[rlc-10/6.12.0-124.55.1.el10_1] Multiple patches tested (4 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

xfrm: esp: avoid in-place decrypt on shared skb frags

cve CVE-2026-43284
commit-author Kuan-Ting Chen <h3xrabbit@gmail.com>
commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4

rxrpc: Fix potential UAF after skb_unshare() failure

cve-pre CVE-2026-43500
commit-author David Howells <dhowells@redhat.com>
commit 1f2740150f904bfa60e4bad74d65add3ccb5e7f8
upstream-diff |
	Trace-header conflict in include/trace/events/rxrpc.h: upstream's
	patch context refers to three trace constants that don't exist in
	this kernel — rxrpc_skb_put_purge_oob, rxrpc_skb_put_response, and
	rxrpc_skb_put_response_copy. They were added by earlier upstream
	rxrpc OOB/response work not present here, plus the dirty-frag fix
	itself for response_copy. The contested constants were dropped
	from the resolution since the code that would emit them isn't in
	this tree (no rxrpc_verify_response wrapper, no OOB-purge path).
	The constants this patch's new code actually uses
	(rxrpc_skb_put_call_rx, rxrpc_skb_see_unshare_nomem) applied
	cleanly. The other four files (ar-internal.h, call_event.c,
	io_thread.c, skbuff.c) merged with no conflicts.

rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets

cve-pre CVE-2026-43500
commit-author David Howells <dhowells@redhat.com>
commit 55b2984c96c37f909bbfe8851f13152693951382

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

cve CVE-2026-43500
commit-author Hyunwoo Kim <imv4bel@gmail.com>
commit -
commit-source https://lore.kernel.org/all/af2kdW2F1gJ9U-Gg@v4bel
upstream-diff |
        The conn_event.c hunk is dropped entirely. Upstream wraps the
        conn->security->verify_response() call inside a new
        rxrpc_verify_response() function that copies non-linear skbs before
        in-place decryption. This kernel doesn't have that wrapper; the
        security op is called directly from rxrpc_process_event(), so there
        is no call site to patch. Additionally, the rxkad_verify_response()
        implementation in this tree already pulls the response and ticket
        out via skb_copy_bits() into kmalloc'd local buffers and decrypts
        those buffers (not the skb backing pages), so the RESPONSE-packet
        vector that v3 closes upstream is not reachable here. The
        call_event.c hunk applies as-is.

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	36m 35s	37m 23s
aarch64	22m 8s	22m 41s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	395	59	rlc-10/6.12.0-124.55.1.el10_1	✅ No regressions
aarch64	347	53	rlc-10/6.12.0-124.55.1.el10_1	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1480	80	rlc-10/6.12.0-124.55.1.el10_1	✅ No regressions
aarch64	1451	81	rlc-10/6.12.0-124.55.1.el10_1	✅ No regressions

• View LTP logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 25573884272

[shreeya-patel98]

This is not the final PR, other CI is still running which wil update this one.

[roxanan1996]

This is not the final PR, other CI is still running which wil update this one.

nooo :(( I was so entusiastic

[PlaidCat]

This is not the final PR, other CI is still running which wil update this one.

Is this the commit header updates?

[roxanan1996]

This is not the final PR, other CI is still running which wil update this one.

Is this the commit header updates?

No. I am not sure if I should it now, it may interfere with the pipeline running. I am a bit confused tbh

[roxanan1996]

Changes look correct to me (content wise)

[roxanan1996]

I updated the commit messages.
Last pipeline is still not finished https://github.com/ctrliq/kernel-src-tree/actions/runs/25559699607.

[PlaidCat]