backports: v1.14.1

Pkgfile

@@ -3,9 +3,9 @@
 format: v1alpha2
 
 vars:
-  TOOLCHAIN_MUSL_IMAGE: ghcr.io/siderolabs/toolchain-musl:v1.14.0-3-g386b969
+  TOOLCHAIN_MUSL_IMAGE: ghcr.io/siderolabs/toolchain-musl:v1.14.0-4-gebafe88
   TOOLS_PREFIX: ghcr.io/siderolabs/
-  TOOLS_REV: v1.14.0-5-g87316ca
+  TOOLS_REV: v1.14.0-7-ga404efb
   LLVM_IMAGE: ghcr.io/siderolabs/llvm
   RUSTC_IMAGE: ghcr.io/siderolabs/rustc:v1.14.0
 
@@ -15,10 +15,10 @@ vars:
   cni_sha512: 5811fb14786f1f9d9e40741ce337449ce329e14e04213bc660102eb470150f24026e59caec480572e37d0e3e6e6518737f3cc7ac462c47034d0737283ec532f9
 
   # renovate: datasource=github-tags depName=containerd/containerd
-  containerd_version: v2.3.4
-  containerd_ref: db8809540e1a7a9da5d518876894933ff55692ab
-  containerd_sha256: 175bbf57d637c987fa742f846b43b1b8ba2c61af6a9eaec619c625e4a8a19b69
-  containerd_sha512: cf8be1759399fb9e3b7c84d353a876b8f599b74fb3094a288333cf0b61a743b74484cbde7eab96576b214c92caf7de65ef94813bb3670e079585c371a438f6b4
+  containerd_version: v2.3.5
+  containerd_ref: 1294c24a7da8e5a793ed378161673abe94118892
+  containerd_sha256: a99a4dca98061064ff4cb35d27d1ec2345717e9108c822329fcec91dc72bff96
+  containerd_sha512: 87255f36b2b2fb5fc2cb7abaadae33c2ea85b5f7a1259c8c52cc3cf3efffa64525886a220eadf804b7c6414babe7310d39fddc6a24e79b707770fb621323f5c8
 
   # renovate: datasource=github-tags depName=kdave/btrfs-progs
   btrfsprogs_version: 6.19.1
@@ -104,9 +104,9 @@ vars:
   kspp_sha512: 2b40c41ed0347a339053aef61c838b5131dd583fb0d1ac8f3361040361ba868724ad16dfdc13023ff2b0f51f32c0aba605316d5d76f9fc6c1d50d90b4ceedead
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
-  linux_version: 6.18.48
-  linux_sha256: 5ebdadb10a4b5708fc6b1c457764a110bc49f8150cc3502c59b921ead8c6fc8c
-  linux_sha512: 711e08958a8a4c39206018d0222687dc5a01845a9226ae44f7d3f0cfcea76caae041cee958dfe8c0cfc8c728a5a2241b29018ccf1b7593b9615c27057d2628c4
+  linux_version: 6.18.51
+  linux_sha256: ba2f60f858bf4d1f929101faa356c93dc8b925b17aaa9f95eabd4627758df613
+  linux_sha512: 482c68c483c8317db0266fcdce54bc7028ba2a2e0d410af5995258efa21d4f8246dcbded43c09da7cc0b272148ee34c422d840d66dbf7ebb9d57c295dc770bea
 
   # renovate: datasource=git-tags extractVersion=^libaio-(?<version>.*)$ depName=https://pagure.io/libaio.git
   libaio_version: 0.3.113
@@ -175,9 +175,9 @@ vars:
 
   # NOTE: keep in sync with the libpathrs version required by runc: https://github.com/opencontainers/runc/blob/release-1.5/script/build-libpathrs.sh
   # renovate: datasource=github-releases depName=cyphar/libpathrs
-  libpathrs_version: v0.2.5
-  libpathrs_sha256: f8f4a9419eb839cd5decbd120b65f0495bf6eac07155477fe39a8c2a23da589d
-  libpathrs_sha512: 009a6aa91d4ef5ccae011f39def4cf7ffc626fd7def9e9cbcf7c827d813215811719c44674e68192d3f4770c7968f2e7de7c13b27c7e53807f0aa0f4ba5c428f
+  libpathrs_version: v0.2.6
+  libpathrs_sha256: 7b1e3a2c3cc0bd9f94187edbb6d1ba9737deb2bf7f724df1ee37653ea405b2b0
+  libpathrs_sha512: e48a3e2ed8c8403c95621f1f98ae7e95cd86f733894c73478742772852eca2aa52ff99af27e43c2997f3c658cf4f5cb4f86c46c6ec7dcb3b3ddfc3a60797dd17
 
