modes, along with intelligent scheduling.

Fixed issues

An issue where netfilter-related features were unavailable because RPM packages such as kernel-modules-extra and kernel-modules-internal were not automatically installed during a kernel update is fixed.
An issue where the /proc/sys/kernel/sched_group_identity_enabled interface sometimes could not be disabled is fixed. This was caused by incorrect reference counting for group identity during cgroup creation and deletion.

Image updates

Container images
- alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3:3.9
- alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3:latest
  Note
  After the new version is released, you can no longer use the `latest` tag to pull the image for version 3.9.
Virtual machine images
- The rpmdb format is switched to sqlite by default.
- The keentune service is installed but not enabled by default.
- The nfs-server service is not started by default.

Known issues

The kdump service may not work correctly on ecs.g6r.large instances due to memory size. Adjusting the crash parameter, for example, to `0M-2G:0M,2G-128G:256M,128G-:384M`, can prevent this issue.
On an NFSv3 file system, if you add the S permission to a file and then change the file's owner under specific conditions, the S permission of the group is lost.
The patch to fix this issue is 2d8ae8c417("db nfsd: use vfs setgid helper"). However, the helper functions required for the fix have significant code changes compared with the 5.10 kernel version. Therefore, this is a known issue and the fix is postponed.
After you replace TCP with SMC, netperf tests may exit prematurely.
SMC uses a fixed-size ring buffer. During sending, the remaining buffer space may be smaller than the data size specified by `send()`. In this case, SMC returns the number of bytes that can be sent, which is usually less than the amount specified by the user in `send()`. In netperf, this behavior is considered an error, which causes it to exit. The upstream maintainer strongly recommends keeping the current design to avoid connection stalled issues. Therefore, this issue will not be fixed.

Alibaba Cloud Linux 3.2104 U8

Version number	Image ID	Release date	Release content
Alibaba Cloud Linux 3.2104 U8	aliyun_3_arm64_20G_alibase_20230731.vhd	2023-07-31	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit for ARM` base image to the latest software version. Updated the kernel to version 5.10.134-15.al8.aarch64. Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_alibase_20230727.vhd	2023-07-27	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Updated the kernel to version 5.10.134-15.al8.x86_64. Content updates: For more information, see Content updates.
	aliyun_3_x64_20G_qboot_alibase_20230727.vhd	2023-07-27	Added the `Alibaba Cloud Linux 3.2104 64-bit Quick Launch Edition` image. This image is created based on the aliyun_3_x64_20G_alibase_20230727.vhd version of the `Alibaba Cloud Linux 3.2104 64-bit` base image. Updated the kernel to version 5.10.134-15.al8.x86_64.
	aliyun_3_x64_20G_uefi_alibase_20230727.vhd	2023-07-27	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit UEFI Edition` image to the latest software version. This image is created based on the aliyun_3_x64_20G_alibase_20230727.vhd version of the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image. The boot mode is switched to UEFI and only this mode is supported. Updated the kernel to version 5.10.134-15.al8.x86_64.

Content updates

Security updates

Package name	CVE number	Package version
ctags	CVE-2022-4515	5.8-23.0.1.al8
gssntlmssp	CVE-2023-25563 CVE-2023-25564 CVE-2023-25565 CVE-2023-25566 CVE-2023-25567	1.2.0-1.0.1.al8
libtar	CVE-2021-33643 CVE-2021-33644 CVE-2021-33645 CVE-2021-33646	1.2.20-17.0.1.al8
device-mapper-multipath	CVE-2022-41973	0.8.4-37.0.1.al8
postgresql-jdbc	CVE-2022-41946	42.2.14-2.al8
freerdp	CVE-2022-39282 CVE-2022-39283 CVE-2022-39316 CVE-2022-39317 CVE-2022-39318 CVE-2022-39319 CVE-2022-39320 CVE-2022-39347 CVE-2022-41877	2.2.0-10.0.1.al8
tigervnc	CVE-2022-4283 CVE-2022-46340 CVE-2022-46341 CVE-2022-46342 CVE-2022-46343 CVE-2022-46344	1.12.0-15.al8
xorg-x11-server	CVE-2022-3550 CVE-2022-3551 CVE-2022-4283 CVE-2022-46340 CVE-2022-46341 CVE-2022-46342 CVE-2022-46343 CVE-2022-46344 CVE-2023-0494	1.20.11-15.0.1.al8
poppler	CVE-2022-38784	20.11.0-6.0.1.al8
wayland	CVE-2021-3782	1.21.0-1.al8
net-snmp	CVE-2022-44792 CVE-2022-44793	5.8-27.0.1.al8
dhcp	CVE-2022-2928 CVE-2022-2929	4.3.6-49.0.1.al8
python-mako	CVE-2022-40023	1.0.6-14.al8
curl	CVE-2023-27535	7.61.1-30.0.2.al8.2
go-toolset golang	CVE-2023-29402 CVE-2023-29403 CVE-2023-29404 CVE-2023-29405	1.19.10-1.al8 1.19.10-1.0.1.al8
dnsmasq	CVE-2023-28450	2.79-27.al8
qt5	CVE-2022-25255	5.15.3-1.0.1.al8
autotrace	CVE-2022-32323	0.31.1-55.al8
bind	CVE-2023-2828	9.11.36-8.al8.1
libnbd libtpms libvirt nbdkit qemu-kvm supermin virt-v2v	CVE-2021-46790 CVE-2022-3165 CVE-2022-30784 CVE-2022-30786 CVE-2022-30788 CVE-2022-30789 CVE-2023-1018	libnbd-1.6.0-5.0.1.al8 libtpms-0.9.1-2.20211126git1ff6fe1f43.al8 libvirt-8.0.0-20.al8 nbdkit-1.24.0-5.al8 qemu-kvm-6.2.0-32.0.1.al8 supermin-5.2.1-2.0.2.al8 virt-v2v-1.42.0-22.al8
mysql	CVE-2022-21594 CVE-2022-21599 CVE-2022-21604 CVE-2022-21608 CVE-2022-21611 CVE-2022-21617 CVE-2022-21625 CVE-2022-21632 CVE-2022-21633 CVE-2022-21637 CVE-2022-21640 CVE-2022-39400 CVE-2022-39408 CVE-2022-39410 CVE-2023-21836 CVE-2023-21863 CVE-2023-21864 CVE-2023-21865 CVE-2023-21867 CVE-2023-21868 CVE-2023-21869 CVE-2023-21870 CVE-2023-21871 CVE-2023-21873 CVE-2023-21874 CVE-2023-21875 CVE-2023-21876 CVE-2023-21877 CVE-2023-21878 CVE-2023-21879 CVE-2023-21880 CVE-2023-21881 CVE-2023-21882 CVE-2023-21883 CVE-2023-21887 CVE-2023-21912 CVE-2023-21917	8.0.32-1.0.2.al8
ruby	CVE-2021-33621 CVE-2023-28755 CVE-2023-28756	2.7.8-139.0.1.al8
kernel	CVE-2021-33061 CVE-2021-3759 CVE-2022-3606 CVE-2022-36280 CVE-2022-3707 CVE-2022-39188 CVE-2022-4095 CVE-2022-41849 CVE-2022-42432 CVE-2022-4379 CVE-2022-4382 CVE-2022-4662 CVE-2022-4744 CVE-2022-47521 CVE-2022-47929 CVE-2023-0045 CVE-2023-0386 CVE-2023-0458 CVE-2023-0459 CVE-2023-0461 CVE-2023-0590 CVE-2023-0597 CVE-2023-1073 CVE-2023-1074 CVE-2023-1075 CVE-2023-1076 CVE-2023-1077 CVE-2023-1078 CVE-2023-1079 CVE-2023-1095 CVE-2023-1118 CVE-2023-1281 CVE-2023-1380 CVE-2023-1382 CVE-2023-1611 CVE-2023-1670 CVE-2023-1829 CVE-2023-1855 CVE-2023-1859 CVE-2023-1989 CVE-2023-1990 CVE-2023-2002 CVE-2023-20928 CVE-2023-20938 CVE-2023-2124 CVE-2023-2162 CVE-2023-2177 CVE-2023-2194 CVE-2023-2269 CVE-2023-22995 CVE-2023-23000 CVE-2023-23004 CVE-2023-2483 CVE-2023-25012 CVE-2023-26545 CVE-2023-26607 CVE-2023-28327 CVE-2023-28466 CVE-2023-2985 CVE-2023-30456 CVE-2023-30772 CVE-2023-3117 CVE-2023-31248 CVE-2023-31436 CVE-2023-3220 CVE-2023-32233 CVE-2023-32269 CVE-2023-3268 CVE-2023-33288 CVE-2023-35001 CVE-2023-35788 CVE-2023-35825	5.10.134-15.al8
webkit2gtk3	CVE-2023-32435 CVE-2023-32439	2.38.5-1.0.1.al8.5
libssh	CVE-2023-1667 CVE-2023-2283	0.9.6-7.al8
libssh	CVE-2023-1667 CVE-2023-2283	0.9.6-7.al8
open-vm-tools	CVE-2023-20867	12.1.5-2.al8
grafana	CVE-2022-2880 CVE-2022-27664 CVE-2022-39229 CVE-2022-41715	7.5.15-4.0.2.al8
grafana-pcp	CVE-2022-27664	3.2.0-3.0.1.al8
frr	CVE-2022-37032	7.5.1-7.0.1.al8
sqlite	CVE-2020-24736	3.26.0-18.al8
git-lfs	CVE-2022-2880 CVE-2022-41715 CVE-2022-41717	3.2.0-2.0.1.al8
sysstat	CVE-2022-39377	11.7.3-9.0.1.al8
python3	CVE-2023-24329	3.6.8-51.0.1.al8.1
c-ares	CVE-2023-32067	1.13.0-6.al8.2
cups-filters	CVE-2023-24805	1.20.0-29.0.1.al8.2
webkit2gtk3	CVE-2023-28204 CVE-2023-32373	2.38.5-1.0.1.al8.4
delve go-toolset golang	CVE-2023-24540	delve-1.9.1-1.0.1.al8 go-toolset-1.19.9-1.al8 golang-1.19.9-1.0.1.al8
kernel	CVE-2022-47929 CVE-2023-0386 CVE-2023-1075 CVE-2023-1380 CVE-2023-26545 CVE-2023-28466 CVE-2023-30456 CVE-2023-32233	5.10.134-14.1.al8
git	CVE-2023-22490 CVE-2023-23946 CVE-2023-25652 CVE-2023-25815 CVE-2023-29007	2.39.3-1.1.al8
apr-util	CVE-2022-25147	1.6.1-6.2.al8.1
webkit2gtk3	CVE-2023-2203	2.38.5-1.0.1.al8.3
edk2	CVE-2022-4304 CVE-2022-4450 CVE-2023-0215 CVE-2023-0286	20220126gitbb1bba3d77-4.al8
mingw-expat	CVE-2022-40674	2.4.8-2.al8

