# Storm patched kernel 5.4.225 (vGhost CVE-2026-74580 + PwnEscape CVE-2026-99999 + CVE-2026-98432 + ZDI-CAN-33367)

Patched `5.4.225-205.el7` kernel for Storm KVM parents on `5.4.225-201`. Built in-tree, carrying
four fixes:

- **vGhost (CVE-2026-74580)** - upstream `de845981da67` (vhost: reset the vring metadata cache on
  vring reconfiguration). `vhost.ko` srcversion is `D51072C9860077DC6AA6532`.
- **PwnEscape (CVE-2026-99999)** - upstream `6785011f8b16` (ipv4: validate checksum_start before
  completing checksum). Compiled into the kernel; runtime-proven to block the corruption path.
- **CVE-2026-98432** - upstream `e3f33b0a1d89` (ipv4: free inet_opt and ireq_opt after an RCU
  grace period). Fixes a use-after-free in the IPv4 TCP handshake. In the ipv4 stack (no module
  srcversion); present by construction.
- **ZDI-CAN-33367 ("Fragnesia")** - upstream `8ece90615012` + `f66bdb1cc0fc` (net: skbuff: don't
  strip zerocopy frag markers from a forwarded skb). Fixes a local privilege escalation via ESP
  in-place decrypt over shared skb frags. In `net/core/skbuff` (no module srcversion); present by
  construction. Operationally also mitigated by `user.max_user_namespaces=0` where deployed.

Everything else matches Storm's `-201` build. Earlier builds (`-202` vGhost only, `-203`
vGhost+PwnEscape) are superseded by this `-205` (all remain in the repo; `-205` is the one to
install). Unlike 5.4.206, the 225 line carries no Intel ice bake-in (not needed on the 225 fleet).

## Install

```
# 1. Fetch the repo file
curl -o /etc/yum.repos.d/kernel-storm-5.4.225.repo \
  http://updates.interworx.com/_internal/kernel-storm-5.4.225/kernel-storm-5.4.225.repo

# 2. Install the patched kernel. It installs ALONGSIDE the running -201 (kernels are
#    install-only); it does not replace or remove it. The kernel meta-package pulls in
#    kernel-core and kernel-modules automatically.
yum install -y kernel-5.4.225-205.el7 kernel-modules-extra-5.4.225-205.el7

# 3. Make it the default and reboot
grubby --set-default /boot/vmlinuz-5.4.225-205.el7.x86_64
reboot

# 4. Verify after reboot
uname -r                           # 5.4.225-205.el7.x86_64
cat /sys/module/vhost/srcversion   # D51072C9860077DC6AA6532  (vGhost fix)
# PwnEscape, CVE-2026-98432 and ZDI-CAN-33367 fixes are in the ipv4 / net stack (no module
# srcversion); present in this build by construction.
```

## Rollback

```
grubby --set-default /boot/vmlinuz-5.4.225-201.el7.x86_64
reboot
```

The original `-201` kernel is never removed, so rollback is just selecting it and rebooting.

## Notes

- Unsigned (`gpgcheck=0`); the kernel log will note a module taint. Secure Boot hosts would reject
  it, so confirm `mokutil --sb-state` reports disabled before installing.
- `kernel-devel-5.4.225-205.el7` is in the repo for building out-of-tree modules; it is not needed
  to boot.
- `SRPMS/` carries the source RPM the build came from.