# Storm patched kernel 5.4.206 (vGhost CVE-2026-74580 + PwnEscape CVE-2026-99999 + CVE-2026-98432 + ZDI-CAN-33367 + Intel ice 1.9.11)

Patched `5.4.206-205.el7` kernel for Storm KVM parents on `5.4.206-200`. Built in-tree, carrying
four CVE/vuln fixes plus Intel's ice driver:

- **vGhost (CVE-2026-74580)** - upstream `de845981da67` (vhost: reset the vring metadata cache on
  vring reconfiguration). `vhost.ko` srcversion is `D51072C9860077DC6AA6532`.
- **PwnEscape (CVE-2026-99999)** - upstream `6785011f8b16` (ipv4: validate checksum_start before
  completing checksum). Compiled into the kernel; runtime-proven to block the corruption path.
- **CVE-2026-98432** - upstream `e3f33b0a1d89` (ipv4: free inet_opt and ireq_opt after an RCU
  grace period). Fixes a use-after-free in the IPv4 TCP handshake. In the ipv4 stack (no module
  srcversion); present by construction.
- **ZDI-CAN-33367 ("Fragnesia")** - upstream `8ece90615012` + `f66bdb1cc0fc` (net: skbuff: don't
  strip zerocopy frag markers from a forwarded skb). Fixes a local privilege escalation via ESP
  in-place decrypt over shared skb frags. In `net/core/skbuff` (no module srcversion); present by
  construction. Operationally also mitigated by `user.max_user_namespaces=0` where deployed.
- **Intel ice 1.9.11** replaces the in-tree ice 0.8.1-k, which has no driver for E810-XXV
  (`8086:159b`). This is the same driver E810 parents already run on `-200` from Intel's
  `ice-1.9.11-1` RPM (srcversion `E0A755B08AF362959CD1766`), now built into `kernel-core` so no
  separate package is needed.

Everything else matches Storm's `-200` build. Earlier builds (`-201` vGhost only, `-202` no Intel
ice, `-203` the first ice-in-tree build) are superseded by this `-205` (all remain in the repo;
`-205` is the one to install).

## Install

```
# 1. Fetch the repo file
curl -o /etc/yum.repos.d/kernel-storm-5.4.206.repo \
  http://updates.interworx.com/_internal/kernel-storm-5.4.206/kernel-storm-5.4.206.repo

# 2. Install the patched kernel. It installs ALONGSIDE the running kernel (kernels are
#    install-only); it does not replace or remove it. The kernel meta-package pulls in
#    kernel-core and kernel-modules automatically.
yum install -y kernel-5.4.206-205.el7 kernel-modules-extra-5.4.206-205.el7

# 3. Make it the default and reboot
grubby --set-default /boot/vmlinuz-5.4.206-205.el7.x86_64
reboot

# 4. Verify after reboot
uname -r                           # 5.4.206-205.el7.x86_64
cat /sys/module/vhost/srcversion   # D51072C9860077DC6AA6532  (vGhost fix)
# PwnEscape, CVE-2026-98432 and ZDI-CAN-33367 fixes are in the ipv4 / net stack (no module
# srcversion); present in this build by construction.
# E810 hosts only:
cat /sys/module/ice/version        # 1.9.11
cat /proc/net/bonding/bond0        # all slaves up
```

## Rollback

```
grubby --set-default /boot/vmlinuz-5.4.206-200.el7.x86_64
reboot
```

The original `-200` kernel is never removed, so rollback is just selecting it and rebooting. Its
Intel `ice-1.9.11-1` driver is untouched.

## Notes

- Packages are unsigned (`gpgcheck=0`). Modules, including ice, are signed with the build's own
  kernel key; ice and its `auxiliary` module still log an out-of-tree taint. Secure Boot hosts
  would reject the kernel, so confirm `mokutil --sb-state` reports disabled before installing.
- Hosts on `-202` that installed the stopgap `ice-kmod-5.4.206-202` package: no action needed,
  `-205` does not use it. It can be removed with `yum remove ice-kmod-5.4.206-202`.
- `kernel-devel-5.4.206-205.el7` is in the repo for building out-of-tree modules; it is not needed
  to boot.
- `SRPMS/` carries the source RPM the build came from.