   # renovate: datasource=github-releases extractVersion=^popt-(?<version>.*)-release$ depName=rpm-software-management/popt
   libpopt_version: 1.19

kernel/build/config-amd64

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 6.18.48 Kernel Configuration
+# Linux/x86 6.18.51 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="clang version 22.1.8"
 CONFIG_GCC_VERSION=0
@@ -634,6 +634,7 @@ CONFIG_ACPI_HOTPLUG_IOAPIC=y
 CONFIG_ACPI_HED=y
 CONFIG_ACPI_BGRT=y
 # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set
+CONFIG_ACPI_NHLT=y
 # CONFIG_ACPI_NFIT is not set
 CONFIG_ACPI_NUMA=y
 CONFIG_ACPI_HMAT=y
@@ -1302,7 +1303,7 @@ CONFIG_XFRM_OFFLOAD=y
 CONFIG_XFRM_ALGO=y
 CONFIG_XFRM_USER=y
 # CONFIG_XFRM_USER_COMPAT is not set
-# CONFIG_XFRM_INTERFACE is not set
+CONFIG_XFRM_INTERFACE=m
 # CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_XFRM_MIGRATE is not set
 CONFIG_XFRM_STATISTICS=y
@@ -3000,7 +3001,7 @@ CONFIG_MARVELL_10G_PHY=y
 # CONFIG_MEDIATEK_GE_PHY is not set
 # CONFIG_MICREL_PHY is not set
 # CONFIG_MICROCHIP_T1S_PHY is not set
-# CONFIG_MICROCHIP_PHY is not set
+CONFIG_MICROCHIP_PHY=m
 # CONFIG_MICROCHIP_T1_PHY is not set
 # CONFIG_MICROSEMI_PHY is not set
 # CONFIG_MOTORCOMM_PHY is not set
@@ -3069,7 +3070,7 @@ CONFIG_USB_NET_DRIVERS=y
 # CONFIG_USB_PEGASUS is not set
 # CONFIG_USB_RTL8150 is not set
 CONFIG_USB_RTL8152=m
-# CONFIG_USB_LAN78XX is not set
+CONFIG_USB_LAN78XX=m
 CONFIG_USB_USBNET=m
 CONFIG_USB_NET_AX8817X=m
 CONFIG_USB_NET_AX88179_178A=m
@@ -5226,20 +5227,26 @@ CONFIG_SOUND=m
 CONFIG_SND=m
 CONFIG_SND_TIMER=m
 CONFIG_SND_PCM=m
+CONFIG_SND_PCM_ELD=y
 CONFIG_SND_HWDEP=m
 CONFIG_SND_RAWMIDI=m
+CONFIG_SND_JACK=y
+CONFIG_SND_JACK_INPUT_DEV=y
 # CONFIG_SND_OSSEMUL is not set
 CONFIG_SND_PCM_TIMER=y
 # CONFIG_SND_HRTIMER is not set
-# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_DYNAMIC_MINORS=y
+CONFIG_SND_MAX_CARDS=32
 CONFIG_SND_SUPPORT_OLD_API=y
 CONFIG_SND_PROC_FS=y
 CONFIG_SND_VERBOSE_PROCFS=y
 CONFIG_SND_CTL_FAST_LOOKUP=y
 # CONFIG_SND_DEBUG is not set
 # CONFIG_SND_CTL_INPUT_VALIDATION is not set
 # CONFIG_SND_UTIMER is not set
+CONFIG_SND_VMASTER=y
