<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="35">
<package pkgid="7f77fea59da9f870e05408298d76bd439b90b65dc8cd3c68d2cc1f0f04a348c3" name="apf" arch="noarch">
  <version epoch="4" ver="1.7.6" rel="3.65.1.iworx"/>
  <changelog author="Matt Parmelee &lt;mparmelee@interworx.com&gt;" date="1457524800">- Implemented 'best guess' default interface</changelog>
  <changelog author="Matt Parmelee &lt;mparmelee@interworx.com&gt;" date="1458043200">- Defaulted RESV_DNS to ON.</changelog>
  <changelog author="Paul Oehler &lt;poehler@interworx.com&gt;" date="1505736000">- Upgrade to https://github.com/rfxn/advanced-policy-firewall/releases/tag/1.7.5-2</changelog>
  <changelog author="Paul Oehler &lt;poehler@interworx.com&gt;" date="1525780800">- Upgrade to https://github.com/rfxn/advanced-policy-firewall/commit/93adac0e19f8e486826dda4c2706dbf294b4b2b8</changelog>
  <changelog author="Paul Oehler &lt;poehler@interworx.com&gt;" date="1560859200">- Upgrade to 1.7.6-1 https://github.com/rfxn/advanced-policy-firewall/releases/tag/1.7.6-1</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt;" date="1605700800">- Upgrade to 1.7.6-2 https://github.com/rfxn/advanced-policy-firewall/releases/tag/1.7.6-2</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt;" date="1621944000">- Upgrade to 1.7.6-3 https://github.com/rfxn/advanced-policy-firewall/releases/tag/1.7.6-3</changelog>
  <changelog author="Joseph Purkis &lt;jpurkis@interworx.com&gt;" date="1640001600">- Remove ancient dynamic gcc resolution (always resulted in just 'gcc')
- Almalinux update</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt;" date="1660046400">- Build for Almalinux 9</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt;" date="1783771200">- Enumerate flush tables from iptables-save instead of
  /proc/net/ip_tables_names; the proc file is permanently empty on
  nft-backend systems with lazy x_tables registration (kernels &gt;= 5.13),
  so apf --stop/-f silently left all rules active (IWX-15041)</changelog>
</package>
<package pkgid="5fa9b273e8df87996aaeda78e549e948a90059eca7567c234c237f5cb90188d2" name="djbdns" arch="x86_64">
  <version epoch="0" ver="1.05" rel="192.rhe7x.iworx"/>
  <changelog author="Joseph Purkis &lt;jpurkis@interworx.com&gt;" date="1640088000">- Remove ancient dynamic gcc resolution (always resulted in just 'gcc')
- Cleaned up old Distros</changelog>
  <changelog author="Brandon Locke &lt;blocke@liquidweb.com&gt;" date="1659873600">- Increased datalimit default to 6000000</changelog>
  <changelog author="Brandon L. Locke &lt;blocke@liquidweb.com&gt;" date="1666008000">- Build for Almalinux 9</changelog>
  <changelog author="Brandon Locke &lt;blocke@liquidweb.com&gt;" date="1667476800">- Increase softlimit for axfrdns</changelog>
  <changelog author="Brandon Locke &lt;blocke@liquidweb.com&gt;" date="1686830400">- Require coreutils instead of fileutils on EL9+</changelog>
  <changelog author="Brandon Locke &lt;blocke@liquidweb.com&gt;" date="1687780800">- Increase softlimit for axfrdns again to run on EL9</changelog>
  <changelog author="Brandon Locke &lt;blocke@liduidweb.com&gt;" date="1764849600">- Remove uninstallation prevention scriptlet</changelog>
  <changelog author="Brandon Locke &lt;brandonlocke@nexcess.com&gt;" date="1777982400">- Fix axfrdns AXFR responses to include Question Section per RFC 5936 §2.2</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt;" date="1783771200">- Raise dnscache DATALIMIT to 8000000 and overwrite existing installs' env
  value in %post; kernels &gt;= 4.7 enforce RLIMIT_DATA against mmap and the
  old values crash-loop dnscache on enforcing kernels (IWX-15038)</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt;" date="1783771201">- Add native systemd unit (enabled) so stop/status work after reboots;
  previously the sysv-generated unit went inactive on reboot and
