x86_64 GetPageSpeed extras repository for CentOS/RHEL 7

Update: kernel-lt-6.18.60-2.el7

Sat, 31 Oct 2026 13:58:49 +0000

Package: kernel-lt
Summary: The Linux kernel. (The core of any Linux-based operating system.)

Description:
This package provides the Linux kernel (vmlinuz), the core of any Linux-based operating system. The kernel handles the basic functions of the OS: memory allocation, process allocation, device I/O, etc.

Changes:

kernel-lt-6.18.60-2.el7.x86_64 [77.6 MiB]	Changelog by Danila Vershinin (2026-10-31): - Enable CONFIG_MEMCG_V1=y and CONFIG_CPUSETS_V1=y. Kernel 6.11/6.12 gated the cgroup v1 memory and cpuset controllers behind these default-n symbols, so the %prep `make olddefconfig` dropped them and EL7 userspace (systemd 219, libvirt 4.5, docker), which only speaks cgroup v1, could not mount the memory or cpuset hierarchies: libvirt cannot place VMs under cpuset/machine.slice and MemoryLimit= / docker --memory limits are not enforced. Reported by Nuonuo. - Restore Microsoft Hyper-V / Azure guest support. Kernel 6.18 turned CONFIG_HYPERV into a bool and split the VMBus driver out as CONFIG_HYPERV_VMBUS; the curated HYPERV=m became invalid, resolved to n, and took hv_storvsc, hv_netvsc, hv_balloon, hv_utils, pci-hyperv, hv_sock and MANA with it since 6.18.32-4. Now HYPERV=y, VMBUS=m. - CONFIG_FSCACHE=y (now bool; was invalid =m), CONFIG_IDPF=m (restores INFINIBAND_IRDMA), CONFIG_AMD_HSMP_ACPI/PLAT=m (AMD_HSMP split). - Source1 is now the exact olddefconfig-resolved config, and %prep fails the build if olddefconfig drops any symbol it enables, or if a required EL7-userspace symbol (cgroup v1, legacy xtables, Hyper-V storage) is unset.
kernel-lt-6.18.60-1.el7.x86_64 [77.0 MiB]	Changelog by Danila Vershinin (2026-10-30): - Rebase to upstream 6.18.60 LTS. Fixes CVE-2026-98432 (ipv4: free inet_opt and ireq_opt after an RCU grace period; fixed upstream in 6.18.56): race-induced use-after-free in TCP SYN handling, remotely exploitable to root against hosts with a multipath TCP listener (CONFIG_MPTCP=y here). Also picks up 6.18.33..6.18.60 stable fixes. - Config carried forward unchanged from 6.18.32-7 (renamed to config-6.18.60-x86_64); %prep `make olddefconfig` resolves new symbols.
kernel-lt-6.18.32-7.el7.x86_64 [76.7 MiB]	Changelog by Danila Vershinin (2026-07-06): - Enable CONFIG_NETFILTER_XTABLES_LEGACY=y (plus IP_NF_IPTABLES_LEGACY, IP6_NF_IPTABLES_LEGACY and BRIDGE_NF_EBTABLES_LEGACY as modules). Kernel 6.16 gated the legacy iptables get/setsockopt interface behind NETFILTER_XTABLES_LEGACY (default n), so the %prep `make olddefconfig` silently dropped ip_tables.ko, ip6_tables.ko, ebtables.ko and every iptable_/ip6table_ table module from the -4..-6 builds even though the curated config requests them. EL7 userspace is legacy-only (iptables 1.4.21, firewalld 0.6, fail2ban, wg-quick PostUp): on -6 firewalld exits FATAL with "iptables not usable, disabling IPv4 firewall", fail2ban stays active with zero ban chains, and the host runs with no packet filter at all. Surfaced during the web.getpagespeed.com prod cutover 2026-07-06; web.smartycode.com had carried the same silent hole since 2026-06-04. - %posttrans: `systemctl enable kdump.service` — EL convention is kdump armed whenever crashkernel memory is reserved, but hosts that lived on cloud-vendor helper kernels (kexec impossible) often carry it disabled; the prod cutover found exactly that.
kernel-lt-6.18.32-6.el7.x86_64 [76.6 MiB]	Changelog by Danila Vershinin (2026-06-04): - %posttrans: unconditionally run grub2-mkconfig at the end of the post-install scriptlet so every kernel gets a unique, filename-derived $menuentry_id_option. grubby --add-kernel (invoked by new-kernel-pkg in %post) clones an existing menuentry as a template and copies the template's id verbatim; on hosts where the cloned template belongs to a different kernel family (mixed Linode helper, stock 3.10 kernel-el7 still installed alongside kernel-lt, freshly-flipped grub-legacy to GRUB 2), two menuentries end up sharing one id and GRUB_DEFAULT=saved selection becomes non-deterministic. Surfaced on web.smartycode.com 2026-06-04: the -5 install ended up sharing an id with the stock 3.10.0-1160.119.1.el7 entry and the host booted -4 instead of -5. - Upstream ELRepo kernel-lt-5.4.spec and RHEL 7 stock kernel.spec both delegate entirely to new-kernel-pkg/grubby and never call grub2-mkconfig themselves. EL8+/Fedora switched to kernel-install + BLS where each kernel becomes its own /boot/loader/entries/*.conf and the id-collision bug class does not exist. EL7 has no BLS, so this explicit regen is the durable workaround. The earlier vmlinuz-path self-heal in %posttrans is kept as a belt-and-braces pass and as a clean revert point if the unconditional regen ever misbehaves on a customer host. - Both BIOS /boot/grub2/grub.cfg and UEFI /boot/efi/EFI/centos/grub.cfg paths covered; mkconfig failure logs a WARN but does not abort the transaction. - Release counter only; no kernel source changes.
kernel-lt-6.18.32-5.el7.x86_64 [76.6 MiB]	Changelog by Danila Vershinin (2026-06-02): - Disable CONFIG_MODULE_SIG (and the dependents MODULE_SIG_ALL, MODULE_SIG_SHA512, MODULE_SIG_HASH, MODULE_SIG_KEY*) so the kernel stops tainting itself with TAINT_UNSIGNED_MODULE (bit 13). The build pipeline does not enroll signing keys, so leaving signing enabled caused every in-tree module load (drm, etc.) to dmesg "module verification failed: signature and/or required key missing" and flip the taint bit. Matches ELRepo's kernel-lt convention (signing not enforced); customers needing signed modules can rebuild from SRPM with a local key. - Disable CONFIG_SECURITY_LOCKDOWN_LSM (and SECURITY_LOCKDOWN_LSM_EARLY, drop "lockdown" from CONFIG_LSM list). The lockdown LSM carries `select MODULE_SIG if MODULES`, which made the MODULE_SIG disable above impossible to land as long as lockdown was on. The corecare kernel was already shipping with CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y (lockdown was inert at boot), so removing the LSM itself is a no-op for the default runtime posture. Customers needing kernel lockdown can rebuild from SRPM with both lockdown and a self-enrolled signing key. - Release counter only; no kernel source changes.
kernel-lt-6.18.32-4.el7.x86_64 [76.6 MiB]	Changelog by Danila Vershinin (2026-05-23): - Replace the upstream x86_64_defconfig seed with ELRepo el9's curated config-6.1.173-x86_64 (~10k lines, ~4k modules, ~2.5k builtins). The spec's existing `make olddefconfig` step in %prep resolves symbol drift forward to 6.18.32 against upstream defaults for any symbols added between 6.1 and 6.18. Result: boot drivers (virtio_blk, virtio_net, virtio_scsi, sd_mod, ext4) now ship as =m alongside non-KVM paravirt (xen_blkdev_frontend, xen_netdev_frontend, hyperv_storage, hyperv_net, vmware_pvscsi, vmxnet3) — matching the convention used by RHEL/CentOS, ELRepo, Fedora and Oracle UEK. The virtio bus (CONFIG_VIRTIO_PCI) stays builtin. With drivers now modular, dracut --hostonly produces a meaningfully smaller initramfs and shipping a portable-initramfs drop-in becomes worth revisiting. - Coverage of non-KVM hypervisor families (Xen-PV, Hyper-V, VMware) is verified by config-grep audit and `rpm -qlp \| grep '.ko$'` at build time, not by cold-booting on each platform. The Linode KVM sandbox proves the KVM path end-to-end. Per-hypervisor sandbox proof is not in scope; treat any non-KVM customer report as a hotfix trigger. - Future work for EL8+ targets: add `Recommends: dracut-config-generic` so dracut policy ships in its own package, per EL convention. EL7's yum 3.x has no weak-dep support so this is intentionally not added in this iteration. - Release counter only; no kernel source changes (Patch1-3 unchanged).
kernel-lt-6.18.32-3.el7.x86_64 [15.2 MiB]	Changelog by Danila Vershinin (2026-05-23): - Drop /etc/dracut.conf.d/01-corecare-portable.conf shipped in 6.18.32-2. Verification on a prod-clone EL7 sandbox confirmed the drop-in was a no-op: the upstream x86_64_defconfig we currently build from compiles virtio_blk, virtio_pci, virtio_scsi, virtio_net, sd_mod and ext4 as CONFIG_*=y (builtin to vmlinuz) rather than =m, so hostonly=no/yes does not change initramfs size or contents (~17 MB either way). Additionally, shipping a dracut.conf.d file from a kernel package violates EL convention — stock RHEL/CentOS 7, ELRepo kernel-lt el7/el8/el9, and Fedora rawhide all delegate dracut policy to separate config packages (dracut-config-generic, dracut-config-rescue) and never override it from the kernel RPM. Shipping it from here would silently stomp admin policy on every install. - %posttrans grub.cfg fallback added in 6.18.32-2 is retained — that is the actual fix for the prod failure on 2026-05-22, and verification confirmed it correctly handles the "grubby fatal error: unable to find a suitable template" failure mode via grub2-mkconfig regeneration. - Follow-up tracked in README: adopt an ELRepo-style curated config (boot drivers as =m) so the portable-initramfs question becomes meaningful, then Recommends: dracut-config-generic on EL8+. - Release counter only; no kernel source changes.