Package updates

Package name	Published Version
at	at-3.1.20-12.0.1.al8
audit	audit-3.0.7-2.0.1.al8.2
authselect	authselect-1.2.6-1.al8
bind	bind-9.11.36-8.al8.1
checkpolicy	checkpolicy-2.9-1.2.al8
cloud-utils-growpart	cloud-utils-growpart-0.33-0.0.1.al8
container-selinux	container-selinux-2.189.0-1.al8
coreutils	coreutils-8.30-13.al8
crypto-policies	crypto-policies-20221215-1.gitece0092.al8
cups	cups-2.2.6-51.0.1.al8
dbus	dbus-1.12.8-24.0.1.al8
ding-libs	ding-libs-0.6.1-40.al8
dnf	dnf-4.7.0-16.0.1.al8
dnf-plugins-core	dnf-plugins-core-4.0.21-14.1.al8
dracut	dracut-049-223.git20230119.al8
elfutils	elfutils-0.188-3.0.1.al8
emacs	emacs-27.2-8.0.3.al8.1
expat	expat-2.2.5-11.al8
file	file-5.33-24.al8
freetype	freetype-2.10.4-9.al8
fuse	fuse-2.9.7-16.al8
gmp	gmp-6.2.0-10.0.1.al8
gnupg2	gnupg2-2.2.20-3.al8
graphite2	graphite2-1.3.10-10.2.al8
grub2	grub2-2.02-148.0.1.al8
harfbuzz	harfbuzz-1.7.5-3.2.al8
hwdata	hwdata-0.314-8.16.al8
iproute	iproute-5.18.0-1.al8
iptables	iptables-1.8.4-24.0.1.al8
kernel	kernel-5.10.134-15.al8
kernel-hotfix-13383560-5.10.134-15	kernel-hotfix-13383560-5.10.134-15-1.0-20230724161633.al8
kexec-tools	kexec-tools-2.0.25-5.0.1.al8
kmod	kmod-25-19.0.2.al8
kpatch	kpatch-0.9.7-2.0.1.al8
libarchive	libarchive-3.5.3-4.al8
libffi	libffi-3.1-24.0.1.al8
libteam	libteam-1.31-4.0.1.al8
libuser	libuser-0.62-25.0.1.al8
libxml2	libxml2-2.9.7-16.0.1.al8
linux-firmware	linux-firmware-20230404-114.git2e92a49f.al8
logrotate	logrotate-3.14.0-6.0.1.al8
NetworkManager	NetworkManager-1.40.16-1.0.1.al8
nfs-utils	nfs-utils-2.3.3-59.0.2.al8
nftables	nftables-0.9.3-26.al8
oddjob	oddjob-0.34.7-3.0.1.al8
openssh	openssh-8.0p1-17.0.2.al8
openssl-pkcs11	openssl-pkcs11-0.4.10-3.0.1.al8
pam	pam-1.3.1-25.0.1.al8
pciutils	pciutils-3.7.0-3.0.1.al8
python-linux-procfs	python-linux-procfs-0.7.1-1.al8
python-rpm-generators	python-rpm-generators-5-8.al8
python-slip	python-slip-0.6.4-13.al8
rng-tools	rng-tools-6.15-3.0.1.al8
rpcbind	rpcbind-1.2.5-10.0.1.al8
rpm	rpm-4.14.3-26.0.1.al8
rsyslog	rsyslog-8.2102.0-13.al8
selinux-policy	selinux-policy-3.14.3-117.0.1.al8
setools	setools-4.3.0-3.al8
setup	setup-2.12.2-9.0.1.al8
sg3_utils	sg3_utils-1.44-6.0.1.al8
shared-mime-info	shared-mime-info-2.1-5.0.1.al8
sssd	sssd-2.8.2-2.0.1.al8
tpm2-tss	tpm2-tss-2.3.2-4.0.2.al8
unbound	unbound-1.16.2-5.al8
util-linux	util-linux-2.32.1-42.0.1.al8
virt-what	virt-what-1.25-3.al8
wget	wget-1.19.5-11.0.1.al8
which	which-2.21-18.0.1.al8
xfsprogs	xfsprogs-5.0.0-10.0.6.al8