  'systemctl stop djbdns' silently no-oped while daemons ran under svscan
  (IWX-15039)</changelog>
</package>
<package pkgid="25d1aba7bff9cec99504707b393894d7583db9f6f18745654f9494e6a6dd0591" name="kernel-iwx" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="11.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
</package>
<package pkgid="89066d743fcdccc295b23cc8bd60d359f0c3c6214b576ec19b7eefc72af6eaa1" name="kernel-iwx" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
</package>
<package pkgid="257901dc6a2b4d8ad2f9c1ba5b0700ea49ff3c61613fc492880a237151f80030" name="kernel-iwx" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="8.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-5.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
</package>
<package pkgid="e06d76203fdaa453600d66aba45df06f5739ff87255fad0156ea8714cbdea00d" name="kernel-iwx" arch="x86_64">
  <version epoch="0" ver="6.18.39" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
</package>
<package pkgid="c8c81800ea8df8cd69e53d3a6c3d800a6eaac11a6b74163efb6a97d8fca4c229" name="kernel-iwx" arch="x86_64">
  <version epoch="0" ver="6.18.40" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
</package>
<package pkgid="b8a68c1e1d0d0e5efafe694d2b898cc97dcf763abc9849daad88cc2875b0b0b6" name="kernel-iwx" arch="x86_64">
  <version epoch="0" ver="6.18.43" rel="3.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-2.iworx" date="1785153601">- Enable CONFIG_LIVEPATCH and ship debuginfo for self-built live patches
  (kpatch-build), per Nicholas Welch's request. EL8/EL9 already carried
  LIVEPATCH=y from their distro config bases; EL7 now gets it too, and all
  three OSes are pinned to one posture: LIVEPATCH=y + DWARF4 debuginfo,
  force-listed and covered by the config-assertion gate. DWARF4 rather than
  the toolchain default because gcc 11/13 default to DWARF5, which EL7/EL8
  gdb and crash cannot read. DEBUG_INFO_BTF pinned off before it can spring
  alive if pahole ever lands in the mock roots. New kernel-iwx-debuginfo
  subpackage carries the unstripped vmlinux plus per-module .ko.debug
  companions at the standard /usr/lib/debug layout; runtime modules are now
  explicitly stripped with a .gnu_debuglink (previously EL8/EL9 compiled
  debuginfo and brp-strip discarded it; EL7 built none). Ref IWX-15115.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.43-1.iworx" date="1786017600">- Bump to upstream 6.18.43 (longterm, released 2026-08-06), cumulative over .41
  and .42 since neither was taken on its own. Primary driver is SCTPhantom
  (CVE-2026-64564), fixed in .42: a use-after-free in SCTP ASCONF DEL-IP
  processing where a single chunk carrying [Address Param L][DEL-IP L][DEL-IP
  0.0.0.0] frees asconf-&gt;transport and the wildcard DEL-IP then reuses the
  dangling pointer, leaving primary_path/active_path pointing at freed memory.
  CVSS 8.5, demonstrated local privesc to root and container-to-host escape;
  IP_SCTP is =m and autoloadable here, so every kernel-iwx published to date is
  exposed. Also carried: .41's single fix for an unprivileged-local UAF in posix
  CPU timers (timer_delete vs non-leader exec, freeing a still-armed timer),
  .43's single fix hardening the SRSO Safe-RET sequence against interrupt
  injection (AMD-SB-7061, no CVE; ~647 fleet hosts run affected Zen 2/Zen 3
  parts), and .42's iomap zero-length bitmap_set OOB write reachable from an
  ordinary unprivileged write on XFS. Ref IWX-15151.
- Force RHEL-grade hardening on EL7: FORTIFY_SOURCE, SLAB_FREELIST_HARDENED,
  SLAB_FREELIST_RANDOM, PAGE_POISONING and BPF_JIT_ALWAYS_ON are on in both
  RHEL-derived config bases and were off in ours, because the EL7 base is ELRepo
  kernel-ml tracking mainline defaults rather than Red Hat hardening. Now forced
  and covered by the config-assertion gate, giving all three OSes one posture.