Update: kernel-lt-devel-6.18.60-2.el7

Sat, 31 Oct 2026 13:58:49 +0000

Package: kernel-lt-devel
Summary: Development package for building kernel modules to match the kernel.

Description:
This package provides the kernel header files and makefiles sufficient to build modules against the kernel package.

Changes:

kernel-lt-devel-6.18.60-2.el7.x86_64 [16.7 MiB]	Changelog by Danila Vershinin (2026-10-31): - Enable CONFIG_MEMCG_V1=y and CONFIG_CPUSETS_V1=y. Kernel 6.11/6.12 gated the cgroup v1 memory and cpuset controllers behind these default-n symbols, so the %prep `make olddefconfig` dropped them and EL7 userspace (systemd 219, libvirt 4.5, docker), which only speaks cgroup v1, could not mount the memory or cpuset hierarchies: libvirt cannot place VMs under cpuset/machine.slice and MemoryLimit= / docker --memory limits are not enforced. Reported by Nuonuo. - Restore Microsoft Hyper-V / Azure guest support. Kernel 6.18 turned CONFIG_HYPERV into a bool and split the VMBus driver out as CONFIG_HYPERV_VMBUS; the curated HYPERV=m became invalid, resolved to n, and took hv_storvsc, hv_netvsc, hv_balloon, hv_utils, pci-hyperv, hv_sock and MANA with it since 6.18.32-4. Now HYPERV=y, VMBUS=m. - CONFIG_FSCACHE=y (now bool; was invalid =m), CONFIG_IDPF=m (restores INFINIBAND_IRDMA), CONFIG_AMD_HSMP_ACPI/PLAT=m (AMD_HSMP split). - Source1 is now the exact olddefconfig-resolved config, and %prep fails the build if olddefconfig drops any symbol it enables, or if a required EL7-userspace symbol (cgroup v1, legacy xtables, Hyper-V storage) is unset.
kernel-lt-devel-6.18.60-1.el7.x86_64 [16.7 MiB]	Changelog by Danila Vershinin (2026-10-30): - Rebase to upstream 6.18.60 LTS. Fixes CVE-2026-98432 (ipv4: free inet_opt and ireq_opt after an RCU grace period; fixed upstream in 6.18.56): race-induced use-after-free in TCP SYN handling, remotely exploitable to root against hosts with a multipath TCP listener (CONFIG_MPTCP=y here). Also picks up 6.18.33..6.18.60 stable fixes. - Config carried forward unchanged from 6.18.32-7 (renamed to config-6.18.60-x86_64); %prep `make olddefconfig` resolves new symbols.
kernel-lt-devel-6.18.32-7.el7.x86_64 [16.7 MiB]	Changelog by Danila Vershinin (2026-07-06): - Enable CONFIG_NETFILTER_XTABLES_LEGACY=y (plus IP_NF_IPTABLES_LEGACY, IP6_NF_IPTABLES_LEGACY and BRIDGE_NF_EBTABLES_LEGACY as modules). Kernel 6.16 gated the legacy iptables get/setsockopt interface behind NETFILTER_XTABLES_LEGACY (default n), so the %prep `make olddefconfig` silently dropped ip_tables.ko, ip6_tables.ko, ebtables.ko and every iptable_/ip6table_ table module from the -4..-6 builds even though the curated config requests them. EL7 userspace is legacy-only (iptables 1.4.21, firewalld 0.6, fail2ban, wg-quick PostUp): on -6 firewalld exits FATAL with "iptables not usable, disabling IPv4 firewall", fail2ban stays active with zero ban chains, and the host runs with no packet filter at all. Surfaced during the web.getpagespeed.com prod cutover 2026-07-06; web.smartycode.com had carried the same silent hole since 2026-06-04. - %posttrans: `systemctl enable kdump.service` — EL convention is kdump armed whenever crashkernel memory is reserved, but hosts that lived on cloud-vendor helper kernels (kexec impossible) often carry it disabled; the prod cutover found exactly that.
kernel-lt-devel-6.18.32-6.el7.x86_64 [16.7 MiB]	Changelog by Danila Vershinin (2026-06-04): - %posttrans: unconditionally run grub2-mkconfig at the end of the post-install scriptlet so every kernel gets a unique, filename-derived $menuentry_id_option. grubby --add-kernel (invoked by new-kernel-pkg in %post) clones an existing menuentry as a template and copies the template's id verbatim; on hosts where the cloned template belongs to a different kernel family (mixed Linode helper, stock 3.10 kernel-el7 still installed alongside kernel-lt, freshly-flipped grub-legacy to GRUB 2), two menuentries end up sharing one id and GRUB_DEFAULT=saved selection becomes non-deterministic. Surfaced on web.smartycode.com 2026-06-04: the -5 install ended up sharing an id with the stock 3.10.0-1160.119.1.el7 entry and the host booted -4 instead of -5. - Upstream ELRepo kernel-lt-5.4.spec and RHEL 7 stock kernel.spec both delegate entirely to new-kernel-pkg/grubby and never call grub2-mkconfig themselves. EL8+/Fedora switched to kernel-install + BLS where each kernel becomes its own /boot/loader/entries/*.conf and the id-collision bug class does not exist. EL7 has no BLS, so this explicit regen is the durable workaround. The earlier vmlinuz-path self-heal in %posttrans is kept as a belt-and-braces pass and as a clean revert point if the unconditional regen ever misbehaves on a customer host. - Both BIOS /boot/grub2/grub.cfg and UEFI /boot/efi/EFI/centos/grub.cfg paths covered; mkconfig failure logs a WARN but does not abort the transaction. - Release counter only; no kernel source changes.
kernel-lt-devel-6.18.32-5.el7.x86_64 [16.7 MiB]	Changelog by Danila Vershinin (2026-06-02): - Disable CONFIG_MODULE_SIG (and the dependents MODULE_SIG_ALL, MODULE_SIG_SHA512, MODULE_SIG_HASH, MODULE_SIG_KEY*) so the kernel stops tainting itself with TAINT_UNSIGNED_MODULE (bit 13). The build pipeline does not enroll signing keys, so leaving signing enabled caused every in-tree module load (drm, etc.) to dmesg "module verification failed: signature and/or required key missing" and flip the taint bit. Matches ELRepo's kernel-lt convention (signing not enforced); customers needing signed modules can rebuild from SRPM with a local key. - Disable CONFIG_SECURITY_LOCKDOWN_LSM (and SECURITY_LOCKDOWN_LSM_EARLY, drop "lockdown" from CONFIG_LSM list). The lockdown LSM carries `select MODULE_SIG if MODULES`, which made the MODULE_SIG disable above impossible to land as long as lockdown was on. The corecare kernel was already shipping with CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y (lockdown was inert at boot), so removing the LSM itself is a no-op for the default runtime posture. Customers needing kernel lockdown can rebuild from SRPM with both lockdown and a self-enrolled signing key. - Release counter only; no kernel source changes.
kernel-lt-devel-6.18.32-4.el7.x86_64 [16.7 MiB]	Changelog by Danila Vershinin (2026-05-23): - Replace the upstream x86_64_defconfig seed with ELRepo el9's curated config-6.1.173-x86_64 (~10k lines, ~4k modules, ~2.5k builtins). The spec's existing `make olddefconfig` step in %prep resolves symbol drift forward to 6.18.32 against upstream defaults for any symbols added between 6.1 and 6.18. Result: boot drivers (virtio_blk, virtio_net, virtio_scsi, sd_mod, ext4) now ship as =m alongside non-KVM paravirt (xen_blkdev_frontend, xen_netdev_frontend, hyperv_storage, hyperv_net, vmware_pvscsi, vmxnet3) — matching the convention used by RHEL/CentOS, ELRepo, Fedora and Oracle UEK. The virtio bus (CONFIG_VIRTIO_PCI) stays builtin. With drivers now modular, dracut --hostonly produces a meaningfully smaller initramfs and shipping a portable-initramfs drop-in becomes worth revisiting. - Coverage of non-KVM hypervisor families (Xen-PV, Hyper-V, VMware) is verified by config-grep audit and `rpm -qlp \| grep '.ko$'` at build time, not by cold-booting on each platform. The Linode KVM sandbox proves the KVM path end-to-end. Per-hypervisor sandbox proof is not in scope; treat any non-KVM customer report as a hotfix trigger. - Future work for EL8+ targets: add `Recommends: dracut-config-generic` so dracut policy ships in its own package, per EL convention. EL7's yum 3.x has no weak-dep support so this is intentionally not added in this iteration. - Release counter only; no kernel source changes (Patch1-3 unchanged).
kernel-lt-devel-6.18.32-3.el7.x86_64 [15.5 MiB]	Changelog by Danila Vershinin (2026-05-23): - Drop /etc/dracut.conf.d/01-corecare-portable.conf shipped in 6.18.32-2. Verification on a prod-clone EL7 sandbox confirmed the drop-in was a no-op: the upstream x86_64_defconfig we currently build from compiles virtio_blk, virtio_pci, virtio_scsi, virtio_net, sd_mod and ext4 as CONFIG_*=y (builtin to vmlinuz) rather than =m, so hostonly=no/yes does not change initramfs size or contents (~17 MB either way). Additionally, shipping a dracut.conf.d file from a kernel package violates EL convention — stock RHEL/CentOS 7, ELRepo kernel-lt el7/el8/el9, and Fedora rawhide all delegate dracut policy to separate config packages (dracut-config-generic, dracut-config-rescue) and never override it from the kernel RPM. Shipping it from here would silently stomp admin policy on every install. - %posttrans grub.cfg fallback added in 6.18.32-2 is retained — that is the actual fix for the prod failure on 2026-05-22, and verification confirmed it correctly handles the "grubby fatal error: unable to find a suitable template" failure mode via grub2-mkconfig regeneration. - Follow-up tracked in README: adopt an ELRepo-style curated config (boot drivers as =m) so the portable-initramfs question becomes meaningful, then Recommends: dracut-config-generic on EL8+. - Release counter only; no kernel source changes.

Update: kernel-lt-headers-6.18.60-2.el7

Sat, 31 Oct 2026 13:58:49 +0000

Package: kernel-lt-headers
Summary: Header files of the kernel, for use by glibc.

Description:
This package provides the C header files that specify the interface between the Linux kernel and userspace libraries and programs. The header files define structures and constants that are needed when building most standard programs. They are also required when rebuilding the glibc package.

Changes:

kernel-lt-headers-6.18.60-2.el7.x86_64 [1.8 MiB]	Changelog by Danila Vershinin (2026-10-31): - Enable CONFIG_MEMCG_V1=y and CONFIG_CPUSETS_V1=y. Kernel 6.11/6.12 gated the cgroup v1 memory and cpuset controllers behind these default-n symbols, so the %prep `make olddefconfig` dropped them and EL7 userspace (systemd 219, libvirt 4.5, docker), which only speaks cgroup v1, could not mount the memory or cpuset hierarchies: libvirt cannot place VMs under cpuset/machine.slice and MemoryLimit= / docker --memory limits are not enforced. Reported by Nuonuo. - Restore Microsoft Hyper-V / Azure guest support. Kernel 6.18 turned CONFIG_HYPERV into a bool and split the VMBus driver out as CONFIG_HYPERV_VMBUS; the curated HYPERV=m became invalid, resolved to n, and took hv_storvsc, hv_netvsc, hv_balloon, hv_utils, pci-hyperv, hv_sock and MANA with it since 6.18.32-4. Now HYPERV=y, VMBUS=m. - CONFIG_FSCACHE=y (now bool; was invalid =m), CONFIG_IDPF=m (restores INFINIBAND_IRDMA), CONFIG_AMD_HSMP_ACPI/PLAT=m (AMD_HSMP split). - Source1 is now the exact olddefconfig-resolved config, and %prep fails the build if olddefconfig drops any symbol it enables, or if a required EL7-userspace symbol (cgroup v1, legacy xtables, Hyper-V storage) is unset.
kernel-lt-headers-6.18.60-1.el7.x86_64 [1.8 MiB]	Changelog by Danila Vershinin (2026-10-30): - Rebase to upstream 6.18.60 LTS. Fixes CVE-2026-98432 (ipv4: free inet_opt and ireq_opt after an RCU grace period; fixed upstream in 6.18.56): race-induced use-after-free in TCP SYN handling, remotely exploitable to root against hosts with a multipath TCP listener (CONFIG_MPTCP=y here). Also picks up 6.18.33..6.18.60 stable fixes. - Config carried forward unchanged from 6.18.32-7 (renamed to config-6.18.60-x86_64); %prep `make olddefconfig` resolves new symbols.
kernel-lt-headers-6.18.32-7.el7.x86_64 [1.8 MiB]	Changelog by Danila Vershinin (2026-07-06): - Enable CONFIG_NETFILTER_XTABLES_LEGACY=y (plus IP_NF_IPTABLES_LEGACY, IP6_NF_IPTABLES_LEGACY and BRIDGE_NF_EBTABLES_LEGACY as modules). Kernel 6.16 gated the legacy iptables get/setsockopt interface behind NETFILTER_XTABLES_LEGACY (default n), so the %prep `make olddefconfig` silently dropped ip_tables.ko, ip6_tables.ko, ebtables.ko and every iptable_/ip6table_ table module from the -4..-6 builds even though the curated config requests them. EL7 userspace is legacy-only (iptables 1.4.21, firewalld 0.6, fail2ban, wg-quick PostUp): on -6 firewalld exits FATAL with "iptables not usable, disabling IPv4 firewall", fail2ban stays active with zero ban chains, and the host runs with no packet filter at all. Surfaced during the web.getpagespeed.com prod cutover 2026-07-06; web.smartycode.com had carried the same silent hole since 2026-06-04. - %posttrans: `systemctl enable kdump.service` — EL convention is kdump armed whenever crashkernel memory is reserved, but hosts that lived on cloud-vendor helper kernels (kexec impossible) often carry it disabled; the prod cutover found exactly that.
kernel-lt-headers-6.18.32-6.el7.x86_64 [1.8 MiB]	Changelog by Danila Vershinin (2026-06-04): - %posttrans: unconditionally run grub2-mkconfig at the end of the post-install scriptlet so every kernel gets a unique, filename-derived $menuentry_id_option. grubby --add-kernel (invoked by new-kernel-pkg in %post) clones an existing menuentry as a template and copies the template's id verbatim; on hosts where the cloned template belongs to a different kernel family (mixed Linode helper, stock 3.10 kernel-el7 still installed alongside kernel-lt, freshly-flipped grub-legacy to GRUB 2), two menuentries end up sharing one id and GRUB_DEFAULT=saved selection becomes non-deterministic. Surfaced on web.smartycode.com 2026-06-04: the -5 install ended up sharing an id with the stock 3.10.0-1160.119.1.el7 entry and the host booted -4 instead of -5. - Upstream ELRepo kernel-lt-5.4.spec and RHEL 7 stock kernel.spec both delegate entirely to new-kernel-pkg/grubby and never call grub2-mkconfig themselves. EL8+/Fedora switched to kernel-install + BLS where each kernel becomes its own /boot/loader/entries/*.conf and the id-collision bug class does not exist. EL7 has no BLS, so this explicit regen is the durable workaround. The earlier vmlinuz-path self-heal in %posttrans is kept as a belt-and-braces pass and as a clean revert point if the unconditional regen ever misbehaves on a customer host. - Both BIOS /boot/grub2/grub.cfg and UEFI /boot/efi/EFI/centos/grub.cfg paths covered; mkconfig failure logs a WARN but does not abort the transaction. - Release counter only; no kernel source changes.
kernel-lt-headers-6.18.32-5.el7.x86_64 [1.8 MiB]	Changelog by Danila Vershinin (2026-06-02): - Disable CONFIG_MODULE_SIG (and the dependents MODULE_SIG_ALL, MODULE_SIG_SHA512, MODULE_SIG_HASH, MODULE_SIG_KEY*) so the kernel stops tainting itself with TAINT_UNSIGNED_MODULE (bit 13). The build pipeline does not enroll signing keys, so leaving signing enabled caused every in-tree module load (drm, etc.) to dmesg "module verification failed: signature and/or required key missing" and flip the taint bit. Matches ELRepo's kernel-lt convention (signing not enforced); customers needing signed modules can rebuild from SRPM with a local key. - Disable CONFIG_SECURITY_LOCKDOWN_LSM (and SECURITY_LOCKDOWN_LSM_EARLY, drop "lockdown" from CONFIG_LSM list). The lockdown LSM carries `select MODULE_SIG if MODULES`, which made the MODULE_SIG disable above impossible to land as long as lockdown was on. The corecare kernel was already shipping with CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y (lockdown was inert at boot), so removing the LSM itself is a no-op for the default runtime posture. Customers needing kernel lockdown can rebuild from SRPM with both lockdown and a self-enrolled signing key. - Release counter only; no kernel source changes.
kernel-lt-headers-6.18.32-4.el7.x86_64 [1.8 MiB]	Changelog by Danila Vershinin (2026-05-23): - Replace the upstream x86_64_defconfig seed with ELRepo el9's curated config-6.1.173-x86_64 (~10k lines, ~4k modules, ~2.5k builtins). The spec's existing `make olddefconfig` step in %prep resolves symbol drift forward to 6.18.32 against upstream defaults for any symbols added between 6.1 and 6.18. Result: boot drivers (virtio_blk, virtio_net, virtio_scsi, sd_mod, ext4) now ship as =m alongside non-KVM paravirt (xen_blkdev_frontend, xen_netdev_frontend, hyperv_storage, hyperv_net, vmware_pvscsi, vmxnet3) — matching the convention used by RHEL/CentOS, ELRepo, Fedora and Oracle UEK. The virtio bus (CONFIG_VIRTIO_PCI) stays builtin. With drivers now modular, dracut --hostonly produces a meaningfully smaller initramfs and shipping a portable-initramfs drop-in becomes worth revisiting. - Coverage of non-KVM hypervisor families (Xen-PV, Hyper-V, VMware) is verified by config-grep audit and `rpm -qlp \| grep '.ko$'` at build time, not by cold-booting on each platform. The Linode KVM sandbox proves the KVM path end-to-end. Per-hypervisor sandbox proof is not in scope; treat any non-KVM customer report as a hotfix trigger. - Future work for EL8+ targets: add `Recommends: dracut-config-generic` so dracut policy ships in its own package, per EL convention. EL7's yum 3.x has no weak-dep support so this is intentionally not added in this iteration. - Release counter only; no kernel source changes (Patch1-3 unchanged).
kernel-lt-headers-6.18.32-3.el7.x86_64 [1.8 MiB]	Changelog by Danila Vershinin (2026-05-23): - Drop /etc/dracut.conf.d/01-corecare-portable.conf shipped in 6.18.32-2. Verification on a prod-clone EL7 sandbox confirmed the drop-in was a no-op: the upstream x86_64_defconfig we currently build from compiles virtio_blk, virtio_pci, virtio_scsi, virtio_net, sd_mod and ext4 as CONFIG_*=y (builtin to vmlinuz) rather than =m, so hostonly=no/yes does not change initramfs size or contents (~17 MB either way). Additionally, shipping a dracut.conf.d file from a kernel package violates EL convention — stock RHEL/CentOS 7, ELRepo kernel-lt el7/el8/el9, and Fedora rawhide all delegate dracut policy to separate config packages (dracut-config-generic, dracut-config-rescue) and never override it from the kernel RPM. Shipping it from here would silently stomp admin policy on every install. - %posttrans grub.cfg fallback added in 6.18.32-2 is retained — that is the actual fix for the prod failure on 2026-05-22, and verification confirmed it correctly handles the "grubby fatal error: unable to find a suitable template" failure mode via grub2-mkconfig regeneration. - Follow-up tracked in README: adopt an ELRepo-style curated config (boot drivers as =m) so the portable-initramfs question becomes meaningful, then Recommends: dracut-config-generic on EL8+. - Release counter only; no kernel source changes.

