diff --git a/.gitignore b/.gitignore index 38fd2e4..cc341d1 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,6 @@ SOURCES/centossecureboot201.cer SOURCES/centossecurebootca2.cer -SOURCES/linux-4.18.0-553.137.1.rt7.478.el8_10.tar.xz +SOURCES/linux-4.18.0-553.139.1.rt7.480.el8_10.tar.xz SOURCES/redhatsecureboot302.cer SOURCES/redhatsecureboot303.cer SOURCES/redhatsecureboot501.cer diff --git a/.kernel-rt.metadata b/.kernel-rt.metadata index bd5c758..0737c1b 100644 --- a/.kernel-rt.metadata +++ b/.kernel-rt.metadata @@ -1,6 +1,6 @@ 2ba40bf9138b48311e5aa1b737b7f0a8ad66066f SOURCES/centossecureboot201.cer bfdb3d7cffc43f579655af5155d50c08671d95e5 SOURCES/centossecurebootca2.cer -bf882f308d5f8c8fcddcade1759acff853db2aa7 SOURCES/linux-4.18.0-553.137.1.rt7.478.el8_10.tar.xz +a14407c76c0b9d7b8400e25f6e92493cff2b3e4c SOURCES/linux-4.18.0-553.139.1.rt7.480.el8_10.tar.xz 13e5cd3f856b472fde80a4deb75f4c18dfb5b255 SOURCES/redhatsecureboot302.cer e89890ca0ded2f9058651cc5fa838b78db2e6cc2 SOURCES/redhatsecureboot303.cer ba0b760e594ff668ee72ae348adf3e49b97f75fb SOURCES/redhatsecureboot501.cer diff --git a/SOURCES/kernel-rt-aarch64-debug.config b/SOURCES/kernel-rt-aarch64-debug.config index 3526051..5a47844 100644 --- a/SOURCES/kernel-rt-aarch64-debug.config +++ b/SOURCES/kernel-rt-aarch64-debug.config @@ -3230,6 +3230,7 @@ CONFIG_EEPROM_MAX6875=m CONFIG_EFI=y CONFIG_EFIVAR_FS=y CONFIG_EFI_PARTITION=y +CONFIG_EFI_SBAT_FILE="" CONFIG_EFI_STUB=y CONFIG_EFI_VARS=y CONFIG_EFI_VARS_PSTORE=y diff --git a/SOURCES/kernel-rt-aarch64.config b/SOURCES/kernel-rt-aarch64.config index 7170418..fef5265 100644 --- a/SOURCES/kernel-rt-aarch64.config +++ b/SOURCES/kernel-rt-aarch64.config @@ -3259,6 +3259,7 @@ CONFIG_EEPROM_MAX6875=m CONFIG_EFI=y CONFIG_EFIVAR_FS=y CONFIG_EFI_PARTITION=y +CONFIG_EFI_SBAT_FILE="" CONFIG_EFI_STUB=y CONFIG_EFI_VARS=y CONFIG_EFI_VARS_PSTORE=y diff --git a/SOURCES/kernel-rt-ppc64le-debug.config b/SOURCES/kernel-rt-ppc64le-debug.config index 569df1b..d9f8314 100644 --- a/SOURCES/kernel-rt-ppc64le-debug.config +++ b/SOURCES/kernel-rt-ppc64le-debug.config @@ -2900,6 +2900,7 @@ CONFIG_EEPROM_AT24=m CONFIG_EEPROM_LEGACY=m CONFIG_EEPROM_MAX6875=m CONFIG_EFI_PARTITION=y +CONFIG_EFI_SBAT_FILE="" CONFIG_ENABLE_MUST_CHECK=y CONFIG_ENCLOSURE_SERVICES=m CONFIG_ENCRYPTED_KEYS=y diff --git a/SOURCES/kernel-rt-ppc64le.config b/SOURCES/kernel-rt-ppc64le.config index 16fa42c..77a7545 100644 --- a/SOURCES/kernel-rt-ppc64le.config +++ b/SOURCES/kernel-rt-ppc64le.config @@ -2926,6 +2926,7 @@ CONFIG_EEPROM_AT24=m CONFIG_EEPROM_LEGACY=m CONFIG_EEPROM_MAX6875=m CONFIG_EFI_PARTITION=y +CONFIG_EFI_SBAT_FILE="" CONFIG_ENABLE_MUST_CHECK=y CONFIG_ENCLOSURE_SERVICES=m CONFIG_ENCRYPTED_KEYS=y diff --git a/SOURCES/kernel-rt-s390x-debug.config