| Age | Commit message (Collapse) | Author |
|---|
|
The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability
|
|
This fixes the LPE https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
|
|
serial: T8844: fix default config injection leading to invalid boot console
|
|
With all the latest serial interface changes - and the resulting patching of
the default configuration based on the build flavor - the serial console
was always injected by a helper named write-config-file-value.py, even if the
console_type was set to tty instead of ttyS or ttyAMA.
This was a pending issue in the rolling tests for the PROXMOX flavor. It is
applicable to every other flavor using tty as default console.
|
|
Kernel: T6847: update Intel Out-Of-Tree drivers for IGB, IXGBE, I40e, ICE and IAVF
|
|
Stable kernels with Hyunwoo Kim's patch [1] for the second vulnerability
CVE-2026-43500 reported with Dirty Frag and Copy Fail 2.
1: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71
|
|
The Intel iavf driver (formerly i40evf) is the Linux virtual function driver
for modern Intel Ethernet adapters supporting SR-IOV, including the X700/E800
series.
Renamed to iavf to support future devices, it replaced i40evf entirely by 2019.
The driver facilitates high-performance networking in virtualized environments.
This commit contains custom patches to make the driver build.
|
|
The current version of the Intel ice driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
The current version of the Intel i40e driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
These kernels contain a partial fix for the Dirty Frag [1] and
Copy Fail 2 [2] security flaws.
1: https://github.com/V4bel/dirtyfrag#dirty-frag-universal-linux-lpe
2: https://www.openwall.com/lists/oss-security/2026/05/07/12
|
|
* Forwared port all out-of-tree driver patches
* Add Intel QAT patch to make it compile for LInux 6.18
* Remove out-of-tree OpenVPN DCO module - now available upstream
|
|
|
|
Kernel: T861: add custom VyOS CA to Kernel builds for later module signing
|
|
With this addition we can always sign a Kernel module later and ship it if
needed, without re-compiling the Kernel.
Kernel will report:
[ 1.223891] Loaded X.509 cert 'VyOS Networks Secure Boot Signer 2025 - linux: 6ca57e2add335babd08da69b48c70693edd2b037'
Issuer: CN = VyOS Networks Secure Boot CA
Validity
Not Before: Apr 26 09:07:06 2025 GMT
Not After : Apr 24 09:07:06 2035 GMT
Subject: CN = VyOS Networks Secure Boot Signer 2025 - linux
|
|
config.boot.default
We do have different default console configurations per flavor used. We will
set the serial console to the default configuration for the flavor once during
ISO image assembly.
|
|
image: T8375: honor already existing boot_settings
|
|
VyOS flavors might come with boot_settings which already provided additional
serial interface settings if required. Instead of using our own definitions,
re-use what's already existing.
scripts/image-build/build-vyos-image comes with an implicit default for
boot_settings like console number and speed, thus we do not need to redefine
the existing default - again.
|
|
* 6.6.135 https://lwn.net/Articles/1068477/
* 6.6.134 https://lwn.net/Articles/1067276/
|
|
|
|
flavor: T8375: add flavor.json during build into resulting image
|
|
T8047: replace netplugd with vyos-netlinkd
|
|
In order for amd64 or arm64 images to know their serial console settings, we
embed a new file named "flavor.json" under "/usr/share/vyos" into the resulting
image. The file holds configuration parameters unique to the build flavor.
Corresponding library functions are available via a Python vyos.flavor module.
|
|
T8410: Fix typos and mistakes in scripts and comments
|
|
Fix typos and mistakes in the comments
No functional changes
|
|
The custom patch "nft_ct: Added nfct_seqadj_ext_add() for DNAT'ed - conntrack."
is now available upstream in the Kernel tree.
|
|
|
|
|
|
found error
|
|
|
|
T8311: move to GNU coreutils when building GLIBC multiarch variable
|
|
T8330: ARM64: vyos-ipt-netflow package is missing in the build
|
|
Related to commit 39dc9c98c68 ("T8311: fix initramfs hook "dpkg-architecture:
command not found"). Drop dpkg-dev implementation in favour of GNU coreutils.
On x86_64 (aka amd64) both yield the same result:
$ echo $(uname -m)-linux-gnu
x86_64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
x86_64-linux-gnu
On aarch64 (aka arm64) both yield the same result:
$ echo $(uname -m)-linux-gnu
aarch64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
aarch64-linux-gnu
|
|
T8120: add support for per CPU architecture serial interface name
|
|
Add vyos-ipt-netflow package to be installed on ARM64 platform by default.
|
|
This file is only needed to support upgrades from the legacy image management
tools. Example would be an upgrade from VyOS 1.3.8 -> 1.5 (which is officially
unsupported, but we always try our best). This is also the reason why we can
leave the ttyS0 console in this file - there was no ARM64 image for VyOS 1.3!
|
|
When building an ISO image the files which are probed for no longer exist.
This means it makes no sense to longer carry an unused hook.
|
|
|
|
x86_64 and arm64 both use a different serial interface during Linux Kernel
boot. Define either ttyS0 or ttyAMA0 per CPU architecture. This could be
further overwritten by individual flavors.
|
|
Commit f4877564276947 ("T8311: De-hardcode arch for live-build-config
10-vyos-addons") introduced a regression where an unavailable third-party
helper script was invoked during initramfs hook execution, breaking the ISO
build process.
update-initramfs: Generating /boot/initrd.img-6.6.127-vyos
live-boot: core filesystems devices utils wget blockdev.
/etc/initramfs-tools/hooks/10-vyos-addons: line 3: dpkg-architecture: command not found
The dpkg-architecture helper, provided by the dpkg-dev package, is not
available during hook execution. The same result can be achieved using GNU
coreutils instead:
On x86_64 (aka amd64) both yield the same result:
$ echo $(uname -m)-linux-gnu
x86_64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
x86_64-linux-gnu
On aarch64 (aka arm64) both yield the same result:
$ echo $(uname -m)-linux-gnu
aarch64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
aarch64-linux-gnu
|
|
|
|
|
|
keys.
|
|
|
|
geoip: T7926: Refactor geoip handling
|
|
|
|
Kernel: T8203: Update Linux Kernel to 6.6.121
|
|
|
|
Delete Zabbix repository key.
|
|
Remove Zabbix repository from the list.
|
|
Remove Zabbix repository from the list.
|