Update: kernel-lt-tools-6.18.60-2.el7

Sat, 31 Oct 2026 13:58:49 +0000

Package: kernel-lt-tools
Summary: Assortment of tools for the kernel.

Description:
This package contains the tools/ directory and its supporting documentation, derived from the kernel source.

Changes:

kernel-lt-tools-6.18.60-2.el7.x86_64 [287 KiB]	Changelog by Danila Vershinin (2026-10-31): - Enable CONFIG_MEMCG_V1=y and CONFIG_CPUSETS_V1=y. Kernel 6.11/6.12 gated the cgroup v1 memory and cpuset controllers behind these default-n symbols, so the %prep `make olddefconfig` dropped them and EL7 userspace (systemd 219, libvirt 4.5, docker), which only speaks cgroup v1, could not mount the memory or cpuset hierarchies: libvirt cannot place VMs under cpuset/machine.slice and MemoryLimit= / docker --memory limits are not enforced. Reported by Nuonuo. - Restore Microsoft Hyper-V / Azure guest support. Kernel 6.18 turned CONFIG_HYPERV into a bool and split the VMBus driver out as CONFIG_HYPERV_VMBUS; the curated HYPERV=m became invalid, resolved to n, and took hv_storvsc, hv_netvsc, hv_balloon, hv_utils, pci-hyperv, hv_sock and MANA with it since 6.18.32-4. Now HYPERV=y, VMBUS=m. - CONFIG_FSCACHE=y (now bool; was invalid =m), CONFIG_IDPF=m (restores INFINIBAND_IRDMA), CONFIG_AMD_HSMP_ACPI/PLAT=m (AMD_HSMP split). - Source1 is now the exact olddefconfig-resolved config, and %prep fails the build if olddefconfig drops any symbol it enables, or if a required EL7-userspace symbol (cgroup v1, legacy xtables, Hyper-V storage) is unset.
kernel-lt-tools-6.18.60-1.el7.x86_64 [286 KiB]	Changelog by Danila Vershinin (2026-10-30): - Rebase to upstream 6.18.60 LTS. Fixes CVE-2026-98432 (ipv4: free inet_opt and ireq_opt after an RCU grace period; fixed upstream in 6.18.56): race-induced use-after-free in TCP SYN handling, remotely exploitable to root against hosts with a multipath TCP listener (CONFIG_MPTCP=y here). Also picks up 6.18.33..6.18.60 stable fixes. - Config carried forward unchanged from 6.18.32-7 (renamed to config-6.18.60-x86_64); %prep `make olddefconfig` resolves new symbols.
kernel-lt-tools-6.18.32-7.el7.x86_64 [285 KiB]	Changelog by Danila Vershinin (2026-07-06): - Enable CONFIG_NETFILTER_XTABLES_LEGACY=y (plus IP_NF_IPTABLES_LEGACY, IP6_NF_IPTABLES_LEGACY and BRIDGE_NF_EBTABLES_LEGACY as modules). Kernel 6.16 gated the legacy iptables get/setsockopt interface behind NETFILTER_XTABLES_LEGACY (default n), so the %prep `make olddefconfig` silently dropped ip_tables.ko, ip6_tables.ko, ebtables.ko and every iptable_/ip6table_ table module from the -4..-6 builds even though the curated config requests them. EL7 userspace is legacy-only (iptables 1.4.21, firewalld 0.6, fail2ban, wg-quick PostUp): on -6 firewalld exits FATAL with "iptables not usable, disabling IPv4 firewall", fail2ban stays active with zero ban chains, and the host runs with no packet filter at all. Surfaced during the web.getpagespeed.com prod cutover 2026-07-06; web.smartycode.com had carried the same silent hole since 2026-06-04. - %posttrans: `systemctl enable kdump.service` — EL convention is kdump armed whenever crashkernel memory is reserved, but hosts that lived on cloud-vendor helper kernels (kexec impossible) often carry it disabled; the prod cutover found exactly that.
kernel-lt-tools-6.18.32-6.el7.x86_64 [284 KiB]	Changelog by Danila Vershinin (2026-06-04): - %posttrans: unconditionally run grub2-mkconfig at the end of the post-install scriptlet so every kernel gets a unique, filename-derived $menuentry_id_option. grubby --add-kernel (invoked by new-kernel-pkg in %post) clones an existing menuentry as a template and copies the template's id verbatim; on hosts where the cloned template belongs to a different kernel family (mixed Linode helper, stock 3.10 kernel-el7 still installed alongside kernel-lt, freshly-flipped grub-legacy to GRUB 2), two menuentries end up sharing one id and GRUB_DEFAULT=saved selection becomes non-deterministic. Surfaced on web.smartycode.com 2026-06-04: the -5 install ended up sharing an id with the stock 3.10.0-1160.119.1.el7 entry and the host booted -4 instead of -5. - Upstream ELRepo kernel-lt-5.4.spec and RHEL 7 stock kernel.spec both delegate entirely to new-kernel-pkg/grubby and never call grub2-mkconfig themselves. EL8+/Fedora switched to kernel-install + BLS where each kernel becomes its own /boot/loader/entries/*.conf and the id-collision bug class does not exist. EL7 has no BLS, so this explicit regen is the durable workaround. The earlier vmlinuz-path self-heal in %posttrans is kept as a belt-and-braces pass and as a clean revert point if the unconditional regen ever misbehaves on a customer host. - Both BIOS /boot/grub2/grub.cfg and UEFI /boot/efi/EFI/centos/grub.cfg paths covered; mkconfig failure logs a WARN but does not abort the transaction. - Release counter only; no kernel source changes.
kernel-lt-tools-6.18.32-5.el7.x86_64 [282 KiB]	Changelog by Danila Vershinin (2026-06-02): - Disable CONFIG_MODULE_SIG (and the dependents MODULE_SIG_ALL, MODULE_SIG_SHA512, MODULE_SIG_HASH, MODULE_SIG_KEY*) so the kernel stops tainting itself with TAINT_UNSIGNED_MODULE (bit 13). The build pipeline does not enroll signing keys, so leaving signing enabled caused every in-tree module load (drm, etc.) to dmesg "module verification failed: signature and/or required key missing" and flip the taint bit. Matches ELRepo's kernel-lt convention (signing not enforced); customers needing signed modules can rebuild from SRPM with a local key. - Disable CONFIG_SECURITY_LOCKDOWN_LSM (and SECURITY_LOCKDOWN_LSM_EARLY, drop "lockdown" from CONFIG_LSM list). The lockdown LSM carries `select MODULE_SIG if MODULES`, which made the MODULE_SIG disable above impossible to land as long as lockdown was on. The corecare kernel was already shipping with CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y (lockdown was inert at boot), so removing the LSM itself is a no-op for the default runtime posture. Customers needing kernel lockdown can rebuild from SRPM with both lockdown and a self-enrolled signing key. - Release counter only; no kernel source changes.
kernel-lt-tools-6.18.32-4.el7.x86_64 [280 KiB]	Changelog by Danila Vershinin (2026-05-23): - Replace the upstream x86_64_defconfig seed with ELRepo el9's curated config-6.1.173-x86_64 (~10k lines, ~4k modules, ~2.5k builtins). The spec's existing `make olddefconfig` step in %prep resolves symbol drift forward to 6.18.32 against upstream defaults for any symbols added between 6.1 and 6.18. Result: boot drivers (virtio_blk, virtio_net, virtio_scsi, sd_mod, ext4) now ship as =m alongside non-KVM paravirt (xen_blkdev_frontend, xen_netdev_frontend, hyperv_storage, hyperv_net, vmware_pvscsi, vmxnet3) — matching the convention used by RHEL/CentOS, ELRepo, Fedora and Oracle UEK. The virtio bus (CONFIG_VIRTIO_PCI) stays builtin. With drivers now modular, dracut --hostonly produces a meaningfully smaller initramfs and shipping a portable-initramfs drop-in becomes worth revisiting. - Coverage of non-KVM hypervisor families (Xen-PV, Hyper-V, VMware) is verified by config-grep audit and `rpm -qlp \| grep '.ko$'` at build time, not by cold-booting on each platform. The Linode KVM sandbox proves the KVM path end-to-end. Per-hypervisor sandbox proof is not in scope; treat any non-KVM customer report as a hotfix trigger. - Future work for EL8+ targets: add `Recommends: dracut-config-generic` so dracut policy ships in its own package, per EL convention. EL7's yum 3.x has no weak-dep support so this is intentionally not added in this iteration. - Release counter only; no kernel source changes (Patch1-3 unchanged).
kernel-lt-tools-6.18.32-3.el7.x86_64 [278 KiB]	Changelog by Danila Vershinin (2026-05-23): - Drop /etc/dracut.conf.d/01-corecare-portable.conf shipped in 6.18.32-2. Verification on a prod-clone EL7 sandbox confirmed the drop-in was a no-op: the upstream x86_64_defconfig we currently build from compiles virtio_blk, virtio_pci, virtio_scsi, virtio_net, sd_mod and ext4 as CONFIG_*=y (builtin to vmlinuz) rather than =m, so hostonly=no/yes does not change initramfs size or contents (~17 MB either way). Additionally, shipping a dracut.conf.d file from a kernel package violates EL convention — stock RHEL/CentOS 7, ELRepo kernel-lt el7/el8/el9, and Fedora rawhide all delegate dracut policy to separate config packages (dracut-config-generic, dracut-config-rescue) and never override it from the kernel RPM. Shipping it from here would silently stomp admin policy on every install. - %posttrans grub.cfg fallback added in 6.18.32-2 is retained — that is the actual fix for the prod failure on 2026-05-22, and verification confirmed it correctly handles the "grubby fatal error: unable to find a suitable template" failure mode via grub2-mkconfig regeneration. - Follow-up tracked in README: adopt an ELRepo-style curated config (boot drivers as =m) so the portable-initramfs question becomes meaningful, then Recommends: dracut-config-generic on EL8+. - Release counter only; no kernel source changes.

