Update Linux to 6.18 by sayanchowdhury · Pull Request #4191 · flatcar/scripts

sayanchowdhury · 2026-08-06T14:24:15Z

Testing done

CI: https://jenkins.flatcar.org/job/container/job/packages_all_arches/490/

Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)
Inspected CI output for image differences: /boot and /usr size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.

Copilot

Pull request overview

This PR updates the Flatcar/CoreOS kernel stack to Linux 6.18.26, including new kernel sources/modules/kernel ebuilds, updated kernel configuration for amd64/arm64, and compatibility fixes for the legacy NVIDIA 550.163.01 driver against newer kernel APIs.

Changes:

Bump kernel sources to 6.18.26 (new coreos-sources, coreos-modules, coreos-kernel ebuilds + updated Manifest).
Add/refresh downstream kernel patch set under coreos-sources/files/6.18/ (secure-boot/lockdown-related, build tooling tweaks).
Extend old-nvidia-drivers-550.163.01 to support kernels up to 6.18 via additional patching and src_prepare adjustments.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild	Bump supported kernel max to 6.18 and add NVIDIA 550 build-fix patches + in-tree sed adjustments.
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0001-mm-use-vm_flags_reset-to-avoid-GPL-only-vma_start_wr.patch	Adapts NVIDIA mm/VMA flag helpers for Linux 6.15+ GPL/export changes.
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch	Updates NVIDIA DRM fb_create plumbing for Linux 6.17+ API change (format info param).
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0003-nvidia-use-hrtimer_setup-for-Linux-6.15.patch	Switches to `hrtimer_setup()` for Linux 6.15+ in the open kernel module path.
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0004-nvidia-uvm-guard-iommu_dev_enable_disable_feature-fo.patch	Guards removed IOMMU SVA enable/disable calls for Linux 6.16+.
sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0005-nvidia-uvm-guard-SMMU-WAR-code-with-UVM_ATS_SMMU_WA.patch	Makes ARM64 SMMU WAR code conditional to avoid non-ARM build issues.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest	Adds distfiles entries for linux-6.18 + patch-6.18.26.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.18.26.ebuild	New kernel sources ebuild for 6.18.26 with patch list for Flatcar deltas.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0001-pahole-support-reproducible-builds.patch	Enables reproducible-build support in pahole flags.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch	Reverts upstream removal needed for dm-verity hash storage per commit message.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch	Adds EFI secure boot flag plumbing and secureboot.c addition.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0003-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch	Duplicate alternate-form patch file for EFI secure boot flag plumbing.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch	Adds lockdown-on-secure-boot behavior and related Kconfig/API changes.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0004-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch	Duplicate alternate-form patch file for secure-boot lockdown.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch	Disables phram/slram mappings under kernel lockdown (security hardening).
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0005-mtd-disable-slram-and-phram-when-locked-do.patch	Duplicate alternate-form patch file for phram/slram lockdown behavior.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch	Adds arm64 secure-boot lockdown config/plumbing via FDT params.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.18/z0007-tools-hv-fix-cross-compilation-for-ARM64.patch	Fixes Hyper-V tools Makefile logic for ARM64 cross builds.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.18.26.ebuild	New modules ebuild for 6.18.26: builds vmlinux+modules and installs minimal build tree.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.18	New shared kernel config fragment for 6.18 (common options).
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-6.18	New amd64-specific config fragment for 6.18.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-6.18	New arm64-specific config fragment for 6.18.
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.18.26.ebuild	New kernel build/install ebuild for 6.18.26 (dracut/bootengine integration).