 CONFIG_SND_DMA_SGBUF=y
+CONFIG_SND_CTL_LED=m
 # CONFIG_SND_SEQUENCER is not set
 CONFIG_SND_DRIVERS=y
 # CONFIG_SND_PCSP is not set
@@ -5319,8 +5326,57 @@ CONFIG_SND_PCI=y
 #
 # HD-Audio
 #
-# CONFIG_SND_HDA_INTEL is not set
+CONFIG_SND_HDA=m
+# CONFIG_SND_HDA_HWDEP is not set
+# CONFIG_SND_HDA_RECONFIG is not set
+# CONFIG_SND_HDA_INPUT_BEEP is not set
+# CONFIG_SND_HDA_PATCH_LOADER is not set
+CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0
+# CONFIG_SND_HDA_CTL_DEV_ID is not set
+CONFIG_SND_HDA_PREALLOC_SIZE=0
+CONFIG_SND_HDA_INTEL=m
 # CONFIG_SND_HDA_ACPI is not set
+CONFIG_SND_HDA_GENERIC_LEDS=y
+# CONFIG_SND_HDA_CODEC_ANALOG is not set
+# CONFIG_SND_HDA_CODEC_SIGMATEL is not set
+# CONFIG_SND_HDA_CODEC_VIA is not set
+# CONFIG_SND_HDA_CODEC_CONEXANT is not set
+# CONFIG_SND_HDA_CODEC_SENARYTECH is not set
+# CONFIG_SND_HDA_CODEC_CA0110 is not set
+# CONFIG_SND_HDA_CODEC_CA0132 is not set
+# CONFIG_SND_HDA_CODEC_CMEDIA is not set
+# CONFIG_SND_HDA_CODEC_CM9825 is not set
+# CONFIG_SND_HDA_CODEC_SI3054 is not set
+CONFIG_SND_HDA_GENERIC=m
+CONFIG_SND_HDA_CODEC_REALTEK=m
+CONFIG_SND_HDA_CODEC_REALTEK_LIB=m
+CONFIG_SND_HDA_CODEC_ALC260=m
+CONFIG_SND_HDA_CODEC_ALC262=m
+CONFIG_SND_HDA_CODEC_ALC268=m
+CONFIG_SND_HDA_CODEC_ALC269=m
+CONFIG_SND_HDA_CODEC_ALC662=m
+CONFIG_SND_HDA_CODEC_ALC680=m
+CONFIG_SND_HDA_CODEC_ALC861=m
+CONFIG_SND_HDA_CODEC_ALC861VD=m
+CONFIG_SND_HDA_CODEC_ALC880=m
+CONFIG_SND_HDA_CODEC_ALC882=m
+# CONFIG_SND_HDA_CODEC_CIRRUS is not set
+CONFIG_SND_HDA_CODEC_HDMI=m
+CONFIG_SND_HDA_CODEC_HDMI_GENERIC=m
+CONFIG_SND_HDA_CODEC_HDMI_SIMPLE=m
+CONFIG_SND_HDA_CODEC_HDMI_INTEL=m
+# CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set
+CONFIG_SND_HDA_CODEC_HDMI_ATI=m
+CONFIG_SND_HDA_CODEC_HDMI_NVIDIA=m
+CONFIG_SND_HDA_CODEC_HDMI_NVIDIA_MCP=m
+CONFIG_SND_HDA_CODEC_HDMI_TEGRA=m
+CONFIG_SND_HDA_SCODEC_COMPONENT=m
+CONFIG_SND_HDA_CORE=m
+CONFIG_SND_HDA_COMPONENT=y
+CONFIG_SND_HDA_I915=y
+CONFIG_SND_INTEL_NHLT=y
+CONFIG_SND_INTEL_DSP_CONFIG=m
+CONFIG_SND_INTEL_SOUNDWIRE_ACPI=m
 # end of HD-Audio
 
