From 1ee70ced294bc87d6d15a98bd35a0b6bd0c5cb75 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Thu, 29 Oct 2026 08:39:17 -0700 Subject: [PATCH] fix(os/mkosi): bump the guest kernel to 6.18.59 6.18.40 is affected by CVE-2026-98432, a use-after-free in ip_options_build() caused by freeing inet_opt/ireq_opt without waiting for an RCU grace period. The fix landed in 6.18.56. Patches 0003 (dma-direct) and 0005 (swiotlb) are now in linux-6.18.y and reverse-apply cleanly on 6.18.59, so mkosi stops applying them. The deprecated Yocto backend keeps them for its own pinned kernel. Signed-off-by: Kevin Wang --- os/mkosi/components/kernel/kernel-build.sh | 2 -- os/mkosi/components/kernel/kernel.sh | 2 -- os/mkosi/versions.env | 4 ++-- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/os/mkosi/components/kernel/kernel-build.sh b/os/mkosi/components/kernel/kernel-build.sh index 68ad91f30..d21c16442 100755 --- a/os/mkosi/components/kernel/kernel-build.sh +++ b/os/mkosi/components/kernel/kernel-build.sh @@ -56,9 +56,7 @@ tar -C "$BUILD_DIR" --no-same-owner -xf "$tarball" for patch in \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0001-x86-tdx-select-dma-direct-remap.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0002-acpi-sandbox-block-aml-systemmemory-ram-access.patch" \ - "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0003-dma-direct-return-struct-page-from-alloc-from-pool.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0004-dma-pool-free-atomic-pool-pages-by-physical-address.patch" \ - "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0005-swiotlb-preserve-allocation-virtual-address.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0006-swiotlb-free-dynamic-pools-from-process-context.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0007-sched-smp-batch-wake-q-ipis-in-tdx-guests.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0008-x86-kvm-runtime-pv-single-target-ipi-in-tdx-guests.patch" \ diff --git a/os/mkosi/components/kernel/kernel.sh b/os/mkosi/components/kernel/kernel.sh index b8c88a4e1..98ebe592c 100644 --- a/os/mkosi/components/kernel/kernel.sh +++ b/os/mkosi/components/kernel/kernel.sh @@ -12,9 +12,7 @@ component_cache_key() { key_file "$COMPONENT_PATH/kernel-build.sh" "$COMPONENT_PATH/kernel.config" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0001-x86-tdx-select-dma-direct-remap.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0002-acpi-sandbox-block-aml-systemmemory-ram-access.patch" \ - "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0003-dma-direct-return-struct-page-from-alloc-from-pool.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0004-dma-pool-free-atomic-pool-pages-by-physical-address.patch" \ - "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0005-swiotlb-preserve-allocation-virtual-address.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0006-swiotlb-free-dynamic-pools-from-process-context.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0007-sched-smp-batch-wake-q-ipis-in-tdx-guests.patch" \ "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0008-x86-kvm-runtime-pv-single-target-ipi-in-tdx-guests.patch" \ diff --git a/os/mkosi/versions.env b/os/mkosi/versions.env index f81fa8c8a..bcf1ac0a3 100644 --- a/os/mkosi/versions.env +++ b/os/mkosi/versions.env @@ -1,7 +1,7 @@ # SPDX-License-Identifier: Apache-2.0 # Every network input used by the mkosi backend is immutable or hashed. -KERNEL_VERSION=6.18.40 -KERNEL_SHA256=3712fc1ec839e4daac981176c8518912e8f452650aaedfe4381da4419613a431 +KERNEL_VERSION=6.18.59 +KERNEL_SHA256=53a55ac9863a5547e292b8e381d4e4c2240dd1127d5428a7c44dbc550be23963 DEBIAN_RELEASE=trixie DEBIAN_SNAPSHOT=20261021T000000Z # Base of the kernel module builder image. It must predate DEBIAN_SNAPSHOT: