rpms/kernel
11
4
Fork 6
Code Issues Pull requests Releases Activity
0 releases 1,141 tags
  • changed/a10/kernel-6.12.0-211.7.4.el10_2 b3c4cf07f6

    Bump version to 6.12.0-211.7.4

    alukoshko released this 2026-05-28 11:55:58 +00:00 | -7 commits to c8 since this release

    Refresh the dirtyfrag backport to upstream v5 and add the cifs.spnego
    hardening patch.

    1103-net-skbuff-propagate-shared-frag-marker.patch
    Refreshed from upstream v3 to v5
    (https://lore.kernel.org/all/ageeJfJHwgzmKXbh@v4bel/). The v5
    series adds three hunks on top of v3: two skb_segment() sites
    (fold frag_skb-> flags into nskb on the per-iteration flag merge;
    fill the marker again when the inner switch rebinds frag_skb on
    head_skb-frags exhaustion) and one tcp_clone_payload() site
    (carry the marker when building an MTU probe skb from sk_write_queue
    frag descriptors). skb_try_coalesce() hunk is retained as in v3/v4
    because the upstream commit that dropped it (f84eca581739) is only
    partially backported in 6.12 -- its skb_split() half is present,
    but the skb_try_coalesce() half is missing.

    1105-smb-client-reject-userspace-cifs.spnego-descriptions.patch
    Upstream commit 3da1fdf4efbc verbatim. Refuses userspace-created
    cifs.spnego keys via request_key(2)/add_key(2); only kernel CIFS
    using the private spnego_cred may create them. cifs.upcall
    treats the key description as kernel-originating
    pid/uid/creduid/upcall_target -- without this fence, userspace
    can spoof those fields.

    All five patches verified to apply with patch -p1 -F0 against the
    6.12.0-211.7.1.el10_2 source tree (no fuzz, no rejects).

    Downloads