diff --git a/.gitignore b/.gitignore index 1a277e8da..1e0c7f237 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,7 @@ fedoraimaca.x509 -kernel-abi-stablelists-6.12.0-211.34.1.el10_2.tar.xz -kernel-kabi-dw-6.12.0-211.34.1.el10_2.tar.xz -linux-6.12.0-211.34.1.el10_2.tar.xz +kernel-abi-stablelists-6.12.0-211.37.1.el10_2.tar.xz +kernel-kabi-dw-6.12.0-211.37.1.el10_2.tar.xz +linux-6.12.0-211.37.1.el10_2.tar.xz nvidiabfdpu.x509 nvidiagpuoot001.x509 nvidiajetsonsoc.x509 diff --git a/Makefile.rhelver b/Makefile.rhelver index d1c9acc5b..8193ded8d 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 2 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 211.34.1 +RHEL_RELEASE = 211.37.1 # # RHEL_REBASE_NUM diff --git a/kernel-aarch64-64k-debug-rhel.config b/kernel-aarch64-64k-debug-rhel.config index 6a1b0b1ec..8c954151d 100644 --- a/kernel-aarch64-64k-debug-rhel.config +++ b/kernel-aarch64-64k-debug-rhel.config @@ -5349,7 +5349,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_QORIQ=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC_MMIO is not set CONFIG_PVPANIC_PCI=m diff --git a/kernel-aarch64-64k-rhel.config b/kernel-aarch64-64k-rhel.config index 798f08446..d7184d179 100644 --- a/kernel-aarch64-64k-rhel.config +++ b/kernel-aarch64-64k-rhel.config @@ -5326,7 +5326,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_QORIQ=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC_MMIO is not set CONFIG_PVPANIC_PCI=m diff --git a/kernel-aarch64-debug-rhel.config b/kernel-aarch64-debug-rhel.config index c01200af9..c728fb0f1 100644 --- a/kernel-aarch64-debug-rhel.config +++ b/kernel-aarch64-debug-rhel.config @@ -5345,7 +5345,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_QORIQ=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC_MMIO is not set CONFIG_PVPANIC_PCI=m diff --git a/kernel-aarch64-rhel.config b/kernel-aarch64-rhel.config index e09afcf30..7a7f317b6 100644 --- a/kernel-aarch64-rhel.config +++ b/kernel-aarch64-rhel.config @@ -5322,7 +5322,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_QORIQ=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC_MMIO is not set CONFIG_PVPANIC_PCI=m diff --git a/kernel-aarch64-rt-64k-debug-rhel.config b/kernel-aarch64-rt-64k-debug-rhel.config index c73331f0c..fe4a1928f 100644 --- a/kernel-aarch64-rt-64k-debug-rhel.config +++ b/kernel-aarch64-rt-64k-debug-rhel.config @@ -5393,7 +5393,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_QORIQ=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC_MMIO is not set CONFIG_PVPANIC_PCI=m diff --git a/kernel-aarch64-rt-64k-rhel.config b/kernel-aarch64-rt-64k-rhel.config index 41d7e0195..c15f4ee5a 100644 --- a/kernel-aarch64-rt-64k-rhel.config +++ b/kernel-aarch64-rt-64k-rhel.config @@ -5370,7 +5370,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_QORIQ=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC_MMIO is not set CONFIG_PVPANIC_PCI=m diff --git a/kernel-aarch64-rt-debug-rhel.config b/kernel-aarch64-rt-debug-rhel.config index abc1ead8b..2bb35d529 100644 --- a/kernel-aarch64-rt-debug-rhel.config +++ b/kernel-aarch64-rt-debug-rhel.config @@ -5389,7 +5389,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_QORIQ=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC_MMIO is not set CONFIG_PVPANIC_PCI=m diff --git a/kernel-aarch64-rt-rhel.config b/kernel-aarch64-rt-rhel.config index e21eaab03..39be57f9d 100644 --- a/kernel-aarch64-rt-rhel.config +++ b/kernel-aarch64-rt-rhel.config @@ -5366,7 +5366,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_QORIQ=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC_MMIO