Apply on a9-beta the same four local patches that were carried on
the a9 branch until upstream landed them via the CKI Backport Bot
in 5.14.0-611.55.1.el9_7. Blobs imported verbatim from a9 history:
1100-xfrm-esp-avoid-in-place-decrypt-shared-skb-frags.patch
CVE-2026-43284 -- el9 backport of upstream f4c50a4034e6.
1101-rxrpc-linearize-paged-frags.patch
CVE-2026-43500.
1102-net-skbuff-propagate-shared-frag-marker.patch
CVE-2026-46300 ("Fragnesia") -- v3 sibling to the xfrm/esp fix,
propagates SKBFL_SHARED_FRAG through __pskb_copy_fclone(),
skb_try_coalesce(), skb_shift(), skb_gro_receive() and
skb_gro_receive_list().
1103-ptrace-require-cap-on-mm-less-task.patch
CVE-2026-46333; kABI-safe replacement for upstream 31e62c2ebbfd
which would alter task_struct.
All four verified to apply with `patch -p1 -F0` against the
5.14.0-687.5.1.el9_8 source tree (offsets only, no fuzz, no
rejects). Release bumped 687.5.1 -> 687.5.3 with a single new
changelog stanza.
===================
The Kernel dist-git
===================
The kernel is maintained in a `source tree`_ rather than directly in dist-git.
The specfile is maintained as a `template`_ in the source tree along with a set
of build scripts to generate configurations, (S)RPMs, and to populate the
dist-git repository.
The `documentation`_ for the source tree covers how to contribute and maintain
the tree.
If you're looking for the downstream patch set it's available in the source
tree with "git log master..ark-patches" or
`online`_.
Each release in dist-git is tagged in the source repository so you can easily
check out the source tree for a build. The tags are in the format
name-version-release, but note release doesn't contain the dist tag since the
source can be built in different build roots (Fedora, CentOS, etc.)
.. _source tree: https://gitlab.com/cki-project/kernel-ark.git
.. _template: https://gitlab.com/cki-project/kernel-ark/-/blob/os-build/redhat/kernel.spec.template
.. _documentation: https://gitlab.com/cki-project/kernel-ark/-/wikis/home
.. _online: https://gitlab.com/cki-project/kernel-ark/-/commits/ark-patches
Andrew Lukoshko
08f074dc92