From 40ccb0d0c51f96ccc63b4e839992699e7f6f225f Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Mon, 14 Sep 2026 13:39:11 +0400 Subject: [PATCH 01/10] chore: sync tools & toolchain Use the latest. Signed-off-by: Andrey Smirnov --- Pkgfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Pkgfile b/Pkgfile index 2ecd193c1..7f4ff8742 100644 --- a/Pkgfile +++ b/Pkgfile @@ -3,9 +3,9 @@ format: v1alpha2 vars: - TOOLCHAIN_MUSL_IMAGE: ghcr.io/siderolabs/toolchain-musl:v1.14.0-3-g386b969 + TOOLCHAIN_MUSL_IMAGE: ghcr.io/siderolabs/toolchain-musl:v1.14.0-4-gebafe88 TOOLS_PREFIX: ghcr.io/siderolabs/ - TOOLS_REV: v1.14.0-5-g87316ca + TOOLS_REV: v1.14.0-7-ga404efb LLVM_IMAGE: ghcr.io/siderolabs/llvm RUSTC_IMAGE: ghcr.io/siderolabs/rustc:v1.14.0 From c61bcc3b627d064ef162ee1f11944ea950d3eb39 Mon Sep 17 00:00:00 2001 From: "usman.malik_ext" Date: Sat, 22 Aug 2026 23:46:54 +0200 Subject: [PATCH 02/10] feat: enable CONFIG_XFRM_INTERFACE in the kernel XFRM interfaces are the only part of the XFRM stack still switched off. XFRM, XFRM_USER, XFRM_ALGO, XFRM_OFFLOAD and XFRM_STATISTICS are all enabled, so this fills the remaining gap for route-based IPsec. Without it only policy-based IPsec is possible. The kernel policy database holds one entry per selector pair, so two tunnels carrying the same subnets to different peers cannot both be installed - the second is refused, and the standby ends up waiting on its userspace daemon's retry timer rather than on the routing layer. An XFRM interface avoids that because routing decides what enters the tunnel, which is also what lets ECMP and BFD work over it. The option is a software netdev with no hardware dependency, and depends only on XFRM and IPV6, both already on. CONFIG_XFRM_STATISTICS was enabled the same way in #1052. Signed-off-by: imusmanmalik Signed-off-by: Andrey Smirnov (cherry picked from commit b6b284315268fa0bd4d5d9067ebaf35c3488fcd5) --- kernel/build/config-amd64 | 2 +- kernel/build/config-arm64 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index dc13c721b..61e9c5063 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -1302,7 +1302,7 @@ CONFIG_XFRM_OFFLOAD=y CONFIG_XFRM_ALGO=y CONFIG_XFRM_USER=y # CONFIG_XFRM_USER_COMPAT is not set -# CONFIG_XFRM_INTERFACE is not set +CONFIG_XFRM_INTERFACE=m # CONFIG_XFRM_SUB_POLICY is not set # CONFIG_XFRM_MIGRATE is not set CONFIG_XFRM_STATISTICS=y diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64 index 83f758bc3..2a5c2451d 100644 --- a/kernel/build/config-arm64 +++ b/kernel/build/config-arm64 @@ -1289,7 +1289,7 @@ CONFIG_XFRM=y CONFIG_XFRM_OFFLOAD=y CONFIG_XFRM_ALGO=y CONFIG_XFRM_USER=y -# CONFIG_XFRM_INTERFACE is not set +CONFIG_XFRM_INTERFACE=m # CONFIG_XFRM_SUB_POLICY is not set # CONFIG_XFRM_MIGRATE is not set CONFIG_XFRM_STATISTICS=y From 5ddbb530adcd048dc01350a302b10b71217a303a Mon Sep 17 00:00:00 2001 From: Sacha Weatherstone Date: Thu, 27 Aug 2026 10:27:31 +0800 Subject: [PATCH 03/10] feat: enable CONFIG_USB_LAN78XX and CONFIG_MICROCHIP_PHY on amd64 New modules for amd64: ``` kernel/drivers/net/usb/lan78xx.ko kernel/drivers/net/phy/microchip.ko ``` Signed-off-by: Sacha