[17.0] Kernel update - [amd64-rt, amd64-generic, amd64-generic, arm64-generic, arm64-generic, arm64-nvidia-jp7, riscv64-generic]

[christoph-zededa]

Description

Backport of #6180

Release-branch counterpart of #6180 for 17.0. The kernel pins on 17.0 matched master's pre-update state, so this applies the same update: kernel-commits.mk regenerated with tools/update_kernel_commits.py and amd64 moved to the new eve-kernel-amd64-v6.12.96-generic branch, resulting in the identical pin set.

The arm64 and riscv64 pins pick up the same three changes:

• KVM: x86: Fix shadow paging use-after-free due to unexpected role
• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
• Makefile.eve: make linuxkit tmp dir user-specific (kernel build tooling; no runtime change)

amd64 instead moves from the v6.12.49 to the v6.12.96 eve-kernel branch, i.e. from upstream stable Linux 6.12.49 to 6.12.96 (47 point releases), and kernel-version.mk is bumped accordingly. Both KVM shadow-paging fixes are in upstream 6.12.96, as is the af_alg CVE-2026-31431 fix that v6.12.49-generic carried as a backport. The EVE patch stack (37 patches) was rebased onto the new tag unchanged, with one exception: Makefile.eve: make linuxkit tmp dir user-specific is not present on the new branch (build tooling only, no runtime effect). docs/KERNEL.md is updated to match, in a separate commit.

Updated pins used by this branch:

eve-kernel branch	old	new
eve-kernel-amd64-v6.12.49-generic → eve-kernel-amd64-v6.12.96-generic	dcdba3ddf871	bfc617435842
eve-kernel-arm64-v6.1.155-generic	9fa67514972d	417a12ac3d50
eve-kernel-arm64-v6.8.12-nvidia-jp7	452eaffef5ed	7f5919c0eaef
eve-kernel-riscv64-v6.1.112-generic	30aa75d58cdd	bd5816893ca9

amd64-next, nvidia-jp5 and nvidia-jp6 pins are unchanged. The update also re-adds pins for eve-kernel branches that exist upstream but are not referenced by kernel-version.mk on this branch (amd64-v6.1.111-rt, amd64-v6.1.177-generic, arm64-v6.1.112-generic); these entries are inert here. The inert amd64 6.1.x pin now tracks the new v6.1.177 branch instead of v6.1.112. See the commit message for the full per-branch changelogs.

Docker Hub images for all new pins were verified to exist, including the amd64 core and rt config flavors.

How to test and validate this PR

• The PR gate builds every supported ZARCH/PLATFORM combination against the new pins, which validates that the pinned kernel images are pullable and usable.
• Local validation: make live && make run-live; the device should boot normally and uname -r inside EVE reports a kernel version string containing the new short commit hash of the pinned kernel.
• The KVM shadow-paging fixes are exercised by deploying/booting any VM app instance; make eden TEST_SMOKE=1 covers app-instance deployment end to end.

Changelog notes

Kernel update for all supported platforms: the amd64 kernel moves to upstream stable Linux 6.12.96 (from 6.12.49), and arm64/riscv64 pick up two KVM x86 shadow-paging use-after-free fixes.

PR Backports

Not applicable — this PR targets the 17.0 release branch (counterpart of #6180; the LTS-branch PRs are #6181, #6182 and #6183).

Checklist

• I've provided a proper description
• I've added the proper documentation
• I've tested my PR on amd64 device
• I've tested my PR on arm64 device
• I've written the test verification instructions
• I've set the proper labels to this PR

For backport PRs (remove it if it's not a backport):

• I've added a reference link to the original PR
• PR's title follows the template

And the last but not least:

• I've checked the boxes above, or I've provided a good reason why I didn't
  check them: device testing is pending while this PR is in draft (CI + QA validation to follow).

[christoph-zededa]

seems yetus does not like this 17.0 branch - I see the same issue f.e. here: #6175

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 21.02%. Comparing base (2de292d) to head (db50b64).
⚠️ Report is 3 commits behind head on 17.0-stable.

Additional details and impacted files

@@               Coverage Diff               @@
##           17.0-stable    #6191      +/-   ##
===============================================
+ Coverage        20.61%   21.02%   +0.41%     
===============================================
  Files              506      516      +10     
  Lines            92880    94578    +1698     
===============================================
+ Hits             19148    19887     +739     
- Misses           72136    72917     +781     
- Partials          1596     1774     +178     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[eriknordmark]

LGTM

[rene]

Updates in this PR:

• Rebase on top of 17.0-stable to get Eden Tests fixes.