 CONFIG_SND_USB=y
@@ -6906,6 +6962,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 CONFIG_SECURITY_LANDLOCK=y
 # CONFIG_SECURITY_IPE is not set
 CONFIG_INTEGRITY=y

kernel/build/config-arm64

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 6.18.48 Kernel Configuration
+# Linux/arm64 6.18.51 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="clang version 22.1.8"
 CONFIG_GCC_VERSION=0
@@ -1289,7 +1289,7 @@ CONFIG_XFRM=y
 CONFIG_XFRM_OFFLOAD=y
 CONFIG_XFRM_ALGO=y
 CONFIG_XFRM_USER=y
-# CONFIG_XFRM_INTERFACE is not set
+CONFIG_XFRM_INTERFACE=m
 # CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_XFRM_MIGRATE is not set
 CONFIG_XFRM_STATISTICS=y
@@ -8333,7 +8333,6 @@ CONFIG_IMX9_BLK_CTRL=y
 #
 CONFIG_MTK_SCPSYS=y
 CONFIG_MTK_SCPSYS_PM_DOMAINS=y
-# CONFIG_AIROHA_CPU_PM_DOMAIN is not set
 # end of MediaTek PM Domains
 
 #
@@ -9742,6 +9741,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 CONFIG_SECURITY_LANDLOCK=y
 # CONFIG_SECURITY_IPE is not set
 CONFIG_INTEGRITY=y
@@ -10001,11 +10001,9 @@ CONFIG_CRYPTO_DEV_SUN4I_SS=y
 CONFIG_CRYPTO_DEV_SUN8I_CE=y
 # CONFIG_CRYPTO_DEV_SUN8I_CE_DEBUG is not set
 # CONFIG_CRYPTO_DEV_SUN8I_CE_HASH is not set
-# CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG is not set
 # CONFIG_CRYPTO_DEV_SUN8I_CE_TRNG is not set
 CONFIG_CRYPTO_DEV_SUN8I_SS=y
 # CONFIG_CRYPTO_DEV_SUN8I_SS_DEBUG is not set
-# CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG is not set
 # CONFIG_CRYPTO_DEV_SUN8I_SS_HASH is not set
 # CONFIG_CRYPTO_DEV_FSL_CAAM is not set
 # CONFIG_CRYPTO_DEV_SAHARA is not set

kernel/build/patches/0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch

@@ -0,0 +1,90 @@
+From: Andrey Smirnov <andrey.smirnov@siderolabs.com>
+Date: Thu, 3 Sep 2026 12:00:00 +0400
+Subject: [PATCH] security/lockdown: lock down the kernel in EFI Secure Boot
+ mode
+
+Upstream offers no way to enter lockdown only when the machine was booted
+with UEFI Secure Boot enabled: the default level is a build-time choice
+(LOCK_DOWN_KERNEL_FORCE_*) which applies to every boot, so a single kernel
+image cannot be `none` when booted without Secure Boot and `integrity` when
+booted with it.  Forcing `integrity` unconditionally is not an option, as it
+would also require a signed kernel image for kexec on non-Secure Boot
+installs.
+
+Distributions carry an out-of-tree patch for this (originally by David
+Howells), keyed off an EFI_SECURE_BOOT flag which is itself out of tree and
+is only plumbed into the kernel proper via boot_params on x86.
+
+Do the same thing arch-generically instead: once EFI runtime services are
+up, read the `SecureBoot`/`SetupMode` EFI variables using the helper already
+in <linux/efi.h> and raise lockdown to integrity if Secure Boot is enabled.
+As `lock_kernel_down()` never lowers the level, an explicit
+`lockdown=confidentiality` on the kernel command line still wins.
+
+Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
+---
+diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig
+index e84ddf4..a02aec3 100644
+--- a/security/lockdown/Kconfig
++++ b/security/lockdown/Kconfig
+@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY
+ 	 disabled.
+
+ endchoice
++
++config LOCK_DOWN_IN_EFI_SECURE_BOOT
++	bool "Lock down the kernel in EFI Secure Boot mode"
++	default n
++	depends on SECURITY_LOCKDOWN_LSM
++	depends on EFI
++	help
++	  UEFI Secure Boot provides a mechanism for ensuring that the firmware
++	  will only load signed bootloaders and kernels.  Secure boot mode may
++	  be determined from EFI variables provided by the system firmware if
++	  not indicated by the boot parameters.
++
++	  Enabling this option turns on the kernel lockdown feature in
++	  integrity mode if the kernel was booted on a platform with UEFI
++	  Secure Boot enabled.
+diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
+index cf83afa..da8b89a 100644
+--- a/security/lockdown/lockdown.c
++++ b/security/lockdown/lockdown.c
+@@ -10,6 +10,7 @@
+  * 2 of the Licence, or (at your option) any later version.
+  */
+
++#include <linux/efi.h>
+ #include <linux/security.h>
+ #include <linux/export.h>
+ #include <linux/lsm_hooks.h>
+@@ -93,6 +94,29 @@ static int __init lockdown_lsm_init(void)
+ 	return 0;
+ }
+
++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
++/*
++ * Raise the lockdown level to integrity when the machine was booted with UEFI
++ * Secure Boot enabled.
++ *
++ * This runs once EFI runtime services are available (efisubsys_init() is a
++ * subsys_initcall), which is still well before userspace is started.
++ */
++static int __init lockdown_efi_secure_boot(void)
++{
++	if (!efi_enabled(EFI_BOOT) ||
++	    !efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
++		return 0;
++
++	if (efi_get_secureboot_mode(efi.get_variable) == efi_secureboot_mode_enabled)
++		lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);
++
++	return 0;
++}
++
++late_initcall(lockdown_efi_secure_boot);
++#endif
++
+ static ssize_t lockdown_read(struct file *filp, char __user *buf, size_t count,
+ 			     loff_t *ppos)
+ {