  Compile-time or runtime-gated, so no measurable cost; EL7 is the deployed
  cohort and the slab pair raises the cost of exactly the heap-grooming UAF class
  above. Ref IWX-15152.</changelog>
</package>
<package pkgid="4f7d3598df812326ccadea77534253c0a9240fa3852a1921f17c600a3d48cd8a" name="kernel-iwx-debuginfo" arch="x86_64">
  <version epoch="0" ver="6.18.43" rel="3.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-2.iworx" date="1785153601">- Enable CONFIG_LIVEPATCH and ship debuginfo for self-built live patches
  (kpatch-build), per Nicholas Welch's request. EL8/EL9 already carried
  LIVEPATCH=y from their distro config bases; EL7 now gets it too, and all
  three OSes are pinned to one posture: LIVEPATCH=y + DWARF4 debuginfo,
  force-listed and covered by the config-assertion gate. DWARF4 rather than
  the toolchain default because gcc 11/13 default to DWARF5, which EL7/EL8
  gdb and crash cannot read. DEBUG_INFO_BTF pinned off before it can spring
  alive if pahole ever lands in the mock roots. New kernel-iwx-debuginfo
  subpackage carries the unstripped vmlinux plus per-module .ko.debug
  companions at the standard /usr/lib/debug layout; runtime modules are now
  explicitly stripped with a .gnu_debuglink (previously EL8/EL9 compiled
  debuginfo and brp-strip discarded it; EL7 built none). Ref IWX-15115.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.43-1.iworx" date="1786017600">- Bump to upstream 6.18.43 (longterm, released 2026-08-06), cumulative over .41
  and .42 since neither was taken on its own. Primary driver is SCTPhantom
  (CVE-2026-64564), fixed in .42: a use-after-free in SCTP ASCONF DEL-IP
  processing where a single chunk carrying [Address Param L][DEL-IP L][DEL-IP
  0.0.0.0] frees asconf-&gt;transport and the wildcard DEL-IP then reuses the
  dangling pointer, leaving primary_path/active_path pointing at freed memory.
  CVSS 8.5, demonstrated local privesc to root and container-to-host escape;
  IP_SCTP is =m and autoloadable here, so every kernel-iwx published to date is
  exposed. Also carried: .41's single fix for an unprivileged-local UAF in posix
  CPU timers (timer_delete vs non-leader exec, freeing a still-armed timer),
  .43's single fix hardening the SRSO Safe-RET sequence against interrupt
  injection (AMD-SB-7061, no CVE; ~647 fleet hosts run affected Zen 2/Zen 3
  parts), and .42's iomap zero-length bitmap_set OOB write reachable from an
  ordinary unprivileged write on XFS. Ref IWX-15151.
- Force RHEL-grade hardening on EL7: FORTIFY_SOURCE, SLAB_FREELIST_HARDENED,
  SLAB_FREELIST_RANDOM, PAGE_POISONING and BPF_JIT_ALWAYS_ON are on in both
  RHEL-derived config bases and were off in ours, because the EL7 base is ELRepo
  kernel-ml tracking mainline defaults rather than Red Hat hardening. Now forced
  and covered by the config-assertion gate, giving all three OSes one posture.