Important updates

Kernel updates
- Upstream community updates
  - Support is added for managing subfunctions through devlink.
    A subfunction is a lightweight function. It is more lightweight than a PCIe virtual function. Unlike a virtual function, a subfunction is not an independent PCI device but shares the resources of its parent PCI device. However, a subfunction has all the resources related to network interface card communication, such as send queues, receive queues, and completion queues. In a Linux system, a subfunction is presented as a complete network interface card device. This update adds support for managing subfunctions on a network interface card through devlink. In conjunction with the driver, this lets you create, destroy, and query subfunctions on network interface cards that support them.
  - Support is added for the NVMe passthrough feature in io_uring.
    The overhead of complex storage stacks has a significant impact on latency and input/output operations per second (IOPS). The faster the storage device, the larger the proportion of this software stack overhead. Accessing NVMe disks requires passing through multiple abstraction layers, such as the file system, block layer, and NVMe driver, to reach the target device. This update backports the `uring_cmd` feature from the upstream v5.19 kernel. The actual file operations are passed to the kernel through io_uring. These operations are not parsed at the io_uring layer but are directly submitted to the NVMe driver layer, bypassing the file system and block layers. To support this feature, io_uring now supports the CQE32 data structure and the creation of NVMe character devices.
  - Support is added for fine-grained Persistent Reservation permission control for NVMe/SCSI.
    Previously, processes performing Persistent Reservation operations had to have the `CAP_SYS_ADMIN` capability, which prevented its use in some unprivileged scenarios, such as containers. This feature allows unprivileged processes (without the `CAP_SYS_ADMIN` capability) to perform Persistent Reservation operations as long as they have write permission for the block device. This expands the usage scenarios.
  - The IOPS throttling feature for large block I/O is optimized.
    The IOPS throttling capability in the 5.10 kernel did not work well for large block I/O scenarios (such as 1 MB). This was mainly because large block I/O might be split, and the block throttle's IOPS throttling logic did not handle this well. This phenomenon was particularly noticeable in buffered I/O scenarios, because buffered I/O first writes to the page cache and then writes back after a period, a process that often merges I/O into large blocks. The upstream community refactored and optimized this in v5.18. This update backports the upstream patches to optimize IOPS throttling for large block I/O and fixes a bug related to duplicate BPS statistics.
  - Support is backported for `lookup_and_delete_elem` for hashmaps and the bloom filter feature in eBPF.
    - Previously, the eBPF `lookup_and_delete_elem` (look up and delete) operation only supported queue and stack type maps. It now supports hash type maps.
    - A new map type, bloom filter, is added, which is an efficient set lookup tool.
  - Support is added for CPU and memory hot-plugging for QEMU Arm64 virtual machine Guest OS.
    - Support is added for hot-upgrading the number of vCPUs in a Guest OS using the `virsh setvcpus` command.
    - The `CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE` configuration is enabled by default to prevent the `memhp_default_online_type` from being in an offline state. This allows hot-plugged memory to be used automatically, which avoids memory hot-plug failures caused by insufficient memory when creating Page descriptors for the newly inserted memory.
  - Intel HWP boost is enabled for all Intel chips.
    Hardware P-states (HWP) IO boost technology can improve I/O performance. Previously, the kernel only enabled this feature for some Skylake platforms and enterprise servers. This patch removes the CPU type check and enables HWP boost for all CPUs by default.
  - The HVO feature is backported.
    HVO, which stands for HugeTLB Vmemmap Optimization, reduces the memory footprint of vmemmap corresponding to enormous page memory. It works by mapping the virtual addresses of all `struct page` instances in a enormous page's vmemmap to the same physical address, thereby releasing the physical memory occupied by the `struct page` instances.
  - The memcg lru lock optimization feature is backported.
    This feature optimizes scenarios in the kernel that require a global lru lock using the lock of the memcg where the page resides. These scenarios include page movement, memcg movement, swap-in, and swap-out. This feature significantly reduces the contention caused by the global lru lock. In tests with multiple memcgs, performance improved by about 50%.
  - Support is added for the Intel TDX guest kernel.
    Support is added for running a Linux kernel in an Intel TDX guest. This provides the guest with memory encryption, memory integrity protection, CPU register protection, and remote attestation for trusted environments.
  - Adapted for the EMR platform.
    - The EMR CPU ID is added to the PMU driver to enable PMU capabilities on the EMR platform.
    - The IFS Array BIST capability is enabled. In-Field Scan (IFS) is used to capture CPU errors that are difficult to detect with ECC and can check each core during runtime.
- Self-developed features
  - Support is added for transparently accelerating TCP using the Shared Memory Communications (SMC) kernel network protocol stack.
    SMC is a high-performance kernel network protocol stack contributed by IBM to the upstream Linux kernel. It can be used with various shared memory technologies, such as Remote Direct Memory Access (RDMA), to transparently accelerate TCP. Alibaba Cloud Native Kernel (ANCK) has fixed many stability issues on top of the upstream version. It supports SMCv2 by default, supports SMCv2.1 protocol negotiation, supports `max_link`/`max_conn`/Alibaba vendor ID features, optimizes the number of link connections, supports RQ flow control, supports RDMA Write With Immediate operations, adds various diagnostic information, supports using the SMC protocol stack through the `PF_INET` protocol family, and supports transparent replacement through BPF, among other key features.
  - The fuse cache consistency model is enhanced and statistics interfaces are added.
    - A debugging interface is added under sysfs to print all requests sent to the user-mode daemon that are waiting to be processed for a specific fuse file system.
    - A data statistics interface is added under sysfs to count and output the number and processing time of each type of request for a specific fuse file system.
    - Cache consistency in cache modes (`cache=always|auto`) is enhanced to suit distributed file system backends that rely on strong consistency, such as NFS.
      1. The user-mode daemon can notify the fuse client to invalidate all direct dentries in a directory.
      2. The Close-To-Open (CTO) cache consistency model is implemented, including flush-on-close and invalidate-on-open semantics for data and metadata.
      3. The cache consistency model in fuse failover mode is enhanced.
  - EROFS now supports directly mounting tar files and using 4k block size EROFS uncompressed images on arm64 platforms with 16k/64k page configurations.
    - Support is added for mounting 4k block size EROFS uncompressed images on arm64 platforms with 16k/64k page configurations.
    - Support is added for using a tar file directly as a data source, with EROFS metadata to mount and access the tar data.
  - Support is added for passing fuse mount targets across namespaces.
    Support is added for propagating a fuse mount target from an unprivileged sidecar container to an application container. This provides a solution for using fuse-based remote storage in cloud-native scenarios.
  - The memory bloat issue caused by Transparent Enormous Pages (THP) is resolved.
    While THP improves performance, it can also cause memory bloat, which may lead to out-of-memory (OOM) errors. For example, if an application needs to use two small pages (8 KiB of memory), but the kernel allocates one transparent enormous page, the remaining memory in the enormous page (510 small pages) is all zero. This can increase the Resident Set Size (RSS) memory usage and eventually lead to an OOM error.
    The THP Zero Subpage Reclamation (ZSR) feature is designed to solve this memory bloat problem. When the kernel reclaims memory, this feature splits the transparent enormous page into small pages and reclaims the all-zero subpages. This prevents rapid memory bloat and OOM errors.
System configuration updates
- The value of `tcp_max_tw_buckets` is changed to 5000.
- The default mount character set for the vfat file system is changed to iso8859-1.
Package feature updates
- aliyun_cli is integrated by default.
- container-selinux is integrated by default.
- The anolis-epao-release package is added, which allows Alibaba Cloud Linux 3 to use the Anolis OS epao source to install applications such as AI.