is not set CONFIG_PVPANIC_PCI=m diff --git a/kernel-ppc64le-debug-rhel.config b/kernel-ppc64le-debug-rhel.config index 0892e9496..13e50f79c 100644 --- a/kernel-ppc64le-debug-rhel.config +++ b/kernel-ppc64le-debug-rhel.config @@ -4914,7 +4914,7 @@ CONFIG_PTP_1588_CLOCK_KVM=m CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC is not set # CONFIG_PVPANIC_MMIO is not set diff --git a/kernel-ppc64le-rhel.config b/kernel-ppc64le-rhel.config index 5ed1ba308..c14817c4b 100644 --- a/kernel-ppc64le-rhel.config +++ b/kernel-ppc64le-rhel.config @@ -4893,7 +4893,7 @@ CONFIG_PTP_1588_CLOCK_KVM=m CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC is not set # CONFIG_PVPANIC_MMIO is not set diff --git a/kernel-riscv64-debug-rhel.config b/kernel-riscv64-debug-rhel.config index 06d56bfd3..7004c70eb 100644 --- a/kernel-riscv64-debug-rhel.config +++ b/kernel-riscv64-debug-rhel.config @@ -4828,7 +4828,7 @@ CONFIG_PTP_1588_CLOCK_KVM=m CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC is not set # CONFIG_PVPANIC_MMIO is not set diff --git a/kernel-riscv64-rhel.config b/kernel-riscv64-rhel.config index 0d82dad4b..48e9948bf 100644 --- a/kernel-riscv64-rhel.config +++ b/kernel-riscv64-rhel.config @@ -4807,7 +4807,7 @@ CONFIG_PTP_1588_CLOCK_KVM=m CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC is not set # CONFIG_PVPANIC_MMIO is not set diff --git a/kernel-s390x-debug-rhel.config b/kernel-s390x-debug-rhel.config index 3603e59d4..4612cb792 100644 --- a/kernel-s390x-debug-rhel.config +++ b/kernel-s390x-debug-rhel.config @@ -4851,7 +4851,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK=y CONFIG_PTP_S390=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC is not set # CONFIG_PVPANIC_MMIO is not set diff --git a/kernel-s390x-rhel.config b/kernel-s390x-rhel.config index d77d9c294..40a2b54fc 100644 --- a/kernel-s390x-rhel.config +++ b/kernel-s390x-rhel.config @@ -4830,7 +4830,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK=y CONFIG_PTP_S390=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC is not set # CONFIG_PVPANIC_MMIO is not set diff --git a/kernel-s390x-zfcpdump-rhel.config b/kernel-s390x-zfcpdump-rhel.config index 9cfa5b166..990151517 100644 --- a/kernel-s390x-zfcpdump-rhel.config +++ b/kernel-s390x-zfcpdump-rhel.config @@ -4842,7 +4842,7 @@ CONFIG_PTP_1588_CLOCK_KVM=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK=y # CONFIG_PTP_S390 is not set -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set # CONFIG_PVPANIC is not set # CONFIG_PVPANIC_MMIO is not set diff --git a/kernel-x86_64-debug-rhel.config b/kernel-x86_64-debug-rhel.config index 776b18663..2985ba5f5 100644 --- a/kernel-x86_64-debug-rhel.config +++ b/kernel-x86_64-debug-rhel.config @@ -5190,7 +5190,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_VMW=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set CONFIG_PVH=y CONFIG_PVPANIC_MMIO=m diff --git a/kernel-x86_64-rhel.config b/kernel-x86_64-rhel.config index df59865cb..b390068c4 100644 --- a/kernel-x86_64-rhel.config +++ b/kernel-x86_64-rhel.config @@ -5168,7 +5168,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_VMW=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set CONFIG_PVH=y CONFIG_PVPANIC_MMIO=m diff --git a/kernel-x86_64-rt-debug-rhel.config b/kernel-x86_64-rt-debug-rhel.config index f4fb35a3a..8b1a48730 100644 --- a/kernel-x86_64-rt-debug-rhel.config +++ b/kernel-x86_64-rt-debug-rhel.config @@ -5234,7 +5234,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_VMW=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set CONFIG_PVH=y CONFIG_PVPANIC_MMIO=m