  Compile-time or runtime-gated, so no measurable cost; EL7 is the deployed
  cohort and the slab pair raises the cost of exactly the heap-grooming UAF class
  above. Ref IWX-15152.</changelog>
</package>
<package pkgid="a6ed45cada8add05b80d48722e5951dbbb1855c39669ebd32c9063f5ff7062a1" name="kernel-iwx-devel" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="11.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
</package>
<package pkgid="6ef0027a916b5d6111d09d806e79567c58babb654e4c6d1a397c9d619150178d" name="kernel-iwx-devel" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
</package>
<package pkgid="fd1336c7fbbad8829b6ba9fa3a1c74085b9f337963dcf2fc1a26509878146eb8" name="kernel-iwx-devel" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="8.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-5.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
</package>
<package pkgid="f0e82c1ef7ecc28479b121a48582c3e3cb5ec6a7cb2a4b81c6a6d9ea1ace3944" name="kernel-iwx-devel" arch="x86_64">
  <version epoch="0" ver="6.18.39" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
</package>
<package pkgid="8d12abcf3d7eeb63017ea146f34bc220ad40f9f9f1ea546645841cee6237f9e5" name="kernel-iwx-devel" arch="x86_64">
  <version epoch="0" ver="6.18.40" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
</package>
<package pkgid="766c1ce6ee3b6af7b25a0cf8f7a0704c529d95363d6839b5a4192505c0845ceb" name="kernel-iwx-devel" arch="x86_64">
  <version epoch="0" ver="6.18.43" rel="3.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-2.iworx" date="1785153601">- Enable CONFIG_LIVEPATCH and ship debuginfo for self-built live patches
  (kpatch-build), per Nicholas Welch's request. EL8/EL9 already carried
  LIVEPATCH=y from their distro config bases; EL7 now gets it too, and all
  three OSes are pinned to one posture: LIVEPATCH=y + DWARF4 debuginfo,
  force-listed and covered by the config-assertion gate. DWARF4 rather than
  the toolchain default because gcc 11/13 default to DWARF5, which EL7/EL8
  gdb and crash cannot read. DEBUG_INFO_BTF pinned off before it can spring
  alive if pahole ever lands in the mock roots. New kernel-iwx-debuginfo
  subpackage carries the unstripped vmlinux plus per-module .ko.debug
  companions at the standard /usr/lib/debug layout; runtime modules are now
  explicitly stripped with a .gnu_debuglink (previously EL8/EL9 compiled
  debuginfo and brp-strip discarded it; EL7 built none). Ref IWX-15115.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.43-1.iworx" date="1786017600">- Bump to upstream 6.18.43 (longterm, released 2026-08-06), cumulative over .41
  and .42 since neither was taken on its own. Primary driver is SCTPhantom
  (CVE-2026-64564), fixed in .42: a use-after-free in SCTP ASCONF DEL-IP
  processing where a single chunk carrying [Address Param L][DEL-IP L][DEL-IP
  0.0.0.0] frees asconf-&gt;transport and the wildcard DEL-IP then reuses the
  dangling pointer, leaving primary_path/active_path pointing at freed memory.
  CVSS 8.5, demonstrated local privesc to root and container-to-host escape;
  IP_SCTP is =m and autoloadable here, so every kernel-iwx published to date is
  exposed. Also carried: .41's single fix for an unprivileged-local UAF in posix
  CPU timers (timer_delete vs non-leader exec, freeing a still-armed timer),
  .43's single fix hardening the SRSO Safe-RET sequence against interrupt
  injection (AMD-SB-7061, no CVE; ~647 fleet hosts run affected Zen 2/Zen 3
  parts), and .42's iomap zero-length bitmap_set OOB write reachable from an
  ordinary unprivileged write on XFS. Ref IWX-15151.
- Force RHEL-grade hardening on EL7: FORTIFY_SOURCE, SLAB_FREELIST_HARDENED,
  SLAB_FREELIST_RANDOM, PAGE_POISONING and BPF_JIT_ALWAYS_ON are on in both
  RHEL-derived config bases and were off in ours, because the EL7 base is ELRepo
  kernel-ml tracking mainline defaults rather than Red Hat hardening. Now forced
  and covered by the config-assertion gate, giving all three OSes one posture.