b/SOURCES/kernel-rt-s390x-debug.config index 7a62fa5..218b02b 100644 --- a/SOURCES/kernel-rt-s390x-debug.config +++ b/SOURCES/kernel-rt-s390x-debug.config @@ -3006,6 +3006,7 @@ CONFIG_EDAC_GHES=y CONFIG_EDAC_LEGACY_SYSFS=y CONFIG_EDAC_PND2=m CONFIG_EFI_PARTITION=y +CONFIG_EFI_SBAT_FILE="" CONFIG_ENABLE_MUST_CHECK=y CONFIG_ENCLOSURE_SERVICES=m CONFIG_ENCRYPTED_KEYS=m diff --git a/SOURCES/kernel-rt-s390x-zfcpdump.config b/SOURCES/kernel-rt-s390x-zfcpdump.config index 4427f5e..35d8d62 100644 --- a/SOURCES/kernel-rt-s390x-zfcpdump.config +++ b/SOURCES/kernel-rt-s390x-zfcpdump.config @@ -3175,6 +3175,7 @@ CONFIG_EDAC_GHES=y CONFIG_EDAC_LEGACY_SYSFS=y CONFIG_EDAC_PND2=m CONFIG_EFI_PARTITION=y +CONFIG_EFI_SBAT_FILE="" CONFIG_ELF_CORE=y CONFIG_ENABLE_MUST_CHECK=y CONFIG_ENCLOSURE_SERVICES=y diff --git a/SOURCES/kernel-rt-s390x.config b/SOURCES/kernel-rt-s390x.config index cdd373d..a3e5b58 100644 --- a/SOURCES/kernel-rt-s390x.config +++ b/SOURCES/kernel-rt-s390x.config @@ -3034,6 +3034,7 @@ CONFIG_EDAC_GHES=y CONFIG_EDAC_LEGACY_SYSFS=y CONFIG_EDAC_PND2=m CONFIG_EFI_PARTITION=y +CONFIG_EFI_SBAT_FILE="" CONFIG_ENABLE_MUST_CHECK=y CONFIG_ENCLOSURE_SERVICES=m CONFIG_ENCRYPTED_KEYS=m diff --git a/SOURCES/kernel-rt-x86_64-debug.config b/SOURCES/kernel-rt-x86_64-debug.config index 0cf0d73..9ffafbd 100644 --- a/SOURCES/kernel-rt-x86_64-debug.config +++ b/SOURCES/kernel-rt-x86_64-debug.config @@ -3075,6 +3075,7 @@ CONFIG_EFI_MIXED=y CONFIG_EFI_PARTITION=y CONFIG_EFI_RCI2_TABLE=y CONFIG_EFI_RUNTIME_MAP=y +CONFIG_EFI_SBAT_FILE="" CONFIG_EFI_STUB=y CONFIG_EFI_VARS=y CONFIG_EFI_VARS_PSTORE=y diff --git a/SOURCES/kernel-rt-x86_64.config b/SOURCES/kernel-rt-x86_64.config index 905ae72..a8360ab 100644 --- a/SOURCES/kernel-rt-x86_64.config +++ b/SOURCES/kernel-rt-x86_64.config @@ -3102,6 +3102,7 @@ CONFIG_EFI_MIXED=y CONFIG_EFI_PARTITION=y CONFIG_EFI_RCI2_TABLE=y CONFIG_EFI_RUNTIME_MAP=y +CONFIG_EFI_SBAT_FILE="" CONFIG_EFI_STUB=y CONFIG_EFI_VARS=y CONFIG_EFI_VARS_PSTORE=y diff --git a/SOURCES/kernel.sbat.template b/SOURCES/kernel.sbat.template new file mode 100644 index 0000000..11f9283 --- /dev/null +++ b/SOURCES/kernel.sbat.template @@ -0,0 +1,2 @@ +sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md +kernel.@SBAT_SUFFIX,1,Red Hat,kernel-core,@KVER,mailto:secalert@redhat.com diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 43492d4..a7e0e5c 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -21,6 +21,17 @@ %global signkernel 0 %endif +# RHEL/CentOS/Fedora specific .SBAT entries +%if 0%{?centos} +%global sbat_suffix centos +%else +%if 0%{?fedora} +%global sbat_suffix fedora +%else +%global sbat_suffix rhel +%endif +%endif + # Sign modules on all arches %global signmodules 1 @@ -38,10 +49,10 @@ # define buildid .local %define