Weatherstone Signed-off-by: Andrey Smirnov (cherry picked from commit 539432102f629aaaac3467052d88c1c8c092e2bd) --- kernel/build/config-amd64 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index 61e9c5063..bd5b39624 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -3000,7 +3000,7 @@ CONFIG_MARVELL_10G_PHY=y # CONFIG_MEDIATEK_GE_PHY is not set # CONFIG_MICREL_PHY is not set # CONFIG_MICROCHIP_T1S_PHY is not set -# CONFIG_MICROCHIP_PHY is not set +CONFIG_MICROCHIP_PHY=m # CONFIG_MICROCHIP_T1_PHY is not set # CONFIG_MICROSEMI_PHY is not set # CONFIG_MOTORCOMM_PHY is not set @@ -3069,7 +3069,7 @@ CONFIG_USB_NET_DRIVERS=y # CONFIG_USB_PEGASUS is not set # CONFIG_USB_RTL8150 is not set CONFIG_USB_RTL8152=m -# CONFIG_USB_LAN78XX is not set +CONFIG_USB_LAN78XX=m CONFIG_USB_USBNET=m CONFIG_USB_NET_AX8817X=m CONFIG_USB_NET_AX88179_178A=m From 202a6778528823898d767696cf1701ac786ccfc0 Mon Sep 17 00:00:00 2001 From: Noel Georgi Date: Wed, 2 Sep 2026 23:00:40 +0530 Subject: [PATCH 04/10] feat: bump kernel to 6.18.49 Bump kernel to 6.18.49 Signed-off-by: Noel Georgi (cherry picked from commit 381fc2d45303a4909f65196c9875063e8010a009) --- Pkgfile | 6 +++--- kernel/build/config-amd64 | 2 +- kernel/build/config-arm64 | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Pkgfile b/Pkgfile index 7f4ff8742..f529d75a4 100644 --- a/Pkgfile +++ b/Pkgfile @@ -104,9 +104,9 @@ vars: kspp_sha512: 2b40c41ed0347a339053aef61c838b5131dd583fb0d1ac8f3361040361ba868724ad16dfdc13023ff2b0f51f32c0aba605316d5d76f9fc6c1d50d90b4ceedead # renovate: datasource=git-tags extractVersion=^v(?.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git - linux_version: 6.18.48 - linux_sha256: 5ebdadb10a4b5708fc6b1c457764a110bc49f8150cc3502c59b921ead8c6fc8c - linux_sha512: 711e08958a8a4c39206018d0222687dc5a01845a9226ae44f7d3f0cfcea76caae041cee958dfe8c0cfc8c728a5a2241b29018ccf1b7593b9615c27057d2628c4 + linux_version: 6.18.49 + linux_sha256: ae826f33111fea6f1d279dde7299d7463c8dfd204aeb75a8fb5432bc60a28191 + linux_sha512: 115af2b6004a49c16e424f56794f1313d2266591b4398d88a17011893b182ec23b711de49b832e3bab07183e03ab7b6152db434e487c3b12ac63b10761031647 # renovate: datasource=git-tags extractVersion=^libaio-(?.*)$ depName=https://pagure.io/libaio.git libaio_version: 0.3.113 diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index bd5b39624..86e0a7862 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.48 Kernel Configuration +# Linux/x86 6.18.49 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.8" CONFIG_GCC_VERSION=0 diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64 index 2a5c2451d..c06612a03 100644 --- a/kernel/build/config-arm64 +++ b/kernel/build/config-arm64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.18.48 Kernel Configuration +# Linux/arm64 6.18.49 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.8" CONFIG_GCC_VERSION=0 From 2415a010f6c115bde419cd9614b48b2a881c9f7c Mon Sep 17 00:00:00 2001 From: Dennis Docter Date: Tue, 1 Sep 2026 14:42:55 +0200 Subject: [PATCH 05/10] feat: add kernel modules to enable Intel HD audio Enable the Intel HD Audio stack as loadable modules on amd64, including: Intel PCI HDA controller support generic HDA codec support Realtek codec families commonly used for onboard audio HDMI/DisplayPort codecs for Intel, AMD, and NVIDIA GPUs Intel graphics audio-component integration the required ALSA jack, ELD, LED, and codec helper functionality Signed-off-by: Dennis Docter Signed-off-by: Andrey Smirnov (cherry picked from commit a8b682b77160d065c4662dd9f06f31c38a298ac6) --- kernel/build/config-amd64 | 60 +++++++++++++++++++++++++++++++++++++-- 1 file changed, 58 insertions(+), 2 deletions(-) diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index 86e0a7862..ee0251332 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -634,6 +634,7 @@ CONFIG_ACPI_HOTPLUG_IOAPIC=y CONFIG_ACPI_HED=y CONFIG_ACPI_BGRT=y # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set +CONFIG_ACPI_NHLT=y # CONFIG_ACPI_NFIT is not set CONFIG_ACPI_NUMA=y CONFIG_ACPI_HMAT=y @@ -5226,12 +5227,16 @@ CONFIG_SOUND=m CONFIG_SND=m CONFIG_SND_TIMER=m CONFIG_SND_PCM=m +CONFIG_SND_PCM_ELD=y CONFIG_SND_HWDEP=m CONFIG_SND_RAWMIDI=m +CONFIG_SND_JACK=y +CONFIG_SND_JACK_INPUT_DEV=y # CONFIG_SND_OSSEMUL is not set CONFIG_SND_PCM_TIMER=y # CONFIG_SND_HRTIMER is not set -# CONFIG_SND_DYNAMIC_MINORS is not set +CONFIG_SND_DYNAMIC_MINORS=y +CONFIG_SND_MAX_CARDS=32 CONFIG_SND_SUPPORT_OLD_API=y CONFIG_SND_PROC_FS=y CONFIG_SND_VERBOSE_PROCFS=y @@ -5239,7 +5244,9 @@ CONFIG_SND_CTL_FAST_LOOKUP=y # CONFIG_SND_DEBUG is not set # CONFIG_SND_CTL_INPUT_VALIDATION is not set # CONFIG_SND_UTIMER is not set +CONFIG_SND_VMASTER=y CONFIG_SND_DMA_SGBUF=y +CONFIG_SND_CTL_LED=m # CONFIG_SND_SEQUENCER is not set CONFIG_SND_DRIVERS=y # CONFIG_SND_PCSP is not set @@ -5319,8 +5326,57 @@ CONFIG_SND_PCI=y # # HD-Audio # -# CONFIG_SND_HDA_INTEL is not set +CONFIG_SND_HDA=m +# CONFIG_SND_HDA_HWDEP is not set +# CONFIG_SND_HDA_RECONFIG is not set +# CONFIG_SND_HDA_INPUT_BEEP is not set +# CONFIG_SND_HDA_PATCH_LOADER is not set +CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0 +# CONFIG_SND_HDA_CTL_DEV_ID is not set +CONFIG_SND_HDA_PREALLOC_SIZE=0 +CONFIG_SND_HDA_INTEL=m # CONFIG_SND_HDA_ACPI is not set +CONFIG_SND_HDA_GENERIC_LEDS=y +# CONFIG_SND_HDA_CODEC_ANALOG is not set +# CONFIG_SND_HDA_CODEC_SIGMATEL is not set +# CONFIG_SND_HDA_CODEC_VIA is not set +# CONFIG_SND_HDA_CODEC_CONEXANT is not set +# CONFIG_SND_HDA_CODEC_SENARYTECH is not set +# CONFIG_SND_HDA_CODEC_CA0110 is not set +# CONFIG_SND_HDA_CODEC_CA0132 is not set +# CONFIG_SND_HDA_CODEC_CMEDIA is not set +# CONFIG_SND_HDA_CODEC_CM9825 is not set +# CONFIG_SND_HDA_CODEC_SI3054 is not set +CONFIG_SND_HDA_GENERIC=m +CONFIG_SND_HDA_CODEC_REALTEK=m +CONFIG_SND_HDA_CODEC_REALTEK_LIB=m +CONFIG_SND_HDA_CODEC_ALC260=m +CONFIG_SND_HDA_CODEC_ALC262=m +CONFIG_SND_HDA_CODEC_ALC268=m +CONFIG_SND_HDA_CODEC_ALC269=m +CONFIG_SND_HDA_CODEC_ALC662=m +CONFIG_SND_HDA_CODEC_ALC680=m +CONFIG_SND_HDA_CODEC_ALC861=m +CONFIG_SND_HDA_CODEC_ALC861VD=m +CONFIG_SND_HDA_CODEC_ALC880=m +CONFIG_SND_HDA_CODEC_ALC882=m +# CONFIG_SND_HDA_CODEC_CIRRUS is not set +CONFIG_SND_HDA_CODEC_HDMI=m +CONFIG_SND_HDA_CODEC_HDMI_GENERIC=m +CONFIG_SND_HDA_CODEC_HDMI_SIMPLE=m +CONFIG_SND_HDA_CODEC_HDMI_INTEL=m +# CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set +CONFIG_SND_HDA_CODEC_HDMI_ATI=m +CONFIG_SND_HDA_CODEC_HDMI_NVIDIA=m +CONFIG_SND_HDA_CODEC_HDMI_NVIDIA_MCP=m +CONFIG_SND_HDA_CODEC_HDMI_TEGRA=m +CONFIG_SND_HDA_SCODEC_COMPONENT=m +CONFIG_SND_HDA_CORE=m +CONFIG_SND_HDA_COMPONENT=y +CONFIG_SND_HDA_I915=y +CONFIG_SND_INTEL_NHLT=y +CONFIG_SND_INTEL_DSP_CONFIG=m +CONFIG_SND_INTEL_SOUNDWIRE_ACPI=m # end of HD-Audio CONFIG_SND_USB=y From fd0c2b2a5e0eb870dac4c75fccc1c205e20b5fe4 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Thu, 3 Sep 2026 20:44:06 +0400 Subject: [PATCH 06/10] fix: add a kernel patch for EFI SecureBoot integrity lockdown For 1.14.0, we dropped the lockdown=confidentialy flag from the Linux kernel cmdline to unify installers. The idea was that the Linux should enter integrity on SecureBoot, but it turns out that it's an out-of-tree patch, so bring it in here. Signed-off-by: Andrey Smirnov (cherry picked from commit 43e6298f76423318f9d8aa4469ed171271dd24a4) --- kernel/build/config-amd64 | 1 + kernel/build/config-arm64 | 1 + ...-lock-down-the-kernel-in-EFI-Secure-.patch | 90 +++++++++++++++++++ kernel/build/patches/README.md | 1 + 4 files changed, 93 insertions(+) create mode 100644 kernel/build/patches/0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index ee0251332..409dc0d11 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -6962,6 +6962,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y CONFIG_SECURITY_LANDLOCK=y # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64 index c06612a03..c4f4840d3 100644 --- a/kernel/build/config-arm64 +++ b/kernel/build/config-arm64 @@ -9742,6 +9742,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y CONFIG_SECURITY_LANDLOCK=y # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y diff --git a/kernel/build/patches/0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch b/kernel/build/patches/0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch new file mode 100644 index 000000000..a1c7bab77 --- /dev/null +++ b/kernel/build/patches/0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch @@ -0,0 +1,90 @@ +From: Andrey Smirnov +Date: Thu, 3 Sep 2026 12:00:00 +0400 +Subject: [PATCH] security/lockdown: lock down the kernel in EFI Secure Boot + mode + +Upstream offers no way to enter lockdown only when the machine was booted +with UEFI Secure Boot enabled: the default level is a build-time choice +(LOCK_DOWN_KERNEL_FORCE_*) which applies to every boot, so a single kernel +image cannot be `none` when booted without Secure Boot and `integrity` when +booted with it. Forcing `integrity` unconditionally is not an option, as it +would also require a signed kernel image for kexec on non-Secure Boot +installs. + +Distributions carry an out-of-tree patch for this (originally by David +Howells), keyed off an EFI_SECURE_BOOT flag which is itself out of tree and +is only plumbed into the kernel proper via boot_params on x86. + +Do the same thing arch-generically instead: once EFI runtime services are +up, read the `SecureBoot`/`SetupMode` EFI variables using the helper already +in and raise lockdown to integrity if Secure Boot is enabled. +As `lock_kernel_down()` never lowers the level, an explicit +`lockdown=confidentiality` on the kernel command line still wins. + +Signed-off-by: Andrey Smirnov +--- +diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig +index e84ddf4..a02aec3 100644 +--- a/security/lockdown/Kconfig ++++ b/security/lockdown/Kconfig +@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY + disabled. + + endchoice ++ ++config LOCK_DOWN_IN_EFI_SECURE_BOOT ++ bool "Lock down the kernel in EFI Secure Boot mode" ++ default n ++ depends on SECURITY_LOCKDOWN_LSM ++ depends on EFI ++ help ++ UEFI Secure Boot provides a mechanism for ensuring that the firmware ++ will only load signed bootloaders and kernels. Secure boot mode may ++ be determined from EFI variables provided by the system firmware if ++ not indicated by the boot parameters. ++ ++ Enabling this option turns on the kernel lockdown feature in ++ integrity mode if the kernel was booted on a platform with UEFI ++ Secure Boot enabled. +diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c +index cf83afa..da8b89a 100644 +--- a/security/lockdown/lockdown.c ++++ b/security/lockdown/lockdown.c +@@ -10,6 +10,7 @@ + * 2 of the Licence, or (at your option) any later version. + */ + ++#include + #include + #include + #include +@@ -93,6 +94,29 @@ static int __init lockdown_lsm_init(void) + return 0; + } + ++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT ++/* ++ * Raise the lockdown level to integrity when the machine was booted with UEFI ++ * Secure Boot enabled. ++ * ++ * This runs once EFI runtime services are available (efisubsys_init() is a ++ * subsys_initcall), which is still well before userspace is started. ++ */ ++static int __init lockdown_efi_secure_boot(void) ++{ ++ if (!efi_enabled(EFI_BOOT) || ++ !efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) ++ return 0; ++ ++ if (efi_get_secureboot_mode(efi.get_variable) == efi_secureboot_mode_enabled) ++ lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX); ++ ++ return 0; ++} ++ ++late_initcall(lockdown_efi_secure_boot); ++#endif ++ + static ssize_t lockdown_read(struct file *filp, char __user *buf, size_t count, + loff_t *ppos) + { diff --git a/kernel/build/patches/README.md b/kernel/build/patches/README.md index 83998c6ca..2be93bdc9 100644 --- a/kernel/build/patches/README.md +++ b/kernel/build/patches/README.md @@ -14,3 +14,4 @@ | `0014-libceph-add-support-for-CEPH_CRYPTO_AES256KRB5.patch` | libceph: the actual `aes256k` support — new key type `CEPH_CRYPTO_AES256KRB5` (`0x2`), AES256-CTS-HMAC-SHA384-192 via the in-kernel `crypto/krb5` library, per-usage AEAD tfms and confounder+HMAC framing. Fixes kclient auth against a cluster whose CephX keys have been rotated to `--key-type aes256k` for [CVE-2025-30156](https://docs.ceph.com/en/latest/security/CVE-2025-30156/). **Adds `select CRYPTO_KRB5` to `CEPH_LIB`** — hence `CONFIG_CRYPTO_KRB5`/`KRB5ENC`/`CAMELLIA` in both configs | Merged to mainline v7.0 | [`b7cc142dbafe`](https://git.kernel.org/torvalds/c/b7cc142dbafeaf6c053284ca9121b9f70b6d6d06), [pull