  Compile-time or runtime-gated, so no measurable cost; EL7 is the deployed
  cohort and the slab pair raises the cost of exactly the heap-grooming UAF class
  above. Ref IWX-15152.</changelog>
</package>
<package pkgid="8fc1c076e58cf619c24ee1e848d1bf28bfa4f3d5160d7d4b1290f7600064071b" name="kernel-iwx-headers" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="11.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
</package>
<package pkgid="9471b950e48406923e581765d2c1c92969d9b4791c660ed108df399fe01cbe3f" name="kernel-iwx-headers" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="8.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-5.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
</package>
<package pkgid="3e82bfd127e08536622e2f3716164ecd2eb24a9b3a4207656676fee135778994" name="kernel-iwx-headers" arch="x86_64">
  <version epoch="0" ver="6.18.39" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
</package>
<package pkgid="b37f4297b8d5a777adf442a499608b55c1fe4a4f15b7903b23c5d15e6df09678" name="kernel-iwx-headers" arch="x86_64">
  <version epoch="0" ver="6.18.40" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
</package>
<package pkgid="5d2ef4253fef50377980e5dd69a859b86cdb6598403219ea39a34488ada00f6d" name="kernel-iwx-headers" arch="x86_64">
  <version epoch="0" ver="6.18.43" rel="3.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-2.iworx" date="1785153601">- Enable CONFIG_LIVEPATCH and ship debuginfo for self-built live patches
  (kpatch-build), per Nicholas Welch's request. EL8/EL9 already carried
  LIVEPATCH=y from their distro config bases; EL7 now gets it too, and all
  three OSes are pinned to one posture: LIVEPATCH=y + DWARF4 debuginfo,
  force-listed and covered by the config-assertion gate. DWARF4 rather than
  the toolchain default because gcc 11/13 default to DWARF5, which EL7/EL8
  gdb and crash cannot read. DEBUG_INFO_BTF pinned off before it can spring
  alive if pahole ever lands in the mock roots. New kernel-iwx-debuginfo
  subpackage carries the unstripped vmlinux plus per-module .ko.debug
  companions at the standard /usr/lib/debug layout; runtime modules are now
  explicitly stripped with a .gnu_debuglink (previously EL8/EL9 compiled
  debuginfo and brp-strip discarded it; EL7 built none). Ref IWX-15115.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.43-1.iworx" date="1786017600">- Bump to upstream 6.18.43 (longterm, released 2026-08-06), cumulative over .41
  and .42 since neither was taken on its own. Primary driver is SCTPhantom
  (CVE-2026-64564), fixed in .42: a use-after-free in SCTP ASCONF DEL-IP
  processing where a single chunk carrying [Address Param L][DEL-IP L][DEL-IP
  0.0.0.0] frees asconf-&gt;transport and the wildcard DEL-IP then reuses the
  dangling pointer, leaving primary_path/active_path pointing at freed memory.
  CVSS 8.5, demonstrated local privesc to root and container-to-host escape;
  IP_SCTP is =m and autoloadable here, so every kernel-iwx published to date is
  exposed. Also carried: .41's single fix for an unprivileged-local UAF in posix
  CPU timers (timer_delete vs non-leader exec, freeing a still-armed timer),
  .43's single fix hardening the SRSO Safe-RET sequence against interrupt
  injection (AMD-SB-7061, no CVE; ~647 fleet hosts run affected Zen 2/Zen 3
  parts), and .42's iomap zero-length bitmap_set OOB write reachable from an
  ordinary unprivileged write on XFS. Ref IWX-15151.
- Force RHEL-grade hardening on EL7: FORTIFY_SOURCE, SLAB_FREELIST_HARDENED,
  SLAB_FREELIST_RANDOM, PAGE_POISONING and BPF_JIT_ALWAYS_ON are on in both
  RHEL-derived config bases and were off in ours, because the EL7 base is ELRepo
  kernel-ml tracking mainline defaults rather than Red Hat hardening. Now forced
  and covered by the config-assertion gate, giving all three OSes one posture.
  Compile-time or runtime-gated, so no measurable cost; EL7 is the deployed
  cohort and the slab pair raises the cost of exactly the heap-grooming UAF class
  above. Ref IWX-15152.</changelog>
</package>
<package pkgid="a73824b9f75296f8784b43a011cd161354f4ca800f4d106062eafa19f726bbef" name="kernel-iwx-tools" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="11.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
</package>
<package pkgid="97cffff8a1e7fea51f9177dfc626b852babce0fe92b742139fca171d53c0c33e" name="kernel-iwx-tools" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="8.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-5.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
</package>
<package pkgid="1da80b53bd140920621ee2eb86e1a6a6ce349466df4cf3f04fff1db3b1676f35" name="kernel-iwx-tools" arch="x86_64">
  <version epoch="0" ver="6.18.39" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
</package>
<package pkgid="c6fb7bb3b55277ff55c5593d34d6e74da385504cfe31d3821b33bcea2ba99766" name="kernel-iwx-tools" arch="x86_64">
  <version epoch="0" ver="6.18.40" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
</package>
<package pkgid="a4b94c275ba906eb84be5fcf8668f287472abc0cbac4174e7910fcde99a65d70" name="kernel-iwx-tools" arch="x86_64">
  <version epoch="0" ver="6.18.43" rel="3.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-2.iworx" date="1785153601">- Enable CONFIG_LIVEPATCH and ship debuginfo for self-built live patches