Fixed issues

An issue where the rngd.service failed to start on Alibaba Cloud Linux 3 arm64 images is fixed.
A bugfix from the upstream community for a cgroup leak that occurred when a process fork failed is backported.
A permission issue in overlayfs is fixed. When all upperdir and lowerdir were on the same file system and there was no read permission for the accessed file or directory, `ovl_override_creds()` was not executed correctly due to a logic error in a previous performance optimization. This prevented the effective permissions from being elevated to those of the mounter, which resulted in a permission denied error when copy up required read permission.
Several bugfixes for fuse from the upstream community are backported to further enhance the stability of fuse.
Several bugfixes for ext4 with the bigalloc feature enabled are backported and the time required for online resizing in this scenario is significantly optimized.
Fixes for potential data consistency issues caused by CONT-PTE/PMD are backported.
An issue where resctrl could not be used normally on AMD models is fixed.
Stability issues with the IAX hardware compression and decompression accelerator are fixed.
A cyclic redundancy check (CRC) failure issue with the IAX hardware compression and decompression accelerator is fixed.
A memory corruption issue caused by improper use of the `swap_info_struct` lock during concurrent `swapoff-swapon` operations is fixed. The bugfix for this issue has been merged into the community.
An issue where the self-developed zombie memcg reaper feature did not work in one-shot mode is fixed.
Potential stability issues with the Yitian 710 MPAM memory bandwidth monitoring feature are fixed.

Image updates

Container images
- alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3:3.8
- alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3:latest
  Note
  After the new version is released, you can no longer use the `latest` tag to pull the image for version 3.8.
Virtual machine images

Known issues

Because ANCK 5.10-015 synchronized a scheduling wakeup optimization with the upstream community's implementation, performance may regress in some extreme scenarios. This scenario only occurs in benchmarks with extremely high load pressure and does not affect normal user scenarios.

Alibaba Cloud Linux 3.2104 U7

Version number	Image ID	Release date	Release content
Alibaba Cloud Linux 3.2104 U7	aliyun_3_x64_20G_alibase_20230516.vhd	2023-05-16	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Updated the kernel to version 5.10.134-14.al8.x86_64. Content updates: For more information, see Content updates.
Alibaba Cloud Linux 3.2104 U7	aliyun_3_arm64_20G_alibase_20230515.vhd	2023-05-15	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit for ARM` base image to the latest software version. Updated the kernel to version 5.10.134-14.al8.aarch64. Content updates: For more information, see Content updates.

Content updates

Kernel bugs (Bugfix) and important security vulnerabilities (CVE) are fixed.
Support is added for the multi-pcp feature to bypass the buddy system's global lock and improve network packet reception capabilities.
The multi-pcp feature supports retaining memory pages with an order greater than 0 on a per-core basis. This avoids allocating high-order memory pages through the zone buddy system, which bypasses the buddy system's global lock and improves network packet reception capabilities.
The Intel IAA accelerator driver is enabled to improve compression and decompression performance.
The In-Memory Analytics Accelerator (IAA) is a hardware accelerator that combines basic data analytics functions with high-throughput compression and decompression. The driver code is sourced from the Intel code repository and has been adapted and bug-fixed for the ANCK kernel.
Silent data loss in shmem/hugetlb file systems caused by page cache truncation is fixed.
Faulty shmem and hugetlb pages are removed from the page cache. Subsequent access to the faulty page offset in the file results in the allocation of a new zero page, which leads to silent data loss. This feature fixes the silent data loss issue in shmem/tmpfs and hugetlb file systems caused by page faults.
Support is added for the coresight ETE driver and tools/perf tool.
The KVM module signal handling mechanism on the ARM 64 platform is enhanced to fix system crashes in scenarios such as RAS.
Before the CPU enters Guest mode, if the TIF_NOTIFY_RESUME flag is not processed, frequent RAS events can trigger exceptions and cause a system crash. Therefore, a complete generic entry infrastructure is now supported on the ARM 64 platform to correctly handle pending task work.
Synchronized with the Linux community's CMN/DRW drivers, debugfs support is added, and related bugs are fixed.
The CMN/DRW drivers in versions before 5.10-014 deviated from the Linux community. To reduce future maintenance costs, version 5.10-014 synchronizes with the Linux community's CMN/DRW drivers and is compatible with Yitian 710's CMN700. At the same time, debugfs support and fixes have been added, which allows users to view the CMN topology in user mode.
Support is added for MCE error recovery triggered by Copy On Write in the X86 kernel mode.
If an uncorrectable error is triggered during a Copy on Write (COW) operation in the kernel, the system will crash because there is no recovery handler for uncorrectable errors consumed by the kernel. This feature adds support for a recovery handler by sending a SIGBUS signal to the application, thus avoiding a system crash.
Support is added for top-down analysis of performance issues in the form of perf metrics to improve the usability of the CPU PMU.
Versions before 5.10-014 did not support the perf metric feature and lacked a top-down performance analysis tool. To improve the usability of the CPU Performance Monitoring Unit (PMU) and help users locate CPU performance bottlenecks, version 5.10-014 adds the perf metric feature and supports top-down metrics for platforms such as Yitian 710, Kunpeng, and x86.
virtio-net now supports USO offloading.
Compared with UFO offloading, this improves packet reception performance in complex network environments and the forwarding performance of forwarding components. Starting from version 5.10-014, virtio-net supports UDP segment offloading (USO). Compared with UDP fragment offloading (UFO), USO can effectively reduce the packet loss rate caused by fragment reassembly in business scenarios with unstable network conditions, incast traffic, and significant bursts. It also reduces the overhead of fragment reassembly on the receiving side. Packet loss and out-of-order packets can cause fragment reassembly in forwarding components, which reduces their efficiency. USO can effectively mitigate this problem.
The issue of virtual address space exhaustion on the aarch64 architecture due to the unimplemented `pci_iounmap` is fixed.
In versions before 5.10-014, because `CONFIG_GENERIC_IOMAP` was not configured for `pci_iounmap`, the function's implementation was empty and could not release mapped memory, which leads to virtual address space exhaustion. Version 5.10-014 fixes this issue by correctly implementing the `pci_iounmap` function.
Support is added for high-performance ublk.
ublk is a high-performance user-mode block device implemented based on the io_uring passthrough mechanism. It can be used for efficient agent access in distributed storage.
Support is added for the following self-developed Alibaba Cloud technologies:
- Support is added for a code segment locking feature at the machine and memcg granularity.
  When the memory watermark is low, memory reclamation is triggered. During memory release, the memory belonging to the code segments of core business programs may be reclaimed. As the business programs run, this memory is read from the disk and loaded back into memory. Frequent I/O operations lead to delayed responses from core services and performance jitter. This feature prevents the memory of code segments from being frequently swapped in and out by selecting the cgroup where the core business programs are located and locking their code segment memory so it cannot be reclaimed. This feature also adds a quota limit, which can be set as a percentage to control the proportion of locked code segment memory.
- A page cache usage limit feature is provided to solve OOM issues caused by the page cache reclamation speed being slower than its production speed.
  In container scenarios, the available memory for containers is limited. When the page cache occupies a large amount of memory and triggers memory reclamation, if the page cache reclamation speed is slower than the increasing memory demand of the business, OOM issues can easily occur, which severely affects business performance. To address this, ANCK introduces this feature, which limits the size of the page cache used by a container and performs early memory reclamation for page cache usage that exceeds the limit. This solves the problem of memory pressure and OOM issues. This solution supports page cache usage limits at the cgroup granularity and globally. It also supports both synchronous and asynchronous reclamation methods for flexibility.
- Support is added for dynamic CPU isolation.
  CPU isolation can assign different CPU cores or sets of CPU cores to different tasks to avoid competition for CPU resources, thereby improving overall system performance and stability. CPU isolation technology can isolate a portion of CPUs for critical tasks, while non-critical tasks share the non-isolated CPUs, which ensures that the operation of critical tasks is not affected. However, the number of critical tasks in a system is not fixed during runtime. Isolating too many CPUs can lead to a waste of CPU resources and increased costs. Therefore, dynamic CPU isolation is needed to modify the CPU isolation scope at any time to better utilize CPU resources, save costs, and improve overall business performance.
- Support is added for CPU Burst and tiered memory minimum watermarks on cgroup v2.
  To promote the use of cgroup v2, various self-developed ANCK technologies need to have their interfaces implemented for the cgroup v2 version, including CPU Burst and the tiered memory minimum watermark feature.
- xdp sockets now support allocating virtual memory for queues to avoid allocation failures caused by memory fragmentation.
  By default, xdp sockets use `__get_free_pages()` to allocate contiguous physical memory. If the machine's memory is highly fragmented, allocation can easily fail, which causes xdp socket creation to fail. This feature uses `vmalloc()` to allocate memory, which reduces the likelihood of xdp socket creation failures.