req](https://lore.kernel.org/all/20260217173743.1840319-1-idryomov@gmail.com/) | | `0015-libceph-adapt-ceph_x_challenge_blob-hashing-and-msgr1.patch` | libceph: route the connect-challenge hashing and msgr1 message signing through the key-type-aware helpers so both work with `aes256k` keys | Merged to mainline v7.0 | [`8356b4b1103b`](https://git.kernel.org/torvalds/c/8356b4b1103b8c970648c94bab724aa30e42d869), [pull req](https://lore.kernel.org/all/20260217173743.1840319-1-idryomov@gmail.com/) | | `0016-libceph-Fix-potential-out-of-bounds-access-in-__ceph_.patch` | libceph: bounds-check the plaintext before dereferencing `hdr->magic` in `__ceph_x_decrypt()` — a short `FRAME_TAG_AUTH_REPLY_MORE` frame can read past the buffer. `Cc: stable` but never picked up into 6.18.y; applies on top of `0012`-`0015` | Merged to mainline v7.1 | [`821365487aa5`](https://git.kernel.org/torvalds/c/821365487aa58d06bda65c676ba215d506ba9768) | +| `0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch` | security/lockdown: add `LOCK_DOWN_IN_EFI_SECURE_BOOT`, which raises lockdown to `integrity` from a `late_initcall` when the `SecureBoot`/`SetupMode` EFI variables say UEFI Secure Boot is enabled. Upstream only has the build-time `LOCK_DOWN_KERNEL_FORCE_*` choice, which cannot be conditional on how the machine booted; the distro patch this replaces keys off an out-of-tree `EFI_SECURE_BOOT` flag that is only plumbed through `boot_params` on x86, so this reads the variables directly and works on arm64 too | Not submitted; distro-local (Fedora/SUSE carry an equivalent out-of-tree patch) | [talos#14237](https://github.com/siderolabs/talos/issues/14237), [SUSE `b1a0314b0827`](https://github.com/SUSE/kernel/commit/b1a0314b0827ea781c13a27abcc3c3b96fc0e946) | From 35e38987de3738c658d4da6d4349cdf61ab4a2ed Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Mon, 7 Sep 2026 09:59:35 +0400 Subject: [PATCH 07/10] feat: update containerd to 2.3.5 See https://github.com/containerd/containerd/releases/tag/v2.3.5 Signed-off-by: Andrey Smirnov (cherry picked from commit 977b61fb151992e74cbd89a4dcd921f91dc30ac8) --- Pkgfile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Pkgfile b/Pkgfile index f529d75a4..b752aaabc 100644 --- a/Pkgfile +++ b/Pkgfile @@ -15,10 +15,10 @@ vars: cni_sha512: 5811fb14786f1f9d9e40741ce337449ce329e14e04213bc660102eb470150f24026e59caec480572e37d0e3e6e6518737f3cc7ac462c47034d0737283ec532f9 # renovate: datasource=github-tags depName=containerd/containerd - containerd_version: v2.3.4 - containerd_ref: db8809540e1a7a9da5d518876894933ff55692ab - containerd_sha256: 175bbf57d637c987fa742f846b43b1b8ba2c61af6a9eaec619c625e4a8a19b69 - containerd_sha512: cf8be1759399fb9e3b7c84d353a876b8f599b74fb3094a288333cf0b61a743b74484cbde7eab96576b214c92caf7de65ef94813bb3670e079585c371a438f6b4 + containerd_version: v2.3.5 + containerd_ref: 1294c24a7da8e5a793ed378161673abe94118892 + containerd_sha256: a99a4dca98061064ff4cb35d27d1ec2345717e9108c822329fcec91dc72bff96 + containerd_sha512: 87255f36b2b2fb5fc2cb7abaadae33c2ea85b5f7a1259c8c52cc3cf3efffa64525886a220eadf804b7c6414babe7310d39fddc6a24e79b707770fb621323f5c8 # renovate: datasource=github-tags depName=kdave/btrfs-progs btrfsprogs_version: 6.19.1 From fe037b6bd5b737b1ccc8459a2120c8b79228e73b Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Tue, 8 Sep 2026 18:17:01 +0400 Subject: [PATCH 08/10] feat: update Linux to 6.18.50 The latest LTS. Signed-off-by: Andrey Smirnov (cherry picked from commit 43e533c8387a9b2751b0036bf19351291556306e) --- Pkgfile | 6 +++--- kernel/build/config-amd64 | 2 +- kernel/build/config-arm64 | 4 +--- 3 files changed, 5 insertions(+), 7 deletions(-) diff --git a/Pkgfile b/Pkgfile index b752aaabc..d49bed4cd 100644 --- a/Pkgfile +++ b/Pkgfile @@ -104,9 +104,9 @@ vars: kspp_sha512: 2b40c41ed0347a339053aef61c838b5131dd583fb0d1ac8f3361040361ba868724ad16dfdc13023ff2b0f51f32c0aba605316d5d76f9fc6c1d50d90b4ceedead # renovate: datasource=git-tags extractVersion=^v(?.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git - linux_version: 6.18.49 - linux_sha256: ae826f33111fea6f1d279dde7299d7463c8dfd204aeb75a8fb5432bc60a28191 - linux_sha512: 115af2b6004a49c16e424f56794f1313d2266591b4398d88a17011893b182ec23b711de49b832e3bab07183e03ab7b6152db434e487c3b12ac63b10761031647 + linux_version: 6.18.50 + linux_sha256: d2fc041dab4e11d9645e3ba53be058faa52b8ce28a8a97c889bb2cacee170461 + linux_sha512: 57f65d17e09e023c084adf49041676f14215a7a3514f5b9de7fc8819df9af180b016a909f4a59eb30907932f6bce5e187343cd3fb649a574b4067dcf331eea5f # renovate: datasource=git-tags extractVersion=^libaio-(?.*)$ depName=https://pagure.io/libaio.git libaio_version: 0.3.113 diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index 409dc0d11..f935fa9ab 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.49 Kernel Configuration +# Linux/x86 6.18.50 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.8" CONFIG_GCC_VERSION=0 diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64 index c4f4840d3..36cba1049 100644 --- a/kernel/build/config-arm64 +++ b/kernel/build/config-arm64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.18.49 Kernel Configuration +# Linux/arm64 6.18.50 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -10002,11 +10002,9 @@ CONFIG_CRYPTO_DEV_SUN4I_SS=y CONFIG_CRYPTO_DEV_SUN8I_CE=y # CONFIG_CRYPTO_DEV_SUN8I_CE_DEBUG is not set # CONFIG_CRYPTO_DEV_SUN8I_CE_HASH is not set -# CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG is not set # CONFIG_CRYPTO_DEV_SUN8I_CE_TRNG is not set CONFIG_CRYPTO_DEV_SUN8I_SS=y # CONFIG_CRYPTO_DEV_SUN8I_SS_DEBUG is not set -# CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG is not set # CONFIG_CRYPTO_DEV_SUN8I_SS_HASH is not set # CONFIG_CRYPTO_DEV_FSL_CAAM is not set # CONFIG_CRYPTO_DEV_SAHARA is not set From 85a249a59fb97bcfce08d85af611ab86202dbac6 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Tue, 8 Sep 2026 19:52:25 +0400 Subject: [PATCH 09/10] feat: update libpathrs to 0.2.6 See https://github.com/cyphar/libpathrs/releases/tag/v0.2.6 This seems to have a bugfix for runc specifically. Signed-off-by: Andrey Smirnov (cherry picked from commit 5096469b3d563ff043d23146bcc5d2252e31323c) --- Pkgfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Pkgfile