  (kpatch-build), per Nicholas Welch's request. EL8/EL9 already carried
  LIVEPATCH=y from their distro config bases; EL7 now gets it too, and all
  three OSes are pinned to one posture: LIVEPATCH=y + DWARF4 debuginfo,
  force-listed and covered by the config-assertion gate. DWARF4 rather than
  the toolchain default because gcc 11/13 default to DWARF5, which EL7/EL8
  gdb and crash cannot read. DEBUG_INFO_BTF pinned off before it can spring
  alive if pahole ever lands in the mock roots. New kernel-iwx-debuginfo
  subpackage carries the unstripped vmlinux plus per-module .ko.debug
  companions at the standard /usr/lib/debug layout; runtime modules are now
  explicitly stripped with a .gnu_debuglink (previously EL8/EL9 compiled
  debuginfo and brp-strip discarded it; EL7 built none). Ref IWX-15115.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.43-1.iworx" date="1786017600">- Bump to upstream 6.18.43 (longterm, released 2026-08-06), cumulative over .41
  and .42 since neither was taken on its own. Primary driver is SCTPhantom
  (CVE-2026-64564), fixed in .42: a use-after-free in SCTP ASCONF DEL-IP
  processing where a single chunk carrying [Address Param L][DEL-IP L][DEL-IP
  0.0.0.0] frees asconf-&gt;transport and the wildcard DEL-IP then reuses the
  dangling pointer, leaving primary_path/active_path pointing at freed memory.
  CVSS 8.5, demonstrated local privesc to root and container-to-host escape;
  IP_SCTP is =m and autoloadable here, so every kernel-iwx published to date is
  exposed. Also carried: .41's single fix for an unprivileged-local UAF in posix
  CPU timers (timer_delete vs non-leader exec, freeing a still-armed timer),
  .43's single fix hardening the SRSO Safe-RET sequence against interrupt
  injection (AMD-SB-7061, no CVE; ~647 fleet hosts run affected Zen 2/Zen 3
  parts), and .42's iomap zero-length bitmap_set OOB write reachable from an
  ordinary unprivileged write on XFS. Ref IWX-15151.
- Force RHEL-grade hardening on EL7: FORTIFY_SOURCE, SLAB_FREELIST_HARDENED,
  SLAB_FREELIST_RANDOM, PAGE_POISONING and BPF_JIT_ALWAYS_ON are on in both
  RHEL-derived config bases and were off in ours, because the EL7 base is ELRepo
  kernel-ml tracking mainline defaults rather than Red Hat hardening. Now forced
  and covered by the config-assertion gate, giving all three OSes one posture.
  Compile-time or runtime-gated, so no measurable cost; EL7 is the deployed
  cohort and the slab pair raises the cost of exactly the heap-grooming UAF class
  above. Ref IWX-15152.</changelog>
</package>
<package pkgid="a1670eddde1ff53c853b17896f9bd1555255013e53b0ee87b217894a9c0c67d4" name="kernel-iwx-tools-libs" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="11.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
</package>
<package pkgid="71cd0198daa6fd67bd1d48b74d5a7633ba9bd27c740e26187fc4ac1a9cba91be" name="kernel-iwx-tools-libs" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="8.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-5.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
</package>
<package pkgid="c461e564daceb1140f948db462e0475bc517a98c859a780e22a0e6f7daa8379c" name="kernel-iwx-tools-libs" arch="x86_64">
  <version epoch="0" ver="6.18.39" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
</package>
<package pkgid="c4ff5cf1a1b154fb73fa28f13515d83aa7bc2a0b84d14ce14269ff8db11a8009" name="kernel-iwx-tools-libs" arch="x86_64">
  <version epoch="0" ver="6.18.40" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
</package>
<package pkgid="69945a95e6d2868f6f220c32c7af0a8fe025c74705737543b32993bccd439170" name="kernel-iwx-tools-libs" arch="x86_64">
  <version epoch="0" ver="6.18.43" rel="3.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-2.iworx" date="1785153601">- Enable CONFIG_LIVEPATCH and ship debuginfo for self-built live patches
  (kpatch-build), per Nicholas Welch's request. EL8/EL9 already carried
  LIVEPATCH=y from their distro config bases; EL7 now gets it too, and all
  three OSes are pinned to one posture: LIVEPATCH=y + DWARF4 debuginfo,
  force-listed and covered by the config-assertion gate. DWARF4 rather than
  the toolchain default because gcc 11/13 default to DWARF5, which EL7/EL8
  gdb and crash cannot read. DEBUG_INFO_BTF pinned off before it can spring
  alive if pahole ever lands in the mock roots. New kernel-iwx-debuginfo
  subpackage carries the unstripped vmlinux plus per-module .ko.debug
  companions at the standard /usr/lib/debug layout; runtime modules are now
  explicitly stripped with a .gnu_debuglink (previously EL8/EL9 compiled
  debuginfo and brp-strip discarded it; EL7 built none). Ref IWX-15115.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.43-1.iworx" date="1786017600">- Bump to upstream 6.18.43 (longterm, released 2026-08-06), cumulative over .41
  and .42 since neither was taken on its own. Primary driver is SCTPhantom
  (CVE-2026-64564), fixed in .42: a use-after-free in SCTP ASCONF DEL-IP
  processing where a single chunk carrying [Address Param L][DEL-IP L][DEL-IP
  0.0.0.0] frees asconf-&gt;transport and the wildcard DEL-IP then reuses the
  dangling pointer, leaving primary_path/active_path pointing at freed memory.
