Kernel: T8871: Update Linux Kernel to 6.18.31

This fixes the LPE https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn

2 files changed, 1 insertions, 111 deletions

diff --git a/data/defaults.toml b/data/defaults.toml
index bbefccac..d7faf5fb 100644
--- a/data/defaults.toml
+++ b/data/defaults.toml
@@ -14,7 +14,7 @@ vyos_mirror = "https://packages.vyos.net/repositories/current"
 vyos_branch = "current"
 release_train = "current"
 
-kernel_version = "6.18.29"
+kernel_version = "6.18.31"
 kernel_flavor = "vyos"
 bootloaders = "syslinux,grub-efi"
 
diff --git a/scripts/package-build/linux-kernel/patches/kernel/0005-ptrace-slightly-saner-get_dumpable-logic.patch b/scripts/package-build/linux-kernel/patches/kernel/0005-ptrace-slightly-saner-get_dumpable-logic.patch
deleted file mode 100644
index 950b86a1..00000000
--- a/scripts/package-build/linux-kernel/patches/kernel/0005-ptrace-slightly-saner-get_dumpable-logic.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a Mon Sep 17 00:00:00 2001
-From: Linus Torvalds <torvalds@linux-foundation.org>
-Date: Wed, 13 May 2026 11:37:18 -0700
-Subject: [PATCH] ptrace: slightly saner 'get_dumpable()' logic
-
-The 'dumpability' of a task is fundamentally about the memory image of
-the task - the concept comes from whether it can core dump or not - and
-makes no sense when you don't have an associated mm.
-
-And almost all users do in fact use it only for the case where the task
-has a mm pointer.
-
-But we have one odd special case: ptrace_may_access() uses 'dumpable' to
-check various other things entirely independently of the MM (typically
-explicitly using flags like PTRACE_MODE_READ_FSCREDS).  Including for
-threads that no longer have a VM (and maybe never did, like most kernel
-threads).
-
-It's not what this flag was designed for, but it is what it is.
-
-The ptrace code does check that the uid/gid matches, so you do have to
-be uid-0 to see kernel thread details, but this means that the
-traditional "drop capabilities" model doesn't make any difference for
-this all.
-
-Make it all make a *bit* more sense by saying that if you don't have a
-MM pointer, we'll use a cached "last dumpability" flag if the thread
-ever had a MM (it will be zero for kernel threads since it is never
-set), and require a proper CAP_SYS_PTRACE capability to override.
-
-Reported-by: Qualys Security Advisory <qsa@qualys.com>
-Cc: Oleg Nesterov <oleg@redhat.com>
-Cc: Kees Cook <kees@kernel.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- include/linux/sched.h |  3 +++
- kernel/exit.c         |  1 +
- kernel/ptrace.c       | 22 ++++++++++++++++------
- 3 files changed, 20 insertions(+), 6 deletions(-)
-
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 368c7b4d7cb510..ee06cba5c6f538 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -1002,6 +1002,9 @@ struct task_struct {
- 	unsigned			sched_rt_mutex:1;
- #endif
- 
-+	/* Save user-dumpable when mm goes away */
-+	unsigned			user_dumpable:1;
-+
- 	/* Bit to tell TOMOYO we're in execve(): */
- 	unsigned			in_execve:1;
- 	unsigned			in_iowait:1;
-diff --git a/kernel/exit.c b/kernel/exit.c
-index 9a909993ab1d8b..f50d73c272d6ee 100644
---- a/kernel/exit.c
-+++ b/kernel/exit.c
-@@ -571,6 +571,7 @@ static void exit_mm(void)
- 	 */
- 	smp_mb__after_spinlock();
- 	local_irq_disable();
-+	current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER);
- 	current->mm = NULL;
- 	membarrier_update_current_mm(NULL);
- 	enter_lazy_tlb(mm, current);
-diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index 68c17daef8d40b..130043bfc2091c 100644
---- a/kernel/ptrace.c
-+++ b/kernel/ptrace.c
-@@ -272,11 +272,24 @@ static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
- 	return ns_capable(ns, CAP_SYS_PTRACE);
- }
- 
-+static bool task_still_dumpable(struct task_struct *task, unsigned int mode)
-+{
-+	struct mm_struct *mm = task->mm;
-+	if (mm) {
-+		if (get_dumpable(mm) == SUID_DUMP_USER)
-+			return true;
-+		return ptrace_has_cap(mm->user_ns, mode);
-+	}
-+
-+	if (task->user_dumpable)
-+		return true;
-+	return ptrace_has_cap(&init_user_ns, mode);
-+}
-+
- /* Returns 0 on success, -errno on denial. */
- static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
- {
- 	const struct cred *cred = current_cred(), *tcred;
--	struct mm_struct *mm;
- 	kuid_t caller_uid;
- 	kgid_t caller_gid;
- 
-@@ -337,11 +350,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
- 	 * Pairs with a write barrier in commit_creds().
- 	 */
- 	smp_rmb();
--	mm = task->mm;
--	if (mm &&
--	    ((get_dumpable(mm) != SUID_DUMP_USER) &&
--	     !ptrace_has_cap(mm->user_ns, mode)))
--	    return -EPERM;
-+	if (!task_still_dumpable(task, mode))
-+		return -EPERM;
- 
- 	return security_ptrace_access_check(task, mode);
- }