b/Pkgfile index d49bed4cd..d7a122584 100644 --- a/Pkgfile +++ b/Pkgfile @@ -175,9 +175,9 @@ vars: # NOTE: keep in sync with the libpathrs version required by runc: https://github.com/opencontainers/runc/blob/release-1.5/script/build-libpathrs.sh # renovate: datasource=github-releases depName=cyphar/libpathrs - libpathrs_version: v0.2.5 - libpathrs_sha256: f8f4a9419eb839cd5decbd120b65f0495bf6eac07155477fe39a8c2a23da589d - libpathrs_sha512: 009a6aa91d4ef5ccae011f39def4cf7ffc626fd7def9e9cbcf7c827d813215811719c44674e68192d3f4770c7968f2e7de7c13b27c7e53807f0aa0f4ba5c428f + libpathrs_version: v0.2.6 + libpathrs_sha256: 7b1e3a2c3cc0bd9f94187edbb6d1ba9737deb2bf7f724df1ee37653ea405b2b0 + libpathrs_sha512: e48a3e2ed8c8403c95621f1f98ae7e95cd86f733894c73478742772852eca2aa52ff99af27e43c2997f3c658cf4f5cb4f86c46c6ec7dcb3b3ddfc3a60797dd17 # renovate: datasource=github-releases extractVersion=^popt-(?.*)-release$ depName=rpm-software-management/popt libpopt_version: 1.19 From f694e1bfb5c5bedd69b030ef00e9784986e64de3 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Mon, 14 Sep 2026 11:57:34 +0400 Subject: [PATCH 10/10] feat: update Linux to 6.18.51 The latest LTS. Signed-off-by: Andrey Smirnov (cherry picked from commit 69ed550370d9ab9935fdef4fba5f90705aa97922) --- Pkgfile | 6 +++--- kernel/build/config-amd64 | 2 +- kernel/build/config-arm64 | 3 +-- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/Pkgfile b/Pkgfile index d7a122584..fe2d14d87 100644 --- a/Pkgfile +++ b/Pkgfile @@ -104,9 +104,9 @@ vars: kspp_sha512: 2b40c41ed0347a339053aef61c838b5131dd583fb0d1ac8f3361040361ba868724ad16dfdc13023ff2b0f51f32c0aba605316d5d76f9fc6c1d50d90b4ceedead # renovate: datasource=git-tags extractVersion=^v(?.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git - linux_version: 6.18.50 - linux_sha256: d2fc041dab4e11d9645e3ba53be058faa52b8ce28a8a97c889bb2cacee170461 - linux_sha512: 57f65d17e09e023c084adf49041676f14215a7a3514f5b9de7fc8819df9af180b016a909f4a59eb30907932f6bce5e187343cd3fb649a574b4067dcf331eea5f + linux_version: 6.18.51 + linux_sha256: ba2f60f858bf4d1f929101faa356c93dc8b925b17aaa9f95eabd4627758df613 + linux_sha512: 482c68c483c8317db0266fcdce54bc7028ba2a2e0d410af5995258efa21d4f8246dcbded43c09da7cc0b272148ee34c422d840d66dbf7ebb9d57c295dc770bea # renovate: datasource=git-tags extractVersion=^libaio-(?.*)$ depName=https://pagure.io/libaio.git libaio_version: 0.3.113 diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index f935fa9ab..95c07611a 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.50 Kernel Configuration +# Linux/x86 6.18.51 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.8" CONFIG_GCC_VERSION=0 diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64 index 36cba1049..24641c5f1 100644 --- a/kernel/build/config-arm64 +++ b/kernel/build/config-arm64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.18.50 Kernel Configuration +# Linux/arm64 6.18.51 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -8333,7 +8333,6 @@ CONFIG_IMX9_BLK_CTRL=y # CONFIG_MTK_SCPSYS=y CONFIG_MTK_SCPSYS_PM_DOMAINS=y -# CONFIG_AIROHA_CPU_PM_DOMAIN is not set # end of MediaTek PM Domains #