specversion 4.18.0 -%define pkgrelease 553.137.1.rt7.478.el8_10 +%define pkgrelease 553.139.1.rt7.480.el8_10 # allow pkg_release to have configurable %%{?dist} tag -%define specrelease 553.137.1.rt7.478%{?dist} +%define specrelease 553.139.1.rt7.480%{?dist} %define pkg_release %{specrelease}%{?buildid} @@ -148,7 +159,7 @@ # The preempt RT patch level %global rttag .rt7 # realtimeN -%global rtbuild .478 +%global rtbuild .480 %define with_doc 0 %define with_headers 0 %define with_cross_headers 0 @@ -457,6 +468,7 @@ Source17: mod-blacklist.sh Source18: mod-sign.sh Source19: mod-extra.list Source80: parallel_xz.sh +Source85: kernel.sbat.template Source90: filter-x86_64.sh Source93: filter-aarch64.sh Source96: filter-ppc64le.sh @@ -1144,6 +1156,9 @@ pathfix.py -i %{__python3} -p -n \ %define make make %{?cross_opts} HOSTCFLAGS="%{?build_hostcflags}" HOSTLDFLAGS="%{?build_hostldflags}" +# SBAT data +sed -e s,@KVER,%{KVERREL}, -e s,@SBAT_SUFFIX,%{sbat_suffix}, %{SOURCE85} > kernel.sbat + # only deal with configs if we are going to build for the arch %ifnarch %nobuildarches @@ -1186,6 +1201,7 @@ cat secureboot.pem >> ../certs/rhel.pem %endif for i in *.config; do sed -i 's@CONFIG_SYSTEM_TRUSTED_KEYS=""@CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"@' $i + sed -i 's@CONFIG_EFI_SBAT_FILE=""@CONFIG_EFI_SBAT_FILE="kernel.sbat"@' $i done %endif %endif @@ -2711,7 +2727,7 @@ fi # # %changelog -* Mon Jun 22 2026 Andrei Lukoshko - 4.18.0-553.137.1.rt7.478 +* Tue Jul 07 2026 Andrei Lukoshko - 4.18.0-553.139.1.rt7.480 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 @@ -2722,10 +2738,25 @@ fi - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained -* Mon Jun 22 2026 Eduard Abdullin - 4.18.0-553.137.1.rt7.478 +* Tue Jul 07 2026 Eduard Abdullin - 4.18.0-553.139.1.rt7.480 - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS +* Mon Jun 29 2026 CKI KWF Bot [4.18.0-553.139.1.rt7.480.el8_10] +- NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] + +* Wed Jun 24 2026 CKI KWF Bot [4.18.0-553.138.1.rt7.479.el8_10] +- redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] +- redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] +- redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] +- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] +- x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] +- redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] +- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} +- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} +- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} +- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} + * Fri Jun 19 2026 CKI KWF Bot [4.18.0-553.137.1.rt7.478.el8_10] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054}