Update: kernel-lt-tools-libs-6.18.60-2.el7

Sat, 31 Oct 2026 13:58:49 +0000

Package: kernel-lt-tools-libs
Summary: Libraries for the kernel tools.

Description:
This package contains the libraries built from the tools/ directory, derived from the kernel source.

Changes:

kernel-lt-tools-libs-6.18.60-2.el7.x86_64 [142 KiB]	Changelog by Danila Vershinin (2026-10-31): - Enable CONFIG_MEMCG_V1=y and CONFIG_CPUSETS_V1=y. Kernel 6.11/6.12 gated the cgroup v1 memory and cpuset controllers behind these default-n symbols, so the %prep `make olddefconfig` dropped them and EL7 userspace (systemd 219, libvirt 4.5, docker), which only speaks cgroup v1, could not mount the memory or cpuset hierarchies: libvirt cannot place VMs under cpuset/machine.slice and MemoryLimit= / docker --memory limits are not enforced. Reported by Nuonuo. - Restore Microsoft Hyper-V / Azure guest support. Kernel 6.18 turned CONFIG_HYPERV into a bool and split the VMBus driver out as CONFIG_HYPERV_VMBUS; the curated HYPERV=m became invalid, resolved to n, and took hv_storvsc, hv_netvsc, hv_balloon, hv_utils, pci-hyperv, hv_sock and MANA with it since 6.18.32-4. Now HYPERV=y, VMBUS=m. - CONFIG_FSCACHE=y (now bool; was invalid =m), CONFIG_IDPF=m (restores INFINIBAND_IRDMA), CONFIG_AMD_HSMP_ACPI/PLAT=m (AMD_HSMP split). - Source1 is now the exact olddefconfig-resolved config, and %prep fails the build if olddefconfig drops any symbol it enables, or if a required EL7-userspace symbol (cgroup v1, legacy xtables, Hyper-V storage) is unset.
kernel-lt-tools-libs-6.18.60-1.el7.x86_64 [141 KiB]	Changelog by Danila Vershinin (2026-10-30): - Rebase to upstream 6.18.60 LTS. Fixes CVE-2026-98432 (ipv4: free inet_opt and ireq_opt after an RCU grace period; fixed upstream in 6.18.56): race-induced use-after-free in TCP SYN handling, remotely exploitable to root against hosts with a multipath TCP listener (CONFIG_MPTCP=y here). Also picks up 6.18.33..6.18.60 stable fixes. - Config carried forward unchanged from 6.18.32-7 (renamed to config-6.18.60-x86_64); %prep `make olddefconfig` resolves new symbols.
kernel-lt-tools-libs-6.18.32-7.el7.x86_64 [140 KiB]	Changelog by Danila Vershinin (2026-07-06): - Enable CONFIG_NETFILTER_XTABLES_LEGACY=y (plus IP_NF_IPTABLES_LEGACY, IP6_NF_IPTABLES_LEGACY and BRIDGE_NF_EBTABLES_LEGACY as modules). Kernel 6.16 gated the legacy iptables get/setsockopt interface behind NETFILTER_XTABLES_LEGACY (default n), so the %prep `make olddefconfig` silently dropped ip_tables.ko, ip6_tables.ko, ebtables.ko and every iptable_/ip6table_ table module from the -4..-6 builds even though the curated config requests them. EL7 userspace is legacy-only (iptables 1.4.21, firewalld 0.6, fail2ban, wg-quick PostUp): on -6 firewalld exits FATAL with "iptables not usable, disabling IPv4 firewall", fail2ban stays active with zero ban chains, and the host runs with no packet filter at all. Surfaced during the web.getpagespeed.com prod cutover 2026-07-06; web.smartycode.com had carried the same silent hole since 2026-06-04. - %posttrans: `systemctl enable kdump.service` — EL convention is kdump armed whenever crashkernel memory is reserved, but hosts that lived on cloud-vendor helper kernels (kexec impossible) often carry it disabled; the prod cutover found exactly that.
kernel-lt-tools-libs-6.18.32-6.el7.x86_64 [139 KiB]	Changelog by Danila Vershinin (2026-06-04): - %posttrans: unconditionally run grub2-mkconfig at the end of the post-install scriptlet so every kernel gets a unique, filename-derived $menuentry_id_option. grubby --add-kernel (invoked by new-kernel-pkg in %post) clones an existing menuentry as a template and copies the template's id verbatim; on hosts where the cloned template belongs to a different kernel family (mixed Linode helper, stock 3.10 kernel-el7 still installed alongside kernel-lt, freshly-flipped grub-legacy to GRUB 2), two menuentries end up sharing one id and GRUB_DEFAULT=saved selection becomes non-deterministic. Surfaced on web.smartycode.com 2026-06-04: the -5 install ended up sharing an id with the stock 3.10.0-1160.119.1.el7 entry and the host booted -4 instead of -5. - Upstream ELRepo kernel-lt-5.4.spec and RHEL 7 stock kernel.spec both delegate entirely to new-kernel-pkg/grubby and never call grub2-mkconfig themselves. EL8+/Fedora switched to kernel-install + BLS where each kernel becomes its own /boot/loader/entries/*.conf and the id-collision bug class does not exist. EL7 has no BLS, so this explicit regen is the durable workaround. The earlier vmlinuz-path self-heal in %posttrans is kept as a belt-and-braces pass and as a clean revert point if the unconditional regen ever misbehaves on a customer host. - Both BIOS /boot/grub2/grub.cfg and UEFI /boot/efi/EFI/centos/grub.cfg paths covered; mkconfig failure logs a WARN but does not abort the transaction. - Release counter only; no kernel source changes.