kernel/build/patches/README.md

@@ -14,3 +14,4 @@
 | `0014-libceph-add-support-for-CEPH_CRYPTO_AES256KRB5.patch` | libceph: the actual `aes256k` support — new key type `CEPH_CRYPTO_AES256KRB5` (`0x2`), AES256-CTS-HMAC-SHA384-192 via the in-kernel `crypto/krb5` library, per-usage AEAD tfms and confounder+HMAC framing. Fixes kclient auth against a cluster whose CephX keys have been rotated to `--key-type aes256k` for [CVE-2025-30156](https://docs.ceph.com/en/latest/security/CVE-2025-30156/). **Adds `select CRYPTO_KRB5` to `CEPH_LIB`** — hence `CONFIG_CRYPTO_KRB5`/`KRB5ENC`/`CAMELLIA` in both configs | Merged to mainline v7.0 | [`b7cc142dbafe`](https://git.kernel.org/torvalds/c/b7cc142dbafeaf6c053284ca9121b9f70b6d6d06), [pull req](https://lore.kernel.org/all/20260217173743.1840319-1-idryomov@gmail.com/) |
 | `0015-libceph-adapt-ceph_x_challenge_blob-hashing-and-msgr1.patch` | libceph: route the connect-challenge hashing and msgr1 message signing through the key-type-aware helpers so both work with `aes256k` keys | Merged to mainline v7.0 | [`8356b4b1103b`](https://git.kernel.org/torvalds/c/8356b4b1103b8c970648c94bab724aa30e42d869), [pull req](https://lore.kernel.org/all/20260217173743.1840319-1-idryomov@gmail.com/) |
 | `0016-libceph-Fix-potential-out-of-bounds-access-in-__ceph_.patch` | libceph: bounds-check the plaintext before dereferencing `hdr->magic` in `__ceph_x_decrypt()` — a short `FRAME_TAG_AUTH_REPLY_MORE` frame can read past the buffer. `Cc: stable` but never picked up into 6.18.y; applies on top of `0012`-`0015` | Merged to mainline v7.1 | [`821365487aa5`](https://git.kernel.org/torvalds/c/821365487aa58d06bda65c676ba215d506ba9768) |
+| `0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch` | security/lockdown: add `LOCK_DOWN_IN_EFI_SECURE_BOOT`, which raises lockdown to `integrity` from a `late_initcall` when the `SecureBoot`/`SetupMode` EFI variables say UEFI Secure Boot is enabled. Upstream only has the build-time `LOCK_DOWN_KERNEL_FORCE_*` choice, which cannot be conditional on how the machine booted; the distro patch this replaces keys off an out-of-tree `EFI_SECURE_BOOT` flag that is only plumbed through `boot_params` on x86, so this reads the variables directly and works on arm64 too | Not submitted; distro-local (Fedora/SUSE carry an equivalent out-of-tree patch) | [talos#14237](https://github.com/siderolabs/talos/issues/14237), [SUSE `b1a0314b0827`](https://github.com/SUSE/kernel/commit/b1a0314b0827ea781c13a27abcc3c3b96fc0e946) |