Suppressed comments (1)

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild:167

Same issue as above: \b is not a portable/working word-boundary in sed. If this substitution doesn't match, del_timer_sync() won't be renamed and the build will still fail on kernels where it was renamed/removed. Prefer \< / \> for word boundaries.

	find "${S}" \( -name '*.c' -o -name '*.h' \) \
		-exec sed -i 's/\bdel_timer_sync\b/timer_delete_sync/g' {} + || die

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

chewi · 2026-08-12T16:51:27Z

+inherit kernel-2
+EXTRAVERSION="-flatcar"
+detect_version


Please keep this as it was. This stuff is hairy. I have a branch that renames the kernel from "coreos" to "flatcar" if we eventually decide to do that.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif


+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Fri, 30 Aug 2019 15:54:24 +0100
+Subject: mtd: phram,slram: Disable when the kernel is locked down
+Forwarded: https://lore.kernel.org/linux-security-module/20190830154720.eekfjt6c4jzvlbfz@decadent.org.uk/
+


+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Tue, 10 Sep 2019 11:54:28 +0100
+Subject: efi: Lock down the kernel if booted in secure boot mode
+
+Based on an earlier patch by David Howells, who wrote the following


+From: David Howells <dhowells@redhat.com>
+Date: Mon, 18 Feb 2019 12:45:03 +0000
+Subject: [28/30] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
+Origin: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit?id=a5d70c55c603233c192b375f72116a395909da28
+


dongsupark

I think we should run Jenkins CI for all providers, especially for such a big Kernel bump.

dongsupark · 2026-08-06T14:42:23Z

 CONFIG_CPU_FREQ_STAT=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
 CONFIG_CRYPTO_AES=m
+CONFIG_CRYPTO_CRC32C=y


Why is the kernel config CRYPTO_CRC32C is needed for building old nvidia drivers?

dongsupark · 2026-08-06T14:46:49Z

@@ -0,0 +1,155 @@
+From d1154945f8b2d22392d30a5e522612dfbcf17cff Mon Sep 17 00:00:00 2001


Huge thanks for working on old nvidia drivers.
When I was recently touching those, I was wondering if it would worth keeping this one, because of a huge amount of build issues with newer Kernel versions. Ideally we should deprecate them...? ;-)

Yes, The problem is we don't have a deprecation plan with the older-sysext. We should urgently start discussing this as because we will start piling old versions on our end and it quite difficult to maintain.

ader1990 · 2026-08-07T08:13:58Z

@@ -0,0 +1,140 @@
+# CONFIG_ACPI_AC is not set


the *-6.12 files from this folder need to be removed, same with files from the coreos-sources folder.

ader1990 · 2026-08-07T08:26:58Z

+
+diff --git a/tools/hv/Makefile b/tools/hv/Makefile
+index 34ffcec264ab..7a7ece3cdf03 100644
+--- a/tools/hv/Makefile


There were some new patches recently, maybe we can reuse the official one instead of this one: torvalds/linux@ca5ee0e

Copilot

Pull request overview

Copilot reviewed 22 out of 25 changed files in this pull request and generated 3 comments.

Suppressed comments (4)

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild:162

The sed expression uses \b as a word-boundary, but in GNU sed regex \b is a backspace escape, not a word-boundary. This means the replacement likely never happens and the EXTRA_CFLAGS→ccflags-y migration won’t take effect on 6.15+ builds.

	find "${S}" \( -name 'Kbuild' -o -name 'Makefile' \) \
		-exec sed -i 's/\bEXTRA_CFLAGS\b/ccflags-y/g' {} + || die

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r2.ebuild:167

Same issue here: \bdel_timer_sync\b won’t match as a word-boundary in GNU sed (\b is backspace). The rename to timer_delete_sync likely won’t be applied, defeating the intended compatibility fix.

	find "${S}" \( -name '*.c' -o -name '*.h' \) \
		-exec sed -i 's/\bdel_timer_sync\b/timer_delete_sync/g' {} + || die

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch:143

This patch claims to use the conftest symbol (NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) instead of a hardcoded kernel version check, but the function prototype in nvidia-drm-fb.h is guarded by LINUX_VERSION_CODE >= 6.17. That can desync the prototype from the call sites guarded by defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO) (e.g. with backports), causing build failures.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif

sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/0002-nvidia-drm-550.163.01-pass-drm_format_info-to-nv_drm.patch:263

Same conftest-vs-version mismatch in the non-open kernel/nvidia-drm/nvidia-drm-fb.h hunk: the prototype is guarded by LINUX_VERSION_CODE >= 6.17, while the rest of the patch uses defined(NV_DRM_FB_CREATE_TAKES_FORMAT_INFO). These need to use the same condition to avoid signature mismatches on backports/custom kernels.