Alibaba Cloud Linux 3.2104 U6.1

Version number	Image ID	Release date	Release content
Alibaba Cloud Linux 3.2104 U6.1	aliyun_3_x64_20G_alibase_20230424.vhd	2023-04-24	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Updated the kernel to version 5.10.134-13.1.al8.x86_64.
	aliyun_3_arm64_20G_alibase_20230424.vhd	2023-04-24	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit for ARM` base image to the latest software version. Updated the kernel to version 5.10.134-13.1.al8.aarch64.
	aliyun_3_x64_20G_alibase_20230327.vhd	2023-03-27	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Updated the kernel to version 5.10.134-13.1.al8.x86_64.
	aliyun_3_arm64_20G_alibase_20230327.vhd	2023-03-27	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit for ARM` base image to the latest software version. Updated the kernel to version 5.10.134-13.1.al8.aarch64.

Alibaba Cloud Linux 3.2104 U6

Version number	Image ID	Release date	Release content
Alibaba Cloud Linux 3.2104 U6	aliyun_3_x64_20G_qboot_alibase_20230214.vhd	2023-02-14	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit Quick Launch Edition` image. This image is created based on the aliyun_3_x64_20G_alibase_20230110.vhd version of the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image.
	aliyun_3_x64_20G_uefi_alibase_20230214.vhd	2023-02-14	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit UEFI Edition` image to the latest software version. This image is created based on the aliyun_3_x64_20G_alibase_20230110.vhd version of the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image. The boot mode is switched to UEFI and only this mode is supported.
	aliyun_3_x64_20G_alibase_20230110.vhd	2023-01-10	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Added Plus debug repository repo configuration. Kernel updates: Updated the kernel to version 5.10.134-13.al8.x86_64. Fixed kernel bugs (Bugfix) and important security vulnerabilities (CVE). Added support for user-mode /dev/ioasid. In ANCK versions before 5.10-013, user-mode passthrough frameworks such as devices directly assigned to user mode, VFIO, and vDPA needed to use their own logic to isolate DMA initiated by user mode (these DMA requests are often untrusted). Starting from ANCK version 5.10-013, /dev/ioasid is introduced, providing a unified interface for managing I/O page tables and simplifying the implementation of VFIO and vDPA. Optimized SWIOTLB mechanism performance. In ANCK versions before 5.10-013, the swiotlb mechanism used for communication with peripherals used a single lock when allocating memory. Starting from ANCK version 5.10-013, this lock has been split into multiple locks and is user-configurable. The main beneficiaries are large-scale (such as more than 32 CPUs) confidential virtual machines (Intel TDX). For Redis and MySQL, tests show that this change can increase I/O performance by up to 8 times. Enabled napi.tx in virtio-net to optimize TCP Small Queue performance. In 3bedc5bca69d ('ck: Revert "virtio_net: enable napi_tx by default"'), performance degraded due to high SI (softirq) in some special scenarios. However, this prevented TCP small queues from working correctly, so we have re-enabled this feature. Added support for the AST2600 PCIe 2D VGA Driver. In ANCK versions before 5.10-013, the ASPEED AST2600 graphics card was not supported. Starting from ANCK version 5.10-013, the ASPEED AST2600 graphics card is supported, and it can display correctly on an external monitor. Added support for dynamically enabling the Group Identity feature. In ANCK version 5.10-013, a global sysctl switch was added for the group Identity feature. It is disabled by default to reduce the scheduling overhead for normal processes. To enable it, run the command `echo 1 > /proc/sys/kernel/sched_group_identity_enabled`. Adjusted the default kernel boot cmdline for the ARM64 platform. Starting from version 5.10.134-013, the ARM64 platform adds the following parameters to the boot cmdline to improve performance. `cgroup.memory=nokmem iommu.passthrough=1 iommu.strict=0` cgroup.memory=nokmem: When cgroup.memory is enabled, it adds extra processing logic to the slab-managed page allocation and release process, which affects performance. Disabling this feature improves performance. iommu.passthrough=1: IOMMU passthrough mode. If not explicitly specified, it is controlled by the `CONFIG_IOMMU_DEFAULT_PASSTHROUGH` configuration. This reduces page table mapping conversions and is effective on physical machines. iommu.strict=0: Indicates that TLB invalidation uses lazy mode. During DMA unmap, the invalidation of the corresponding TLB is delayed to improve throughput and speed up the unmap operation. If the IOMMU driver does not support this, it will automatically fall back to strict=1 mode, where the TLB is invalidated at the same time as the DMA unmap operation. Added support for the Compact NUMA Aware (CNA) spinlock feature. Starting from version 5.10.134-013, NUMA-aware functionality has been added to qspinlock. You can enable this feature by adding `numa_spinlock=on` or `numa_spinlock=auto` to the boot cmdline. When enabled, qspinlock tries to pass the lock to a CPU on the same NUMA node when CPUs on different NUMA nodes are competing for the spinlock. This reduces the number of cross-NUMA accesses and improves performance. In benchmark tests for applicable scenarios with sysbench and leveldb, performance improvements of over 10% have been observed. Enriched the perf mem and perf c2c features for ARM 64. Starting from version 5.10.134-013, the perf mem and perf c2c features in ARM64 have been enriched. On the ARM64 platform, you can use perf mem/perf c2c to display the data source of samples, such as L1 hit. perf mem adds support for comprehensive memory events, comprehensive instruction events, and display of total instruction latency information. perf c2c adds node information localization and more. fsck.xfs now supports log recovery. After a system crash, the file system may be in an inconsistent state, and the log may not have been recovered. In xfsprogs versions 5.0.0-10.0.4 and earlier, fsck.xfs did not support log recovery, which could cause the system to enter rescue mode after a restart, requiring manual intervention by a system administrator. Starting from xfsprogs version 5.0.0-10.0.5, log recovery is supported. To enable this capability, system administrators need to configure the boot parameters `fsck.mode=force` and `fsck.repair=yes`. Note that this capability currently only applies to the system disk. Added adaptive on-demand enormous pages for hugetext. Starting from version 5.10.134-013, to address the defect of code enormous pages on the x86 platform (a very small number of 2M iTLB entries), an adaptive processing feature for code enormous pages has been introduced. Based on the scanning heat of the 2M region's PTEs, it controls the use of code enormous pages by consolidating hotter regions into enormous pages. In short, this feature mainly controls the number of code enormous pages used by each application to prevent iTLB miss negative optimization. This feature is primarily aimed at Java applications and applications with large code segments (such as OceanBase and MySQL). Added support for SGX dynamic memory management. In ANCK versions before 5.10, there was no support for SGX dynamic memory management. Starting from ANCK version 5.10, support for the SGX EDMM feature has been added, providing SGX dynamic memory management capabilities. Enabled the wireguard module. In ANCK versions before 5.10-013, the wireguard module was not enabled. Starting from ANCK version 5.10, the configuration for the wireguard module will be enabled. WireGuard is a secure, efficient, and easy-to-use alternative to IPSec. It is designed to be very general and abstract enough to be suitable for most scenarios and is easy to configure.
	aliyun_3_arm64_20G_alibase_20230110.vhd	2023-01-10	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit for ARM` base image to the latest software version. Added Plus debug repository repo configuration. Kernel updates: Updated the kernel to version 5.10.134-13.al8.aarch64. Fixed kernel bugs (Bugfix) and important security vulnerabilities (CVE).

