diff --git a/.gitignore b/.gitignore index 7a4cb254b..683330f90 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,7 @@ fedoraimaca.x509 -kernel-abi-stablelists-6.12.0-55.32.1.el10_0.tar.xz -kernel-kabi-dw-6.12.0-55.32.1.el10_0.tar.xz -linux-6.12.0-55.32.1.el10_0.tar.xz +kernel-abi-stablelists-6.12.0-55.33.1.el10_0.tar.xz +kernel-kabi-dw-6.12.0-55.33.1.el10_0.tar.xz +linux-6.12.0-55.33.1.el10_0.tar.xz nvidiagpuoot001.x509 olima1.x509 olimaca1.x509 diff --git a/Makefile.rhelver b/Makefile.rhelver index 6af39a99f..0e5f3d0bd 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 0 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 55.32.1 +RHEL_RELEASE = 55.33.1 # # RHEL_REBASE_NUM diff --git a/kernel.spec b/kernel.spec index f1a205d22..c1bc48045 100644 --- a/kernel.spec +++ b/kernel.spec @@ -162,15 +162,15 @@ Summary: The Linux kernel %define specrpmversion 6.12.0 %define specversion 6.12.0 %define patchversion 6.12 -%define pkgrelease 55.32.1 +%define pkgrelease 55.33.1 %define kversion 6 -%define tarfile_release 6.12.0-55.32.1.el10_0 +%define tarfile_release 6.12.0-55.33.1.el10_0 # This is needed to do merge window version magic %define patchlevel 12 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 55.32.1%{?buildid}%{?dist} +%define specrelease 55.33.1%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 6.12.0-55.32.1.el10_0 +%define kabiversion 6.12.0-55.33.1.el10_0 # If this variable is set to 1, a bpf selftests build failure will cause a # fatal kernel package build error @@ -3310,7 +3310,7 @@ export CFLAGS="%{build_cflags}" # 'make install' for bpf is broken and upstream refuses to fix it. # Install the needed files manually. %{log_msg "install selftests"} -for dir in bpf bpf/no_alu32 bpf/progs; do +for dir in bpf bpf/no_alu32 bpf/cpuv4 bpf/progs; do # In ARK, the rpm build continues even if some of the selftests # cannot be built. It's not always possible to build selftests, # as upstream sometimes dependens on too new llvm version or has @@ -3326,14 +3326,17 @@ done %buildroot_save_unstripped "usr/libexec/kselftests/bpf/test_progs" %buildroot_save_unstripped "usr/libexec/kselftests/bpf/test_progs-no_alu32" +%buildroot_save_unstripped "usr/libexec/kselftests/bpf/test_progs-cpuv4" # The urandom_read binary doesn't pass the check-rpaths check and upstream # refuses to fix it. So, we save it to buildroot_unstripped and delete it so it # will be hidden from check-rpaths and will automatically get restored later. %buildroot_save_unstripped "usr/libexec/kselftests/bpf/urandom_read" %buildroot_save_unstripped "usr/libexec/kselftests/bpf/no_alu32/urandom_read" +%buildroot_save_unstripped "usr/libexec/kselftests/bpf/cpuv4/urandom_read" rm -f %{buildroot}/usr/libexec/kselftests/bpf/urandom_read rm -f %{buildroot}/usr/libexec/kselftests/bpf/no_alu32/urandom_read +rm -f %{buildroot}/usr/libexec/kselftests/bpf/cpuv4/urandom_read popd %{log_msg "end build selftests"} @@ -4360,7 +4363,7 @@ fi\ # # %changelog -* Tue Sep 16 2025 Andrei Lukoshko - 6.12.0-55.32.1 +* Thu Sep 25 2025 Andrei Lukoshko - 6.12.0-55.33.1 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 @@ -4371,10 +4374,27 @@ fi\ - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained -* Tue