kernel-lt-tools-libs-6.18.32-5.el7.x86_64 [137 KiB]	Changelog by Danila Vershinin (2026-06-02): - Disable CONFIG_MODULE_SIG (and the dependents MODULE_SIG_ALL, MODULE_SIG_SHA512, MODULE_SIG_HASH, MODULE_SIG_KEY*) so the kernel stops tainting itself with TAINT_UNSIGNED_MODULE (bit 13). The build pipeline does not enroll signing keys, so leaving signing enabled caused every in-tree module load (drm, etc.) to dmesg "module verification failed: signature and/or required key missing" and flip the taint bit. Matches ELRepo's kernel-lt convention (signing not enforced); customers needing signed modules can rebuild from SRPM with a local key. - Disable CONFIG_SECURITY_LOCKDOWN_LSM (and SECURITY_LOCKDOWN_LSM_EARLY, drop "lockdown" from CONFIG_LSM list). The lockdown LSM carries `select MODULE_SIG if MODULES`, which made the MODULE_SIG disable above impossible to land as long as lockdown was on. The corecare kernel was already shipping with CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y (lockdown was inert at boot), so removing the LSM itself is a no-op for the default runtime posture. Customers needing kernel lockdown can rebuild from SRPM with both lockdown and a self-enrolled signing key. - Release counter only; no kernel source changes.
kernel-lt-tools-libs-6.18.32-4.el7.x86_64 [135 KiB]	Changelog by Danila Vershinin (2026-05-23): - Replace the upstream x86_64_defconfig seed with ELRepo el9's curated config-6.1.173-x86_64 (~10k lines, ~4k modules, ~2.5k builtins). The spec's existing `make olddefconfig` step in %prep resolves symbol drift forward to 6.18.32 against upstream defaults for any symbols added between 6.1 and 6.18. Result: boot drivers (virtio_blk, virtio_net, virtio_scsi, sd_mod, ext4) now ship as =m alongside non-KVM paravirt (xen_blkdev_frontend, xen_netdev_frontend, hyperv_storage, hyperv_net, vmware_pvscsi, vmxnet3) — matching the convention used by RHEL/CentOS, ELRepo, Fedora and Oracle UEK. The virtio bus (CONFIG_VIRTIO_PCI) stays builtin. With drivers now modular, dracut --hostonly produces a meaningfully smaller initramfs and shipping a portable-initramfs drop-in becomes worth revisiting. - Coverage of non-KVM hypervisor families (Xen-PV, Hyper-V, VMware) is verified by config-grep audit and `rpm -qlp \| grep '.ko$'` at build time, not by cold-booting on each platform. The Linode KVM sandbox proves the KVM path end-to-end. Per-hypervisor sandbox proof is not in scope; treat any non-KVM customer report as a hotfix trigger. - Future work for EL8+ targets: add `Recommends: dracut-config-generic` so dracut policy ships in its own package, per EL convention. EL7's yum 3.x has no weak-dep support so this is intentionally not added in this iteration. - Release counter only; no kernel source changes (Patch1-3 unchanged).
kernel-lt-tools-libs-6.18.32-3.el7.x86_64 [133 KiB]	Changelog by Danila Vershinin (2026-05-23): - Drop /etc/dracut.conf.d/01-corecare-portable.conf shipped in 6.18.32-2. Verification on a prod-clone EL7 sandbox confirmed the drop-in was a no-op: the upstream x86_64_defconfig we currently build from compiles virtio_blk, virtio_pci, virtio_scsi, virtio_net, sd_mod and ext4 as CONFIG_*=y (builtin to vmlinuz) rather than =m, so hostonly=no/yes does not change initramfs size or contents (~17 MB either way). Additionally, shipping a dracut.conf.d file from a kernel package violates EL convention — stock RHEL/CentOS 7, ELRepo kernel-lt el7/el8/el9, and Fedora rawhide all delegate dracut policy to separate config packages (dracut-config-generic, dracut-config-rescue) and never override it from the kernel RPM. Shipping it from here would silently stomp admin policy on every install. - %posttrans grub.cfg fallback added in 6.18.32-2 is retained — that is the actual fix for the prod failure on 2026-05-22, and verification confirmed it correctly handles the "grubby fatal error: unable to find a suitable template" failure mode via grub2-mkconfig regeneration. - Follow-up tracked in README: adopt an ELRepo-style curated config (boot drivers as =m) so the portable-initramfs question becomes meaningful, then Recommends: dracut-config-generic on EL8+. - Release counter only; no kernel source changes.

Update: kernel-lt-tools-libs-devel-6.18.60-2.el7

Sat, 31 Oct 2026 13:58:49 +0000

Package: kernel-lt-tools-libs-devel
Summary: Development package for the kernel tools libraries.

Description:
This package contains the development files for the tools/ directory libraries, derived from the kernel source.

Changes:

kernel-lt-tools-libs-devel-6.18.60-2.el7.x86_64 [111 KiB]	Changelog by Danila Vershinin (2026-10-31): - Enable CONFIG_MEMCG_V1=y and CONFIG_CPUSETS_V1=y. Kernel 6.11/6.12 gated the cgroup v1 memory and cpuset controllers behind these default-n symbols, so the %prep `make olddefconfig` dropped them and EL7 userspace (systemd 219, libvirt 4.5, docker), which only speaks cgroup v1, could not mount the memory or cpuset hierarchies: libvirt cannot place VMs under cpuset/machine.slice and MemoryLimit= / docker --memory limits are not enforced. Reported by Nuonuo. - Restore Microsoft Hyper-V / Azure guest support. Kernel 6.18 turned CONFIG_HYPERV into a bool and split the VMBus driver out as CONFIG_HYPERV_VMBUS; the curated HYPERV=m became invalid, resolved to n, and took hv_storvsc, hv_netvsc, hv_balloon, hv_utils, pci-hyperv, hv_sock and MANA with it since 6.18.32-4. Now HYPERV=y, VMBUS=m. - CONFIG_FSCACHE=y (now bool; was invalid =m), CONFIG_IDPF=m (restores INFINIBAND_IRDMA), CONFIG_AMD_HSMP_ACPI/PLAT=m (AMD_HSMP split). - Source1 is now the exact olddefconfig-resolved config, and %prep fails the build if olddefconfig drops any symbol it enables, or if a required EL7-userspace symbol (cgroup v1, legacy xtables, Hyper-V storage) is unset.
kernel-lt-tools-libs-devel-6.18.60-1.el7.x86_64 [110 KiB]	Changelog by Danila Vershinin (2026-10-30): - Rebase to upstream 6.18.60 LTS. Fixes CVE-2026-98432 (ipv4: free inet_opt and ireq_opt after an RCU grace period; fixed upstream in 6.18.56): race-induced use-after-free in TCP SYN handling, remotely exploitable to root against hosts with a multipath TCP listener (CONFIG_MPTCP=y here). Also picks up 6.18.33..6.18.60 stable fixes. - Config carried forward unchanged from 6.18.32-7 (renamed to config-6.18.60-x86_64); %prep `make olddefconfig` resolves new symbols.
kernel-lt-tools-libs-devel-6.18.32-7.el7.x86_64 [109 KiB]	Changelog by Danila Vershinin (2026-07-06): - Enable CONFIG_NETFILTER_XTABLES_LEGACY=y (plus IP_NF_IPTABLES_LEGACY, IP6_NF_IPTABLES_LEGACY and BRIDGE_NF_EBTABLES_LEGACY as modules). Kernel 6.16 gated the legacy iptables get/setsockopt interface behind NETFILTER_XTABLES_LEGACY (default n), so the %prep `make olddefconfig` silently dropped ip_tables.ko, ip6_tables.ko, ebtables.ko and every iptable_/ip6table_ table module from the -4..-6 builds even though the curated config requests them. EL7 userspace is legacy-only (iptables 1.4.21, firewalld 0.6, fail2ban, wg-quick PostUp): on -6 firewalld exits FATAL with "iptables not usable, disabling IPv4 firewall", fail2ban stays active with zero ban chains, and the host runs with no packet filter at all. Surfaced during the web.getpagespeed.com prod cutover 2026-07-06; web.smartycode.com had carried the same silent hole since 2026-06-04. - %posttrans: `systemctl enable kdump.service` — EL convention is kdump armed whenever crashkernel memory is reserved, but hosts that lived on cloud-vendor helper kernels (kexec impossible) often carry it disabled; the prod cutover found exactly that.
kernel-lt-tools-libs-devel-6.18.32-6.el7.x86_64 [108 KiB]	Changelog by Danila Vershinin (2026-06-04): - %posttrans: unconditionally run grub2-mkconfig at the end of the post-install scriptlet so every kernel gets a unique, filename-derived $menuentry_id_option. grubby --add-kernel (invoked by new-kernel-pkg in %post) clones an existing menuentry as a template and copies the template's id verbatim; on hosts where the cloned template belongs to a different kernel family (mixed Linode helper, stock 3.10 kernel-el7 still installed alongside kernel-lt, freshly-flipped grub-legacy to GRUB 2), two menuentries end up sharing one id and GRUB_DEFAULT=saved selection becomes non-deterministic. Surfaced on web.smartycode.com 2026-06-04: the -5 install ended up sharing an id with the stock 3.10.0-1160.119.1.el7 entry and the host booted -4 instead of -5. - Upstream ELRepo kernel-lt-5.4.spec and RHEL 7 stock kernel.spec both delegate entirely to new-kernel-pkg/grubby and never call grub2-mkconfig themselves. EL8+/Fedora switched to kernel-install + BLS where each kernel becomes its own /boot/loader/entries/*.conf and the id-collision bug class does not exist. EL7 has no BLS, so this explicit regen is the durable workaround. The earlier vmlinuz-path self-heal in %posttrans is kept as a belt-and-braces pass and as a clean revert point if the unconditional regen ever misbehaves on a customer host. - Both BIOS /boot/grub2/grub.cfg and UEFI /boot/efi/EFI/centos/grub.cfg paths covered; mkconfig failure logs a WARN but does not abort the transaction. - Release counter only; no kernel source changes.
kernel-lt-tools-libs-devel-6.18.32-5.el7.x86_64 [106 KiB]	Changelog by Danila Vershinin (2026-06-02): - Disable CONFIG_MODULE_SIG (and the dependents MODULE_SIG_ALL, MODULE_SIG_SHA512, MODULE_SIG_HASH, MODULE_SIG_KEY*) so the kernel stops tainting itself with TAINT_UNSIGNED_MODULE (bit 13). The build pipeline does not enroll signing keys, so leaving signing enabled caused every in-tree module load (drm, etc.) to dmesg "module verification failed: signature and/or required key missing" and flip the taint bit. Matches ELRepo's kernel-lt convention (signing not enforced); customers needing signed modules can rebuild from SRPM with a local key. - Disable CONFIG_SECURITY_LOCKDOWN_LSM (and SECURITY_LOCKDOWN_LSM_EARLY, drop "lockdown" from CONFIG_LSM list). The lockdown LSM carries `select MODULE_SIG if MODULES`, which made the MODULE_SIG disable above impossible to land as long as lockdown was on. The corecare kernel was already shipping with CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y (lockdown was inert at boot), so removing the LSM itself is a no-op for the default runtime posture. Customers needing kernel lockdown can rebuild from SRPM with both lockdown and a self-enrolled signing key. - Release counter only; no kernel source changes.
kernel-lt-tools-libs-devel-6.18.32-4.el7.x86_64 [104 KiB]	Changelog by Danila Vershinin (2026-05-23): - Replace the upstream x86_64_defconfig seed with ELRepo el9's curated config-6.1.173-x86_64 (~10k lines, ~4k modules, ~2.5k builtins). The spec's existing `make olddefconfig` step in %prep resolves symbol drift forward to 6.18.32 against upstream defaults for any symbols added between 6.1 and 6.18. Result: boot drivers (virtio_blk, virtio_net, virtio_scsi, sd_mod, ext4) now ship as =m alongside non-KVM paravirt (xen_blkdev_frontend, xen_netdev_frontend, hyperv_storage, hyperv_net, vmware_pvscsi, vmxnet3) — matching the convention used by RHEL/CentOS, ELRepo, Fedora and Oracle UEK. The virtio bus (CONFIG_VIRTIO_PCI) stays builtin. With drivers now modular, dracut --hostonly produces a meaningfully smaller initramfs and shipping a portable-initramfs drop-in becomes worth revisiting. - Coverage of non-KVM hypervisor families (Xen-PV, Hyper-V, VMware) is verified by config-grep audit and `rpm -qlp \| grep '.ko$'` at build time, not by cold-booting on each platform. The Linode KVM sandbox proves the KVM path end-to-end. Per-hypervisor sandbox proof is not in scope; treat any non-KVM customer report as a hotfix trigger. - Future work for EL8+ targets: add `Recommends: dracut-config-generic` so dracut policy ships in its own package, per EL convention. EL7's yum 3.x has no weak-dep support so this is intentionally not added in this iteration. - Release counter only; no kernel source changes (Patch1-3 unchanged).
kernel-lt-tools-libs-devel-6.18.32-3.el7.x86_64 [103 KiB]	Changelog by Danila Vershinin (2026-05-23): - Drop /etc/dracut.conf.d/01-corecare-portable.conf shipped in 6.18.32-2. Verification on a prod-clone EL7 sandbox confirmed the drop-in was a no-op: the upstream x86_64_defconfig we currently build from compiles virtio_blk, virtio_pci, virtio_scsi, virtio_net, sd_mod and ext4 as CONFIG_*=y (builtin to vmlinuz) rather than =m, so hostonly=no/yes does not change initramfs size or contents (~17 MB either way). Additionally, shipping a dracut.conf.d file from a kernel package violates EL convention — stock RHEL/CentOS 7, ELRepo kernel-lt el7/el8/el9, and Fedora rawhide all delegate dracut policy to separate config packages (dracut-config-generic, dracut-config-rescue) and never override it from the kernel RPM. Shipping it from here would silently stomp admin policy on every install. - %posttrans grub.cfg fallback added in 6.18.32-2 is retained — that is the actual fix for the prod failure on 2026-05-22, and verification confirmed it correctly handles the "grubby fatal error: unable to find a suitable template" failure mode via grub2-mkconfig regeneration. - Follow-up tracked in README: adopt an ELRepo-style curated config (boot drivers as =m) so the portable-initramfs question becomes meaningful, then Recommends: dracut-config-generic on EL8+. - Release counter only; no kernel source changes.