vyos-build.git/scripts/package-build/linux-kernel/patches/kernel, branch rolling

Kernel: T9067: Update Linux Kernel to 6.18.38

2026-07-08T18:38:55+00:00

Merge pull request #1227 from c-po/bnx2-patch

2026-06-26T15:23:32+00:00

Kernel: T8914: add support for 2.5G pluggables on BCM57810S

Merge pull request #1189 from c-po/l2tpv3

2026-06-26T12:24:51+00:00

Kernel: T8605: net/l2tp: allow unmanaged tunnel setup without route to peer

Kernel: T8914: add support for 2.5G pluggables on BCM57810S

2026-06-25T18:21:30+00:00

Add the well-known JAMESMTL kernel module patch for bnx2x to advertise 2.5Gbit/s capabilities on Broadcom NetXtreme2-X cards with BCM57810S chipset. This is useful for ISP GPON access networks that use 2.5Gbit/s pluggables and need the NIC to negotiate beyond 1000baseT/Full, avoiding the 940Mbit/s practical cap on overprovisioned 1G services. References: * https://hack-gpon.org/broadcom-57810s/ * https://github.com/JAMESMTL/snippets/blob/dceb2fee74d80c66d/bnx2x/patches/bnx2x_warpcore_8727_2_5g_sgmii_txfault.patch

Kernel: T9010: update existing patches to remove "hunk off" notices

2026-06-25T15:14:49+00:00

Kernel: T8919: Update Linux Kernel to 6.18.33

2026-05-23T17:54:51+00:00

The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability

Kernel: T8871: Update Linux Kernel to 6.18.31

2026-05-15T20:05:43+00:00

This fixes the LPE https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn

kernel: T8871: add a patch for the ptrace vulnerability

2026-05-15T10:41:06+00:00

that allows unprivileged users to read files owned by any other user

Kernel: T8864: add patch for "fragnesia" local privilege escalation

2026-05-14T11:39:02+00:00

Fragnesia is a universal Linux local privilege escalation exploit, discovered with V12 by William Bowling with the V12 team. Fragnesia is a member of the Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag. It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition. The technique extends the page-cache write bug class that includes Dirty Pipe: when a TCP socket transitions to espintcp ULP mode after data has already been spliced from a file into the receive queue, the kernel processes the queued file pages as ESP ciphertext. The AES-GCM keystream byte at counter block position 2, byte 0 is XORed directly into the cached file page. By selecting the IV nonce to produce a desired keystream byte, any target byte in the file can be set to any value — one byte per trigger invocation. From: https://github.com/v12-security/pocs/blob/532994fc003a7/fragnesia/README.md

Kernel: T8605: net/l2tp: allow unmanaged tunnel setup without route to peer

2026-05-08T20:53:39+00:00

Kernel-created L2TPv3 tunnels (genetlink L2TP_CMD_TUNNEL_CREATE without L2TP_ATTR_FD) used udp_sock_create() and kernel_connect(), which invoke __ip4_datagram_connect() / __ip6_datagram_connect(). Those paths insist on a successful FIB lookup at connect time. If no route to the configured remote existed yet, tunnel and interface creation failed. The data path already resolves routes on transmit (e.g. __ip_queue_xmit(), inet6_csk_route_socket()). This change defers requiring a route until packets are sent. Details: - UDP encapsulation: bind with udp_sock_create() after zeroing peer_udp_port, then l2tp_udp_sk_set_peer() sets daddr/dport and socket "connected" state without caching sk_dst from connect. - IPv4 L2TP/IP (l2tp_ip): on -ENETUNREACH / -EHOSTUNREACH from __ip4_datagram_connect(), l2tp_ip_connect_deferred() installs peer and bind-table updates without a connect-time route. - IPv6 L2TP/IP (l2tp_ip6): same for __ip6_datagram_connect(), including IPv4-mapped peers and scope / bound-device checks aligned with the normal connect path. Forwarding still only happens once the FIB can reach the peer. Until then outgoing packets follow the existing no-route drop path. Assisted-by: Cursor:claude-4.6-opus Signed-off-by: Christian Breunig