Upstream linux-hardened tag v7.1.7-hardened1 available #43

New issue

Closed

opened 2026-08-08 11:01:03 +00:00 by unredacted_bot · 1 comment

unredacted_bot commented

2026-08-08 11:01:03 +00:00

Owner

Upstream tag: v7.1.7-hardened1
Local newest PUBLISHED: v7.1.6-hardened1

CVEs reported fixed in 7.1.7 since 7.1.6 (source: kernel.org CVE project).

Severity = Red Hat's rating (best-effort; the kernel CNA publishes no CVSS), not the project's own. List as of 2026-08-08T11:00Z — the feed can lag, so re-check vulns.git before building.

CVE-2026-68480 — x86/bugs: Make Safe-RET robust against interrupt injection

An attacker injecting interrupts while the Safe-RET mitigation executes
on machines affected by SRSO can neutralize the safe return sequence,
potentially leading to data leakage through speculative execution.

Fixup register state as if the Safe-RET sequence executed successfully
by "emulating" it, in a manner of speaking, and avoid executing a RET
instruction after returning from the interrupt.

Action: review the upstream signature, then tag from an up-to-date
main and push — the tag push triggers build-kernel.yml.

git switch main && git pull --ff-only   # do NOT skip
git tag v7.1.7-hardened1
git push origin v7.1.7-hardened1

The pull is load-bearing. Seed-bump merges and publish: commits
land on main continuously between builds, so a tag cut from a
stale checkout builds an old seed pin and silently ships that config.
If you already pushed a stale tag, drop it on both sides
(git push origin :refs/tags/v7.1.7-hardened1 then
git tag -d v7.1.7-hardened1), pull, and re-tag.

See docs/users/cve-policy.md for the SLA.

Upstream tag: v7.1.7-hardened1 Local newest PUBLISHED: v7.1.6-hardened1 **CVEs reported fixed in `7.1.7` since `7.1.6`** (source: kernel.org CVE project). _Severity = Red Hat's rating (best-effort; the kernel CNA publishes no CVSS), not the project's own. List as of 2026-08-08T11:00Z — the feed can lag, so re-check vulns.git before building._ <details><summary><strong>CVE-2026-68480</strong> — x86/bugs: Make Safe-RET robust against interrupt injection</summary> ```text An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return sequence, potentially leading to data leakage through speculative execution. Fixup register state as if the Safe-RET sequence executed successfully by "emulating" it, in a manner of speaking, and avoid executing a RET instruction after returning from the interrupt. ``` </details> Action: review the upstream signature, then tag from an up-to-date `main` and push — the tag push triggers build-kernel.yml. ``` git switch main && git pull --ff-only # do NOT skip git tag v7.1.7-hardened1 git push origin v7.1.7-hardened1 ``` The pull is load-bearing. Seed-bump merges and `publish:` commits land on `main` continuously between builds, so a tag cut from a stale checkout builds an old seed pin and silently ships that config. If you already pushed a stale tag, drop it on both sides (`git push origin :refs/tags/v7.1.7-hardened1` then `git tag -d v7.1.7-hardened1`), pull, and re-tag. See docs/users/cve-policy.md for the SLA.

zach commented

2026-08-09 05:58:17 +00:00

Owner

Released

zach closed this issue

2026-08-09 05:58:17 +00:00

No labels

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

unredacted/linux-hardened-unredacted#43

No description provided.

Rows
Columns