Sep 16 2025 Eduard Abdullin - 6.12.0-55.32.1 +* Thu Sep 25 2025 Eduard Abdullin - 6.12.0-55.33.1 - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS +* Thu Sep 18 2025 Alex Burmashev [6.12.0-55.33.1.el10_0] +- Fix kABI for net_namespace.h +- Bump internal version to 55.33.1 +- xfrm: interface: fix use-after-free after changing collect_md xfrm interface - CVE-2025-38500 +- idpf: convert control queue mutex to a spinlock - CVE-2025-38392 +- eth: bnxt: fix missing ring index trim on error path - CVE-2025-37873 +- tcp: Correct signedness in skb remaining space calculation - CVE-2025-38463 +- ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - CVE-2025-38550 +- redhat: selftests/bpf: Add cpuv4 variant +- i40e: report VF tx_dropped with tx_errors instead of tx_discards - CVE-2025-38200 +- use uniform permission checks for all mount propagation changes - CVE-2025-38498 +- do_change_type(): refuse to operate on unmounted/not ours mounts - CVE-2025-38498 +- ublk: make sure ubq->canceling is set when queue is frozen - CVE-2025-22068 +- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM +- scsi: lpfc: Use memcpy() for BIOS version - CVE-2025-38332 +- net: introduce per netns packet chains + * Fri Sep 12 2025 Alex Burmashev [6.12.0-55.32.1.el10_0] - Bump internal version to 55.32.1 - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() - CVE-2025-38352 diff --git a/sources b/sources index 047e2a263..b35ee29e4 100644 --- a/sources +++ b/sources @@ -1,7 +1,7 @@ SHA512 (fedoraimaca.x509) = e04809394f4472c17e86d7024dee34f03fb68e82a85502fd5b00535202c72e57626a8376b2cf991b7e1e46404aa5ab8d189ebf320e0dd37d49e7efbc925c7a2e -SHA512 (kernel-abi-stablelists-6.12.0-55.32.1.el10_0.tar.xz) = 6fee4a7489cd6ee6048a2299bb42052b0dad0f40d9edd6f9412286728ddc25e5fd491605c7f176284cce339660d0d2585c02e20b3460ebdef08152a70cb81c33 -SHA512 (kernel-kabi-dw-6.12.0-55.32.1.el10_0.tar.xz) = 95e56376dcb6f68300626e83bc60ca36443866f04e600f0a3eeb459435ee1f1cc3287d578209d5c1522fa0cc3e5a0c7999d573e46c9070bc0001e49c9fb8f9aa -SHA512 (linux-6.12.0-55.32.1.el10_0.tar.xz) = 7b2b6848c82eb3611ae55036e1858e50afa708378ce005df80054482a1ea4c16b6ea3e7737359f1f1dd96ff7f84e0fef4daf48c29f30a74a53f5d43729829dcb +SHA512 (kernel-abi-stablelists-6.12.0-55.33.1.el10_0.tar.xz) = 6fee4a7489cd6ee6048a2299bb42052b0dad0f40d9edd6f9412286728ddc25e5fd491605c7f176284cce339660d0d2585c02e20b3460ebdef08152a70cb81c33 +SHA512 (kernel-kabi-dw-6.12.0-55.33.1.el10_0.tar.xz) = 95e56376dcb6f68300626e83bc60ca36443866f04e600f0a3eeb459435ee1f1cc3287d578209d5c1522fa0cc3e5a0c7999d573e46c9070bc0001e49c9fb8f9aa +SHA512 (linux-6.12.0-55.33.1.el10_0.tar.xz) = e54e510d365f949ce86975c315eb6c91b8d82396c9e2d7c6a5b38eaade0005b7e37f6e864013e7fc78a64602644afa9d89f2b1019484e565ad953f64dbfd1ccc SHA512 (nvidiagpuoot001.x509) = b42f836e1cfa07890cb6ca13de9c3950e306c9ec7686c4c09f050bb68869f5d82962b2cd5f3aa0eb7a0f3a3ae54e9c480eafbac5df53aa92c295ff511a8c59fe SHA512 (olima1.x509) = 123c26c1d698cc8523845c6e1103b9c72abf855acd225d37baf1f3388a47f912166d6d786fb367fe46de39e011b586ad7f3963aa2e8923da30a6ea9ae0d76ad3 SHA512 (olimaca1.x509) = 3a779415fad29d6f7250ec97ab1f0a5eb62c351b724feee06b22e17f065bf74a558f32cc524d3222c4485635ae5b9cd5287855c94010fe743b51a4d954340c4c