2022

Version number	Image ID	Release date	Release content
Alibaba Cloud Linux 3.5.2	aliyun_3_x64_20G_alibase_20221118.vhd	2022-11-18	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version.
	aliyun_3_arm64_20G_alibase_20221118.vhd	2022-11-18	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM edition` base image to the latest software version.
	aliyun_3_x64_20G_alibase_20221102.vhd	2022-11-02	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. The kernel version is updated to 5.10.134-12.2.al8.x86_64.
	aliyun_3_arm64_20G_alibase_20221102.vhd	2022-11-02	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM edition` base image to the latest software version. The kernel version is updated to 5.10.134-12.2.al8.aarch64.
Alibaba Cloud Linux 3.5	aliyun_3_x64_20G_alibase_20220907.vhd	2022-09-07	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Kernel updates: The kernel version is updated to 5.10.134-12.al8.x86_64. Fixed kernel bugs and critical security vulnerabilities (CVEs). Added support for Yitian 710 processors. Added support for Panjiu M physical servers. Optimized the basic performance on the Yitian platform. Added support for the Memory Partitioning and Monitoring (MPAM) feature on the ARM 64 architecture. Added support for datop to monitor cross-node Non-Uniform Memory Access (NUMA) access and identify hot and cold memory at the process granularity. Added support for reserving more than 4 GB of memory for crashkernel on the ARM 64 architecture. Added support for hotfixes for kernel modules on the ARM 64 architecture. Added support for the ftrace osnoise tracer. Added support for the ext4 fast commit feature. This feature provides significant performance optimization for applications with frequent fsync operations, such as MySQL and PostgreSQL databases. The corresponding e2fsprogs version is updated to 1.46.0. Added support for the following Alibaba Cloud proprietary technologies: Padded the unaligned 2 MB part at the end of executable binary files, which improves performance by 2% in some scenarios. Added support for the XFS 16 KB atomic write feature. Compared with the default double-write buffer, this feature improves performance by up to 50% and significantly reduces disk I/O. The corresponding xfsprogs and mariadb packages are also updated in the OpenAnolis yum repo. Compared with hardware-based atomic write solutions, this solution has the following advantages: It is based on the Copy-on-Write (CoW) mechanism. It is hardware-independent. It has no runtime I/O path configuration dependencies. In addition, this optimization can be combined with the code segment enormous page feature. Added support for nydus+erofs over fscache to accelerate container images. This feature was contributed by the OpenAnolis community, merged into the mainline of the Linux community in Linux 5.19, and became the first natively supported solution for container image acceleration in the Linux community. Added support for enhanced fd passthrough and fd attach features. The fd passthrough feature reduces I/O latency to 10% of the original in common scenarios. The fd attach feature supports lossless recovery of fuse mount target connections, which improves the stability of the production environment. kidled now supports scanning of anonymous pages, file pages, and slab objects. Added the memory.use_priority_swap interface to support memory swapping based on cgroup priority. Added support for 1-RTT and RDMA DIM to SMC, and optimized the CQ interrupt handling logic, which increases the data path queries per second (QPS) by 40%. Introduced SMC automated testing capabilities and fixed dozens of stability issues.
	aliyun_3_arm64_20G_alibase_20220907.vhd	2022-09-07	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM edition` base image to the latest software version. Kernel updates: The kernel version is updated to 5.10.134-12.al8.aarch64. Fixed kernel bugs and critical security vulnerabilities (CVEs). Added support for Yitian 710 processors. Added support for Panjiu M physical servers. Optimized the basic performance on the Yitian platform. Added support for the Memory Partitioning and Monitoring (MPAM) feature on the ARM 64 architecture. Added support for datop to monitor cross-node Non-Uniform Memory Access (NUMA) access and identify hot and cold memory at the process granularity. Added support for reserving more than 4 GB of memory for crashkernel on the ARM 64 architecture. Added support for hotfixes for kernel modules on the ARM 64 architecture. Added support for the ftrace osnoise tracer. Added support for the ext4 fast commit feature. This feature provides significant performance optimization for applications with frequent fsync operations, such as MySQL and PostgreSQL databases. The corresponding e2fsprogs version is updated to 1.46.0. Added support for the following Alibaba Cloud proprietary technologies: Padded the unaligned 2 MB part at the end of executable binary files, which improves performance by 2% in some scenarios. Added support for the XFS 16 KB atomic write feature. Compared with the default double-write buffer, this feature improves performance by up to 50% and significantly reduces disk I/O. The corresponding xfsprogs and mariadb packages are also updated in the OpenAnolis yum repo. Compared with hardware-based atomic write solutions, this solution has the following advantages: It is based on the Copy-on-Write (CoW) mechanism. It is hardware-independent. It has no runtime I/O path configuration dependencies. In addition, this optimization can be combined with the code segment enormous page feature. Added support for nydus+erofs over fscache to accelerate container images. This feature was contributed by the OpenAnolis community, merged into the mainline of the Linux community in Linux 5.19, and became the first natively supported solution for container image acceleration in the Linux community. Added support for enhanced fd passthrough and fd attach features. The fd passthrough feature reduces I/O latency to 10% of the original in common scenarios. The fd attach feature supports lossless recovery of fuse mount target connections, which improves the stability of the production environment. kidled now supports scanning of anonymous pages, file pages, and slab objects. Added the memory.use_priority_swap interface to support memory swapping based on cgroup priority. Added support for 1-RTT and RDMA DIM to SMC, and optimized the CQ interrupt handling logic, which increases the data path queries per second (QPS) by 40%. Introduced SMC automated testing capabilities and fixed dozens of stability issues.
	aliyun_3_x64_20G_qboot_alibase_20220907.vhd	2022-09-07	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit Quick Launch Edition` image. This image is created based on the aliyun_3_x64_20G_alibase_20220907.vhd version of the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image.
	aliyun_3_x64_20G_uefi_alibase_20220907.vhd	2022-09-07	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit UEFI Edition` image to the latest software version. This image is created based on the aliyun_3_x64_20G_alibase_20220907.vhd version of the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image. The boot mode is switched to UEFI, and only UEFI mode is supported.
Alibaba Cloud Linux 3.4.2	aliyun_3_arm64_20G_alibase_20220819.vhd	2022-08-19	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM edition` base image to the latest software version. The kernel version is updated to 5.10.112-11.2.al8.aarch64.
Alibaba Cloud Linux 3.4.2	aliyun_3_x64_20G_alibase_20220815.vhd	2022-08-15	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. The kernel version is updated to 5.10.112-11.2.al8.x86_64.
Alibaba Cloud Linux 3.4.1	aliyun_3_x64_20G_alibase_20220728.vhd	2022-07-28	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. The kernel version is updated to 5.10.112-11.1.al8.x86_64.
Alibaba Cloud Linux 3.4.1	aliyun_3_arm64_20G_alibase_20220728.vhd	2022-07-28	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM edition` base image to the latest software version. The kernel version is updated to 5.10.112-11.1.al8.aarch64.