diff --git a/kernel-x86_64-rt-rhel.config b/kernel-x86_64-rt-rhel.config index c8d54075a..6823de63e 100644 --- a/kernel-x86_64-rt-rhel.config +++ b/kernel-x86_64-rt-rhel.config @@ -5212,7 +5212,7 @@ CONFIG_PTP_1588_CLOCK_MOCK=m # CONFIG_PTP_1588_CLOCK_OCP is not set CONFIG_PTP_1588_CLOCK_VMW=m CONFIG_PTP_1588_CLOCK=y -CONFIG_PT_RECLAIM=y +# CONFIG_PT_RECLAIM is not set # CONFIG_PUNIT_ATOM_DEBUG is not set CONFIG_PVH=y CONFIG_PVPANIC_MMIO=m diff --git a/kernel.changelog b/kernel.changelog index 7b520ed97..d00cd8062 100644 --- a/kernel.changelog +++ b/kernel.changelog @@ -1,4 +1,75 @@ -* Mon Jul 13 2026 CKI KWF Bot [6.12.0-211.34.1.el10_2] +* Tue Jul 21 2026 CKI KWF Bot [6.12.0-211.37.1.el10_2] +- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] +- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} +Resolves: RHEL-180076, RHEL-212681 + +* Mon Jul 20 2026 CKI KWF Bot [6.12.0-211.36.1.el10_2] +- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} +- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} +- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] +- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] +- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] +- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] +- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] +- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] +- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} +- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] +- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] +- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] +- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] +- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] +- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] +- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] +- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] +- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] +- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] +- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] +- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] +- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] +- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] +- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] +- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] +- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] +- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} +- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] +- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] +- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] +- bitmap: switch test to scnprintf("%%*pbl") (Jakub Ramaseuski) [RHEL-191324] +- bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] +- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] +- include: update references to include/asm- (Jakub Ramaseuski) [RHEL-191324] +- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} +- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} +- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} +- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} +Resolves: RHEL-180167, RHEL-188644, RHEL-189576, RHEL-189604, RHEL-191324, RHEL-192200 + +* Thu Jul 16 2026 CKI KWF Bot [6.12.0-211.35.1.el10_2] +- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} +- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] +- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] +- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] +- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] +- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] +- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] +- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] +- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] +- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] +- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} +- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] +- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} +- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} +- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} +- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] +- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] +Resolves: RHEL-173103, RHEL-179887, RHEL-180697, RHEL-183975, RHEL-186311, RHEL-188331, RHEL-189658, RHEL-192232 + +* Tue Jul 14 2026 Jan Stancek [6.12.0-211.34.1.el10_2] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] diff --git a/kernel.spec b/kernel.spec index 72313a59a..2ae8b1f5f 100644 --- a/kernel.spec +++ b/kernel.spec @@ -98,7 +98,7 @@ Summary: The Linux kernel %if 0%{?fedora} %define secure_boot_arch x86_64 %else -%define secure_boot_arch x86_64 aarch64 s390x ppc64le +%define secure_boot_arch x86_64 s390x ppc64le %endif # Signing for secure boot authentication @@ -176,15 +176,15 @@ Summary: The Linux kernel %define specrpmversion 6.12.0 %define specversion 6.12.0 %define patchversion 6.12 -%define pkgrelease 211.34.1 +%define pkgrelease 211.37.1 %define kversion 6 -%define tarfile_release 6.12.0-211.34.1.el10_2 +%define tarfile_release 6.12.0-211.37.1.el10_2 # This is needed to do merge window version magic %define patchlevel 12 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 211.34.1%{?buildid}%{?dist} +%define specrelease 211.37.1%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 6.12.0-211.34.1.el10_2 +%define kabiversion 6.12.0-211.37.1.el10_2 # If this variable is set to 1, a bpf selftests build failure will cause a # fatal kernel package build error @@ -717,6 +717,8 @@ Requires: ((%{name}-modules-extra-uname-r = %{KVERREL}) if %{name}-modules-extra Provides: installonlypkg(kernel) %endif +Provides: oracle(kernel-sig-key) == 202502 +Conflicts: shim-x64 < 15.8-1.0.6 # # List the packages used during the kernel build @@ -887,8 +889,6 @@ BuildRequires: tpm2-tools %if 0%{?rhel}%{?centos} && !0%{?eln} %if 0%{?centos} BuildRequires: centos-sb-certs >= 9.0-23 -%else -BuildRequires: redhat-sb-certs >= 9.4-0.1 %endif %endif %endif @@ -908,42 +908,11 @@ Source10: redhatsecurebootca5.cer Source13: redhatsecureboot501.cer %if %{signkernel} -# Name of the packaged file containing signing key -%ifarch ppc64le -%define signing_key_filename kernel-signing-ppc.cer -%endif -%ifarch s390x -%define signing_key_filename kernel-signing-s390.cer -%endif -# Fedora/ELN pesign macro expects to see these cert file names, see: -# https://github.com/rhboot/pesign/blob/main/src/pesign-rpmbuild-helper.in#L216 -%if 0%{?fedora}%{?eln} -%define pesign_name_0 redhatsecureboot501 -%define secureboot_ca_0 %{SOURCE10} -%define secureboot_key_0 %{SOURCE13} -%endif - -# RHEL/centos certs come from system-sb-certs -%if 0%{?rhel} && !0%{?eln} %define secureboot_ca_0 %{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer %define secureboot_key_0 %{_datadir}/pki/sb-certs/secureboot-kernel-%{_arch}.cer -%if 0%{?centos} -%define pesign_name_0 centossecureboot201 -%else -%ifarch x86_64 aarch64 -%define pesign_name_0 redhatsecureboot801 -%endif -%ifarch s390x -%define pesign_name_0 redhatsecureboot302 -%endif -%ifarch ppc64le -%define pesign_name_0 redhatsecureboot701 -%endif -%endif -# rhel && !eln -%endif +%define pesign_name_0 OracleLinuxSecureBootKey3 # signkernel %endif @@ -1030,6 +999,10 @@ Source105: rhelima_centos.x509 Source106: fedoraimaca.x509 Source107: nvidiajetsonsoc.x509 Source108: nvidiabfdpu.x509 +# Oracle Linux IMA CA certificate +Source109: olimaca1.x509 +# Oracle Linux IMA signing certificate +Source110: olima1.x509 %if 0%{?fedora}%{?eln} %define ima_ca_cert %{SOURCE106} @@ -1044,9 +1017,11 @@ Source108: nvidiabfdpu.x509 %define ima_signing_cert %{SOURCE105} %else %define ima_signing_cert %{SOURCE104} +%define ima_signing_cert_ol %{SOURCE110} %endif %define ima_cert_name ima.cer +%define ima_cert_name_ol ima_ol.cer Source200: check-kabi @@ -1117,6 +1092,10 @@ Source4000: README.rst Source4001: rpminspect.yaml Source4002: gating.yaml +# Oracle Linux RHCK Module Signing Key +Source5001: olkmod_signing_key.pem +Source5002: olkmod_signing_key1.pem + ## Patches needed for building this package %if !%{nopatches} @@ -1964,6 +1943,8 @@ ApplyOptionalPatch() mv linux-%{tarfile_release} linux-%{KVERREL} cd linux-%{KVERREL} +#removal of git history +rm -rf .git cp -a %{SOURCE1} . %{log_msg "Start of patch applications"} @@ -2100,6 +2081,13 @@ openssl x509 -inform der -in %{SOURCE102} -out nvidiagpuoot001.pem openssl x509 -inform der -in %{SOURCE107} -out nvidiajetsonsoc.pem openssl x509 -inform der -in %{SOURCE108} -out nvidiabfdpu.pem cat rheldup3.pem rhelkpatch1.pem nvidiagpuoot001.pem nvidiajetsonsoc.pem nvidiabfdpu.pem >> ../certs/rhel.pem +# Add Oracle Linux IMA CA certificate to the kernel trusted certificates list +openssl x509 -inform der -in %{SOURCE109} -out olimaca1.pem +cat olimaca1.pem >> ../certs/rhel.pem +# Add olkmod_signing_key.pem to the kernel trusted certificates list +cat %{SOURCE5001} >> ../certs/rhel.pem +# Add olkmod_signing_key1.pem to the kernel trusted certificates list +cat %{SOURCE5002} >> ../certs/rhel.pem # rhelkeys %endif %if %{signkernel} @@ -2125,7 +2113,7 @@ done %if 0%{?rhel} %{log_msg "Adjust FIPS module name for RHEL"} for i in *.config; do - sed -i 's/CONFIG_CRYPTO_FIPS_NAME=.*/CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux %{rhel} - Kernel Cryptographic API"/' $i + sed -i 's/CONFIG_CRYPTO_FIPS_NAME=.*/CONFIG_CRYPTO_FIPS_NAME="Oracle Linux 10 Kernel Crypto API Cryptographic Module"/' $i done %endif @@ -2795,6 +2783,7 @@ BuildKernel() { python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} @uki-addons.sbat %if %{signkernel} +%if ! %{?oraclelinux} %{log_msg "Sign the EFI UKI kernel"} %if 0%{?fedora}%{?eln} %pesign -s -i $KernelUnifiedImage -o $KernelUnifiedImage.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0} @@ -2826,6 +2815,7 @@ BuildKernel() { cp -a $UKI_secureboot_cert $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/secureboot-uki-%{_arch}.cer # signkernel +%endif %endif # hmac sign the UKI for FIPS @@ -2992,7 +2982,7 @@ BuildKernel() { # prune junk from kernel-debuginfo find $RPM_BUILD_ROOT/usr/src/kernels -name "*.mod.c" -delete - # Red Hat UEFI Secure Boot CA cert, which can be used to authenticate the kernel + # UEFI Secure Boot CA cert, which can be used to authenticate the kernel %{log_msg "Install certs"} mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer %if %{signkernel} @@ -3007,6 +2997,8 @@ BuildKernel() { %if 0%{?rhel} # Red Hat IMA code-signing cert, which is used to authenticate package files install -m 0644 %{ima_signing_cert} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/%{ima_cert_name} + # Oracle Linux IMA signing cert + install -m 0644 %{ima_signing_cert_ol} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/%{ima_cert_name_ol} %endif %if %{signmodules} @@ -4491,7 +4483,88 @@ fi\ # # %changelog -* Mon Jul 13 2026 CKI KWF Bot [6.12.0-211.34.1.el10_2] +* Tue Jul 21 2026 EL Errata [6.12.0-211.37.1.el10_2.OL10] +- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] +- Disable UKI signing [Orabug: 36571828] +- Update Oracle Linux certificates (Kevin Lyons) +- Disable signing for aarch64 (Ilya Okomin) +- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] +- Update x509.genkey [Orabug: 24817676] +- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9 +- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535] +- Add Oracle Linux IMA certificates +- Update module name for cryptographic module [Orabug: 37400433] +- Clean git history at setup stage + +* Tue Jul 21 2026 CKI KWF Bot [6.12.0-211.37.1.el10_2] +- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] +- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} + +* Mon Jul 20 2026 CKI KWF Bot [6.12.0-211.36.1.el10_2] +- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} +- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} +- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] +- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] +- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] +- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] +- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] +- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] +- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} +- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] +- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] +- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] +- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] +- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] +- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] +- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] +- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] +- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] +- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] +- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] +- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] +- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] +- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] +- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] +- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] +- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] +- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} +- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] +- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] +- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] +- bitmap: switch test to scnprintf("%%*pbl") (Jakub Ramaseuski) [RHEL-191324] +- bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] +- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] +- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] +- include: update references to include/asm- (Jakub Ramaseuski) [RHEL-191324] +- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} +- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} +- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} +- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} + +* Thu Jul 16 2026 CKI KWF Bot [6.12.0-211.35.1.el10_2] +- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} +- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] +- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] +- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] +- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] +- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] +- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] +- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] +- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] +- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] +- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} +- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] +- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} +- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} +- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} +- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] +- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] + +* Tue Jul 14 2026 Jan Stancek [6.12.0-211.34.1.el10_2] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] diff --git a/olkmod_signing_key.pem b/olkmod_signing_key.pem new file mode 100644 index 000000000..7a51daf16 --- /dev/null +++ b/olkmod_signing_key.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIEETCCAvmgAwIBAgIJANw8y5k9b7SaMA0GCSqGSIb3DQEBCwUAMIGeMQswCQYD +VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEXMBUGA1UEBwwOUmVkd29vZCBT +aG9yZXMxGzAZBgNVBAoMEk9yYWNsZSBDb3Jwb3JhdGlvbjEVMBMGA1UECwwMT3Jh +Y2xlIExpbnV4MS0wKwYDVQQDDCRPcmFjbGUgTGludXggUkhDSyBNb2R1bGUgU2ln +bmluZyBLZXkwHhcNMTYwNTA5MjMzNjA4WhcNMjYwNTA3MjMzNjA4WjCBnjELMAkG +A1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFzAVBgNVBAcMDlJlZHdvb2Qg +U2hvcmVzMRswGQYDVQQKDBJPcmFjbGUgQ29ycG9yYXRpb24xFTATBgNVBAsMDE9y +YWNsZSBMaW51eDEtMCsGA1UEAwwkT3JhY2xlIExpbnV4IFJIQ0sgTW9kdWxlIFNp +Z25pbmcgS2V5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl6bUDNNZ +jIqgsqgspwBIQ18keDxQeGnWgubZZhHrQU3GpeSRPM4lNTHc+UjMjNXrv/CENZdv +4cETRsxT1VFhGG3CvkbQdzc8v4JOQvWSSJqmViPa1eC+yGaMRnGcFXzKsHiTLA4y +WMjpJnVowFkwTzscRBlN0AysUg/hT/74DE0oqVnlCJNynqccNWpx8MtNRD55ay9A +73yJinYES14rXcU3QbJoO0ZxtRz83ZACDUGX0GORT3+NbB0RK0sttogzA3eLvxKw +umWsWZAHmTuHdWgUjSqqZr34VNLPVcsTHAW8X4bq6rRVcB2lMJ3kJfDP8BJyTn99 +37UmA+/ld47cnwIDAQABo1AwTjAdBgNVHQ4EFgQU3ZlbFVwZs6fD73cHuWniX5Y5 +Zm4wHwYDVR0jBBgwFoAU3ZlbFVwZs6fD73cHuWniX5Y5Zm4wDAYDVR0TBAUwAwEB +/zANBgkqhkiG9w0BAQsFAAOCAQEAF7nfhWfsk4uEDquLj7nJE0wPlVvllVDugzOk +R15pnQ7P+HTyz3sLaLJE4N5oWt6pFzDGDYEtPeoMCn1l447tX179Nf5SMZba9ut8 +3Vxbe7jAn9sQO7ArQR1swf1r101Me4+1oHq7rxPRizOOXrKeEvf5NSAUbSzzXfz6 +TEp21KTIQO7MjqpsKshRQbpPeiReaYy3A6gJftun5xekP04QTLZVBR4dL7tvZf0S +y9SjVg158lONXHfjBekyYTzSFBn/7v+AS8S+cAGRfYteE0Syxl7zJt3GUoEWau/e +kXHT+hd/hkdSQKZZWZo1380M1pVZZAvntLRBU6IN9SswafhiVg== +-----END CERTIFICATE----- diff --git a/olkmod_signing_key1.pem b/olkmod_signing_key1.pem new file mode 100644 index 000000000..b99afba7a --- /dev/null +++ b/olkmod_signing_key1.pem @@ -0,0 +1,35 @@ +-----BEGIN CERTIFICATE----- +MIIGBjCCA+6gAwIBAgIUf99zHRXkhhuQepjkXdIfz1kNGiwwDQYJKoZIhvcNAQEL +BQAwgZ4xKTAnBgNVBAMMIE9yYWNsZSBMaW51eCBEcml2ZXIgU2lnbmluZyBDQSAx +MQswCQYDVQQGEwJ1czEVMBMGA1UEBwwMUmVkd29vZCBDaXR5MRswGQYDVQQKDBJP +cmFjbGUgQ29ycG9yYXRpb24xGzAZBgNVBAsMEk9yYWNsZSBDb3Jwb3JhdGlvbjET +MBEGA1UECAwKQ2FsaWZvcm5pYTAeFw0yNTA1MDIwOTIzNDFaFw0zNjA0MTIyMTEw +MjlaMGcxLDAqBgNVBAMMI09yYWNsZSBMaW51eCBEcml2ZXIgU2lnbmluZyAoa2V5 +IDEpMQswCQYDVQQGEwJ1czEVMBMGA1UEBwwMUmVkd29vZCBDaXR5MRMwEQYDVQQI +DApDYWxpZm9ybmlhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5dMQ +z4EwgCYLrxJCYTn0H5yncdJREDgAgkne3nQAmtJjfcoKNqRxieK5j1KjloF3Qvjt +c5gITvjpne1UrHTodPF9qpJrFieDPb9+CMUGg/R/gk20PofKa5+DhTMyeIEpBOa7 +P6/OdCGiwaGI85Js6JMnNX2YKerehKB44zVfiNmddn7T/3y2QFFNj3VH62tC4XNt +wZLCHnnO0JzOcZht5KA1JsITSLkT6/o//SZLpaNSAQkkanymdvszV5b0PDu4A0Fi +5Ch41Akset2kAlpRoRBaVVdNhqKDyzsGRFyzHD57EyyY4M6H3yh2T6SPPOTUOKgn +tcBfnFuijl2K/d87cnky1v1XzrvZqLzRz11ksLmZrUHZZ3PWfq2EndG8OiO4PdcF +sF4nd20yuUywW4nj5iZT5h6f8P06C62ILe+dJWNzpGm6JgyYvTnHoUXjoQR+TLs/ +WY1l1N2uf3lc5rkof4g+Ckh/6uI1k5XfyHIzw8Z9wEOliUvHXq/8TVZ653IMmfC8 +gIrIMNOXONMdG7ReTnsr9z7ckv/dYKbW1gWtyY8o92N3dLuYb8MpfvCHkVF5ItUR +52ay2wOQ1tDlfLUiU21yiglyW4rKanH6mrLd4mM8cphnPvRpZ9SM0qykwHrNqKOA +m9p0AwIf1zmUL6boX/Xd+6zM2HAXOPMS1EGjA6MCAwEAAaNyMHAwDAYDVR0TAQH/ +BAIwADALBgNVHQ8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHQYDVR0OBBYE +FDUwOWM0ZjZkYmZjMGUyODhjOGM4MB8GA1UdIwQYMBaAFGM2NDkzM2I4OWUzNTYw +ZmVhNWQzMA0GCSqGSIb3DQEBCwUAA4ICAQAmZbUs5P2HGRHt4W/QhGyfxxa/Go8K +6a1VZlh71OURsbQ42ZDCfrYgw8LtDPqx7ySlUlkjDcc7ZvRh6RzLyn+ARIohhKNH +PpEzIpOGm5P4zqY9R36STRSgCDl9iCNlk8pGKzqEIT+aCaZUWF+7NcFgePFDuN9W +FX5tXhxEqqn8rmvGMQ3ZtodxIJb6ksKz6j/JWnuvcD4EgI1ykyc8MAtIm2/qVmPQ +IofwXo6yL6ygT5K7cMsrte4EbzrHvuhuz89RHDmwmgB6XmZCWBOGYrO7lza2Yx0C +/m4LcUHPW6XgrtkvIcLST90Ng9fp8EQl7Rp3med0K83kdwKUt7Ju9aPze049tuTQ +QoHsIHDgsExK4wXUayHNgNNr8lMFm42gTB2DqP9F/Ihq7YhIdfXbOsVdS38Il9+Y +8RWI87H+0mAxsv2RnaNkEbmd+2vY9j1ebHyblN59mxDEY+h3W7v402ay01Ia2Lnw +szOAPq6AKZdfi0nan6zunurwEGKGeF4+Gr42RlA0Pcu1ZltBQVuMhvkO1wKZ5vO6 +MNR7swI0fH6VsyUms8wQbR85MCJg0MhpzRKw0g0Ka+c4nF1c4EmU4GaIbCNfzJy+ +68wdJDHhX+sbD7+AJBQ9i6TmtbPIGKNDHh9cMIXs+jMRtia/ZCYEsOOO5B+xrawF +JuZ4rgQv9ghmhQ== +-----END CERTIFICATE----- diff --git a/sources b/sources index bf53715f4..3c56f5ef9 100644 --- a/sources +++ b/sources @@ -1,7 +1,7 @@ SHA512 (fedoraimaca.x509) = e04809394f4472c17e86d7024dee34f03fb68e82a85502fd5b00535202c72e57626a8376b2cf991b7e1e46404aa5ab8d189ebf320e0dd37d49e7efbc925c7a2e -SHA512 (kernel-abi-stablelists-6.12.0-211.34.1.el10_2.tar.xz) = 3866e09c54c7fda99741913617c9000b11d1e1555d584d3a72cf021d02fc81e89e1fd1cfbdd91d2ad1648da9d8fd07ab17d352a726f650eb2195f7cdcc5f3962 -SHA512 (kernel-kabi-dw-6.12.0-211.34.1.el10_2.tar.xz) = 7f89e69f121aa3cad12a639cda10c7ac19ba4e65882da631481ce36684048d22e97b1be80ad96bde03467223093977abc293232c134d50023a3ee8ee9aeb2aec -SHA512 (linux-6.12.0-211.34.1.el10_2.tar.xz) = 19fef0fe35ef9e377e9b8673cd3e5faacd4936d7c2b0acec38f2a06e6d9d3164199c49f85b161b9dc41776440e02a0fd4e7bec8fc70e7088d1b699ccea86ca4e +SHA512 (kernel-abi-stablelists-6.12.0-211.37.1.el10_2.tar.xz) = 5517b9dcf4db6381f0d576a6160e1bd9b1c4d4c314fd432b15497c8b75ef370b6a8e973912b81f3164c8951d65e89f0ec3b8fc1e5e32fdf399ede683968bcd5b +SHA512 (kernel-kabi-dw-6.12.0-211.37.1.el10_2.tar.xz) = 57aaae94c0eb6ea3a675becaa3eb8a7ec80873ac8b98a6ce2713e2d13e33a4b2b641e93411da06b3b7e2ae9249dc506a64a2796baa37013542a7a7ed97610078 +SHA512 (linux-6.12.0-211.37.1.el10_2.tar.xz) = 93c3524ed4c49c814f58aca7ea6bc72f94fd523083c6afc0671caea64817ecb82ed6688866d851cccc98e495cd3b566c4de5baed7e2e5067036ab01cefabf3ec SHA512 (nvidiabfdpu.x509) = d9f4fbafcec66803c5944df1f97d4348968141c968e6537252c9854c89dca8ea3be225a9c40abbbf2b7d4d3cfd8c5012cd2d34d90443fbc0277b7a018622ac4f SHA512 (nvidiagpuoot001.x509) = b42f836e1cfa07890cb6ca13de9c3950e306c9ec7686c4c09f050bb68869f5d82962b2cd5f3aa0eb7a0f3a3ae54e9c480eafbac5df53aa92c295ff511a8c59fe SHA512 (nvidiajetsonsoc.x509) = 3c6d4f0800b3fae3c3cc3e5361de31df233e230ea96f0fdd3dcc713e6a71e27309f60e7a98d1a4a90d470f336ce311f22fcc88f219429272e96339717fe001dd diff --git a/x509.genkey.rhel b/x509.genkey.rhel index b1bbe387f..5b7056d65 100644 --- a/x509.genkey.rhel +++ b/x509.genkey.rhel @@ -5,9 +5,9 @@ prompt = no x509_extensions = myexts [ req_distinguished_name ] -O = Red Hat -CN = Red Hat Enterprise Linux kernel signing key -emailAddress = secalert@redhat.com +O = Oracle America, Inc.,c=US +CN = Oracle CA Server +emailAddress = support@oracle.com [ myexts ] basicConstraints=critical,CA:FALSE