  CVSS 8.5, demonstrated local privesc to root and container-to-host escape;
  IP_SCTP is =m and autoloadable here, so every kernel-iwx published to date is
  exposed. Also carried: .41's single fix for an unprivileged-local UAF in posix
  CPU timers (timer_delete vs non-leader exec, freeing a still-armed timer),
  .43's single fix hardening the SRSO Safe-RET sequence against interrupt
  injection (AMD-SB-7061, no CVE; ~647 fleet hosts run affected Zen 2/Zen 3
  parts), and .42's iomap zero-length bitmap_set OOB write reachable from an
  ordinary unprivileged write on XFS. Ref IWX-15151.
- Force RHEL-grade hardening on EL7: FORTIFY_SOURCE, SLAB_FREELIST_HARDENED,
  SLAB_FREELIST_RANDOM, PAGE_POISONING and BPF_JIT_ALWAYS_ON are on in both
  RHEL-derived config bases and were off in ours, because the EL7 base is ELRepo
  kernel-ml tracking mainline defaults rather than Red Hat hardening. Now forced
  and covered by the config-assertion gate, giving all three OSes one posture.
  Compile-time or runtime-gated, so no measurable cost; EL7 is the deployed
  cohort and the slab pair raises the cost of exactly the heap-grooming UAF class
  above. Ref IWX-15152.</changelog>
</package>
<package pkgid="3237050751d1c70f7c824eac0e8e28571d86b8e0796478ec010d96f4a50fb338" name="kernel-iwx-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="11.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
</package>
<package pkgid="dd88e860e201643852edc5885522093f182513d4d17747e899efbc7c542b88ba" name="kernel-iwx-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="6.18.38" rel="8.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-5.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
</package>
<package pkgid="d4c1c98954dd0ad57ab24e60999d6b2d4bb44b78996497cbd7588c76918fe5a9" name="kernel-iwx-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="6.18.39" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
</package>
<package pkgid="10446f189fa1af7ea3a77b88b0f5419304bb007499dc6b0975661721cda176a2" name="kernel-iwx-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="6.18.40" rel="2.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
</package>
<package pkgid="3f47a058f87eb6e02fb7a093aa1a8f935d62bdc9bd5d597be53144bfbb2dd443" name="kernel-iwx-tools-libs-devel" arch="x86_64">
  <version epoch="0" ver="6.18.43" rel="3.el7.iworx"/>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-1.iworx" date="1783684800">- Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
  subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
  flavour, x86_64, per-OS %if branches.
- InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
  shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
  (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
- EL8/EL9 config assembly and kernel-install boot integration remain TODO.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-7.iworx" date="1784030400">- Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
  ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
  (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
  boot integration, secure-boot infra disabled for vanilla source, nft AND
  legacy iptables backends per the APF posture); portable brp macros with EL7
  fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
  build time via sources/REMOTE-SOURCES instead of manual placement.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-8.iworx" date="1784116800">- Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
  headers (make headers_install), tools (cpupower + debug decoders, turbostat,
  x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
  tools-libs and tools-libs-devel (libcpupower); name Provides for the
  Fedora-style kernel-core/-modules split on the monolithic main package.
  EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
  kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-11.iworx" date="1784203200">- Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
  iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
  published build: the two-pass olddefconfig flow dropped them because they
  were never on the REQUIRED_M force list and have no legacy-gated Kconfig
  default. Field impact: boot-time ip6tables-restore failed with "unable to
  initialize table 'nat'" on fleet boxes with a *nat block in
  /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
  *nat from the saved v4 ruleset.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.38-13.iworx" date="1784462400">- Force and assert the fleet's storage and NIC drivers in the config gate so a
  base-config rebase or localmodconfig slip cannot silently drop them:
  SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
  controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
  IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
  EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.39-1.iworx" date="1784548800">- Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
  futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
  and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
  that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
  Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
  unchanged. Ref IWX-15085.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-1.iworx" date="1785153600">- Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
  not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
  First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
  NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
  crash callers that dereference them unchecked - .38 and .39 both shipped it,
  and conntrack runs on every APF/csf box. Second, a five-commit ipset race
  batch (gc not stopped on set destroy, add-vs-dump data race in all hash
  types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
  AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
  fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
  address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
  config gate is unchanged. Ref IWX-15114.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.40-2.iworx" date="1785153601">- Enable CONFIG_LIVEPATCH and ship debuginfo for self-built live patches
  (kpatch-build), per Nicholas Welch's request. EL8/EL9 already carried
  LIVEPATCH=y from their distro config bases; EL7 now gets it too, and all
  three OSes are pinned to one posture: LIVEPATCH=y + DWARF4 debuginfo,
  force-listed and covered by the config-assertion gate. DWARF4 rather than
  the toolchain default because gcc 11/13 default to DWARF5, which EL7/EL8
  gdb and crash cannot read. DEBUG_INFO_BTF pinned off before it can spring
  alive if pahole ever lands in the mock roots. New kernel-iwx-debuginfo
  subpackage carries the unstripped vmlinux plus per-module .ko.debug
  companions at the standard /usr/lib/debug layout; runtime modules are now
  explicitly stripped with a .gnu_debuglink (previously EL8/EL9 compiled
  debuginfo and brp-strip discarded it; EL7 built none). Ref IWX-15115.</changelog>
  <changelog author="Tim College &lt;tcollege@interworx.com&gt; - 6.18.43-1.iworx" date="1786017600">- Bump to upstream 6.18.43 (longterm, released 2026-08-06), cumulative over .41
  and .42 since neither was taken on its own. Primary driver is SCTPhantom
  (CVE-2026-64564), fixed in .42: a use-after-free in SCTP ASCONF DEL-IP
  processing where a single chunk carrying [Address Param L][DEL-IP L][DEL-IP
  0.0.0.0] frees asconf-&gt;transport and the wildcard DEL-IP then reuses the
  dangling pointer, leaving primary_path/active_path pointing at freed memory.
  CVSS 8.5, demonstrated local privesc to root and container-to-host escape;
  IP_SCTP is =m and autoloadable here, so every kernel-iwx published to date is
  exposed. Also carried: .41's single fix for an unprivileged-local UAF in posix
  CPU timers (timer_delete vs non-leader exec, freeing a still-armed timer),
  .43's single fix hardening the SRSO Safe-RET sequence against interrupt
  injection (AMD-SB-7061, no CVE; ~647 fleet hosts run affected Zen 2/Zen 3
  parts), and .42's iomap zero-length bitmap_set OOB write reachable from an
  ordinary unprivileged write on XFS. Ref IWX-15151.
- Force RHEL-grade hardening on EL7: FORTIFY_SOURCE, SLAB_FREELIST_HARDENED,
  SLAB_FREELIST_RANDOM, PAGE_POISONING and BPF_JIT_ALWAYS_ON are on in both
  RHEL-derived config bases and were off in ours, because the EL7 base is ELRepo
  kernel-ml tracking mainline defaults rather than Red Hat hardening. Now forced
  and covered by the config-assertion gate, giving all three OSes one posture.
  Compile-time or runtime-gated, so no measurable cost; EL7 is the deployed
  cohort and the slab pair raises the cost of exactly the heap-grooming UAF class
  above. Ref IWX-15152.</changelog>
</package>
</otherdata>