Alibaba Cloud Linux 3.4	aliyun_3_x64_20G_alibase_20220527.vhd	2022-05-27	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Kernel updates: The kernel version is updated to 5.10.112-11.al8.x86_64. Fixed kernel bugs and critical security vulnerabilities (CVEs). Added support for the following Alibaba Cloud proprietary technologies: Kernel code multi-replica feature. Enhanced kernel code enormous page feature. Kfence now supports the detection of issues such as memory out-of-bounds access and Use-After-Free (UAF). Added support for the Hygon CSV2 confidential virtual machine feature. The guest OS supports a maximum of 256 CPUs. Improved the throughput and latency of SMC in multiple scenarios, increased the connection establishment speed, and fixed multiple stability and compatibility issues. Added support for AMX, vAMX, IPI virtualization, UINTER, Intel_idle, and TDX features on Intel SPR. Added support for ptdma, CPU frequency, k10temp, and EDAC features on AMD. Added support for the following features on Alibaba Cloud Yitian 710: DDR PMU, PCIe PMU driver, CMN-700, and RAS. Added support for the coresight feature. Added support for ARM SPE perf memory profiling/c2c features on the ARM architecture. virtiofs now supports file-level DAX. Added support for the smmu event polling feature.
	aliyun_3_x64_20G_qboot_alibase_20220527.vhd	2022-05-27	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit Quick Launch Edition` image. This image is based on the aliyun_3_x64_20G_alibase_20220527.vhd version of the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image.
	aliyun_3_x64_20G_uefi_alibase_20220527.vhd	2022-05-27	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit UEFI Edition` image to the latest software version. This image is created based on the aliyun_3_x64_20G_alibase_20220527.vhd version of the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image. The boot mode is switched to UEFI, and only UEFI mode is supported.
	aliyun_3_arm64_20G_alibase_20220526.vhd	2022-05-26	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM edition` base image to the latest software version. Kernel updates: The kernel version is updated to 5.10.112-11.al8.aarch64. Fixed kernel bugs and critical security vulnerabilities (CVEs). Added support for the following Alibaba Cloud proprietary technologies: Kernel code multi-replica feature. Enhanced kernel code enormous page feature. Kfence now supports the detection of issues such as memory out-of-bounds access and Use-After-Free (UAF). Added support for the Hygon CSV2 confidential virtual machine feature. The guest OS supports a maximum of 256 CPUs. Improved the throughput and latency of SMC in multiple scenarios, increased the connection establishment speed, and fixed multiple stability and compatibility issues. Added support for AMX, vAMX, IPI virtualization, UINTER, Intel_idle, and TDX features on Intel SPR. Added support for ptdma, CPU frequency, k10temp, and EDAC features on AMD. Added support for the following features on Alibaba Cloud Yitian 710: DDR PMU, PCIe PMU driver, CMN-700, and RAS. Added support for the coresight feature. Added support for ARM SPE perf memory profiling/c2c features on the ARM architecture. virtiofs now supports file-level DAX. Added support for the smmu event polling feature.
Alibaba Cloud Linux 3.3.4	aliyun_3_x64_20G_alibase_20220413.vhd	2022-04-13	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Kernel updates: The kernel version is updated to 5.10.84-10.4.al8.x86_64. Fixed critical security vulnerabilities CVE-2022-1016 and CVE-2022-27666.
Alibaba Cloud Linux 3.3.4	aliyun_3_arm64_20G_alibase_20220413.vhd	2022-04-13	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM edition` base image to the latest software version. Kernel updates: The kernel version is updated to 5.10.84-10.4.al8.aarch64. Fixed critical security vulnerabilities CVE-2022-1016 and CVE-2022-27666.
Alibaba Cloud Linux 3.3.3	aliyun_3_x64_20G_alibase_20220315.vhd	2022-03-15	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version. Fixed security vulnerabilities in software packages. Kernel updates: The kernel version is updated to 5.10.84-10.3.al8.x86_64. Fixed vulnerabilities CVE-2022-0435 and CVE-2022-0847.
Alibaba Cloud Linux 3.3.3	aliyun_3_arm64_20G_alibase_20220315.vhd	2022-03-15	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit ARM edition` base image to the latest software version. Fixed security vulnerabilities in software packages. Kernel updates: The kernel version is updated to 5.10.84-10.3.al8.aarch64. Fixed vulnerabilities CVE-2022-0435 and CVE-2022-0847.
Alibaba Cloud Linux 3.3.2	aliyun_3_x64_20G_alibase_20220225.vhd	2022-02-25	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image to the latest software version and fixed security vulnerabilities in software packages. The Real Time Clock (RTC) uses the UTC standard. For more information, see Linux time and time zones. Kernel updates: The kernel version is updated to 5.10.84-10.2.al8.x86_64. Fixed vulnerabilities CVE-2022-0492, CVE-2021-4197, CVE-2022-0330, CVE-2022-22942, and CVE-2022-0185. Added support for the following Alibaba Cloud proprietary features: Kernel code multi-replica feature. Kernel code enormous page feature. RDMA/SMC-R feature. Added support for AMX, RAS, RCEC, Bus lock detect & Ratelimit support, and uncore features on Intel SPR. Added the MCA-R feature for Intel IceLake processors. Enabled the Intel DSA feature. virtio-net now supports the XDP socket feature. Added support for kernel KTLS with Chinese cryptographic algorithms. Added support for Kfence, a tool that detects issues such as memory out-of-bounds access and Use-After-Free (UAF). Optimized the SM4 algorithm in the kernel for the AVX/AVX2 instruction sets. Added support for the Hygon CSV VM attestation feature. Added support for the perf c2c feature of ARM SPE. Added support for the i10nm_edac feature. Ported the unevictable_pid feature. Added support for adjusting memory watermarks. Added support for the adaptive sqpoll mode in IO_Uring. Added support for enormous vmalloc mappings.
	aliyun_3_x64_20G_qboot_alibase_20220225.vhd	2022-02-25	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit Quick Launch Edition` image. This image is created based on the aliyun_3_x64_20G_alibase_20220225.vhd version of the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image. The Real Time Clock (RTC) uses the UTC standard. For more information, see Linux time and time zones.
	aliyun_3_arm64_20G_alibase_20220225.vhd	2022-02-25	The Real Time Clock (RTC) uses the UTC standard. For more information, see Linux time and time zones. Kernel updates: The kernel version is updated to 5.10.84-10.2.al8.aarch64. Fixed vulnerabilities CVE-2022-0492, CVE-2021-4197, CVE-2022-0330, CVE-2022-22942, and CVE-2022-0185. Added support for the following Alibaba Cloud proprietary features: Kernel code multi-replica feature. Kernel code enormous page feature. RDMA/SMC-R feature. Added support for AMX, RAS, RCEC, Bus lock detect & Ratelimit support, and uncore features on Intel SPR. Added the MCA-R feature for Intel IceLake processors. Enabled the Intel DSA feature. virtio-net now supports the XDP socket feature. Added support for kernel KTLS with Chinese cryptographic algorithms. Added support for Kfence, a tool that detects issues such as memory out-of-bounds access and Use-After-Free (UAF). Optimized the SM4 algorithm in the kernel for the AVX/AVX2 instruction sets. Added support for the Hygon CSV VM attestation feature. Added support for the perf c2c feature of ARM SPE. Added support for the i10nm_edac feature. Ported the unevictable_pid feature. Added support for adjusting memory watermarks. Added support for the adaptive sqpoll mode in IO_Uring. Added support for enormous vmalloc mappings.
	aliyun_3_x64_20G_uefi_alibase_20220225.vhd	2022-02-25	Updated the `Alibaba Cloud Linux 3.2104 LTS 64-bit UEFI Edition` image to the latest software version. This image is created based on the aliyun_3_x64_20G_alibase_20220225.vhd version of the `Alibaba Cloud Linux 3.2104 LTS 64-bit` base image. The Real Time Clock (RTC) uses the UTC standard. For more information, see Linux time and time zones.

2021

Version number	Image ID	Release date	Release notes
Alibaba Cloud Linux 3.2	aliyun_3_x64_20G_qboot_alibase_20211214.vhd	2021-12-14	Added the `Alibaba Cloud Linux 3.2104 64-bit Quick Launch Edition` image. This image is created from the aliyun_3_x64_20G_alibase_20210910.vhd version of the `Alibaba Cloud Linux 3.2104 64-bit` base image.
	aliyun_3_x64_20G_alibase_20210910.vhd	2021-09-10	Updated the `Alibaba Cloud Linux 3.2104 64-bit` base image to the latest software version and fixed package security vulnerabilities. Added the update-motd service and enabled it by default. Enabled the Kdump service by default. Enabled the atd service by default. Kernel updates: Upgraded the kernel to the mainline stable version 5.10.60. The current kernel version is 5.10.60-9.al8.x86_64. Fixed kernel bugs and critical security vulnerabilities. Added support for the following Alibaba Cloud proprietary technologies: elastic Remote Direct Memory Access (eRDMA) and eRDMA-based SMC-R technology. Resource fencing: OOM priority control. Memory KIDLED technology. Resource fencing: memcg zombie reaper. Rich container technology. Resource fencing: CPU Group Identity. UKFEF technology. Added support for Intel SPR CPUs. Added support for AMD Milan cpupower. Added support for SEDI-based NMI watchdog on the ARM 64 architecture. Added support for MPAM on the ARM 64 architecture. Added support for memory hotplug on the ARM 64 architecture. Enhanced the kernel's Quick Launch technology. Added support for x86 SGX2. Optimized virtio-net performance. Added support for eBPF LSM technology. Added hardware and software synergy for KVM virtualization (supports PV-qspinlock).
	aliyun_3_arm64_20G_alibase_20210910.vhd	2021-09-10	Updated the `Alibaba Cloud Linux 3.2104 64-bit ARM Edition` image to the latest software version. This image is created from the aliyun_3_x64_20G_alibase_20210910.vhd version of the `Alibaba Cloud Linux 3.2104 64-bit` base image.
	aliyun_3_x64_20G_uefi_alibase_20210910.vhd	2021-09-10	Updated the `Alibaba Cloud Linux 3.2104 64-bit UEFI Edition` image to the latest software version. This image is created from the aliyun_3_x64_20G_alibase_20210910.vhd version of the `Alibaba Cloud Linux 3.2104 64-bit` base image. Available in: China (Hangzhou), China (Shanghai), China (Beijing), China (Ulanqab), China (Shenzhen), China (Heyuan), and Singapore.
Alibaba Cloud Linux 3.1	aliyun_3_arm64_20G_alibase_20210709.vhd	2021-07-09	Added the `Alibaba Cloud Linux 3.2104 64-bit ARM Edition` image. Added support for Security Center. Available in: China (Hangzhou).
	aliyun_3_x64_20G_alibase_20210425.vhd	2021-04-25	Updated the `Alibaba Cloud Linux 3.2104 64-bit` base image. Kernel update: The version is updated to 5.10.23-5.al8.x86_64.
	aliyun_3_x64_20G_uefi_alibase_20210425.vhd	2021-04-25	Added the `Alibaba Cloud Linux 3.2104 64-bit UEFI Edition` image. This image is created from the aliyun_3_x64_20G_alibase_20210425.vhd version of the `Alibaba Cloud Linux 3.2104 64-bit` base image. The boot mode is now UEFI. Only UEFI mode is supported. Available in: China (Beijing), China (Hangzhou), China (Shanghai), and China (Shenzhen).
Alibaba Cloud Linux 3.0	aliyun_3_x64_20G_alibase_20210415.vhd	2021-04-15	The `Alibaba Cloud Linux 3.2104 64-bit` base image was published. Kernel notes: Based on the Linux community's long-term support kernel version 5.10. The initial kernel version is 5.10.23-4.al8.x86_64. Added support for PV-Panic, PV-Unhalt, and PV-Preempt features on the ARM64 architecture. Added support for Kernel Live Patching on the ARM64 architecture. Added support for the TCP-RT feature. Added support for asynchronous background reclaiming for Memcg. The cgroup v1 interface supports memcg QoS and Pressure Stall Information (PSI) features. Added support for the cgroup writeback feature. Enhanced monitoring and statistics for block I/O throttling. Optimized the JBD2 interface for ext4. Optimized the Alibaba Cloud open source kernel and fixed bugs in multiple subsystems, such as the scheduler, memory, file system, and block layer. Added support for CPU Burst. Image notes: Compatible with the CentOS 8 and RHEL 8 software ecosystems. Fixed package security vulnerabilities. Supports GCC 10.2.1 and glibc 2.32. Supports Python 3.6 and Python 2.7. Supports the new AppStream mechanism. Available in: China (Hangzhou).

References

Alibaba Cloud Linux 2 image release notes.
Third-party and open source public image release notes.
You can use the latest Alibaba Cloud Linux 3 image to create an instance.