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+    const struct drm_format_info *info,
+#endif

+  ${PATCH_DIR}/z0002-Revert-x86-boot-Remove-the-bugger-off-message.patch \
+  ${PATCH_DIR}/z0003-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \
+  ${PATCH_DIR}/z0004-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \
+  ${PATCH_DIR}/z0005-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \
+  ${PATCH_DIR}/z0006-arm64-add-kernel-config-option-to-lock-down-when-in-.patch \


 DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548
 DIST patch-6.12.105.xz 5624568 BLAKE2B 0a70f979a8ef937a2881003131a93c785fa30dd2634055f50909cb21995ecb875bfbc9bbcae30bb1c0056f8ebc845f2bc1a704ebdd9cd07e734eaa33d70270ee SHA512 017122b28c1a43ace897e75069286b49b4115d7eda37d46b4a7d682071fc526e9e4bfd290ecbe0dc41e591801976dcb5935afd5b7c16e596860b331d1040bcb7
+DIST linux-6.18.tar.xz 154309096 BLAKE2B b94b7b9bf18aca0c3e50baf79b009a1448fc6cd9c3ee019f641cc247dcf53a4abef4274ee0608ad8cd4943af69854363a95d26e117ff23620bb07dccb158859f SHA512 88599ffdec96d150c1feb9b261ba93bb0301a9d0e1ad6bef7aeab1f5372cbfc57d8b43c7e902bd8f76921d1dbd8189663c142ea869e51d0e2b483b150ee00fe0
+DIST patch-6.18.26.xz 1538696 BLAKE2B 327bc85624fd2d2e6c72f42037d1b02ada8b486ff0736ef440cabbf320c1cb52e4685647a47f04507ddf933df36ea7ffbcbc8dacb32b208844d7554ed8d81a4c SHA512 e983f3c6d9ca2fe1ab878d0f7897fe398befd1819239e416e123679427c92f64f708567c2361c82d8b210c0db500088781079dd60b68584fe5fa939ceea91444


+	# Not strictly required but this is where we used to install the config.
+	dosym "../${build}/.config" "/usr/boot/config-${KV_FULL}"
+	dosym "../${build}/.config" "/usr/boot/config"
+}


chewi · 2026-08-26T12:24:20Z

@@ -119,7 +105,6 @@ CONFIG_TCG_INFINEON=m
 CONFIG_TCG_NSC=m
 CONFIG_UPROBE_EVENTS=y
 CONFIG_USB_OHCI_HCD_SSB=y
-CONFIG_VBOXGUEST=m


Why? We explicitly include that in bootengine.

chewi · 2026-08-26T12:28:32Z

Most of the options dropped here were added recently in #4053.

Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

…6.18 Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

This commits also retabs the ebuilds Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

Copilot

Pull request overview

Copilot reviewed 24 out of 27 changed files in this pull request and generated 2 comments.

+	# Linux 6.15 removed EXTRA_CFLAGS support for out-of-tree kernel modules
+	# (upstream commit b2c885b9). NVIDIA 550 uses EXTRA_CFLAGS in its Kbuild
+	# files to pass -I$(src)/common/inc, so headers like os-interface.h,
+	# nv-firmware.h, and nv-pci-types.h are never found at compile time on
+	# kernels >= 6.15. Replace with ccflags-y, the correct variable.
+	find "${S}" \( -name 'Kbuild' -o -name 'Makefile' \) \
+		-exec sed -i 's/\bEXTRA_CFLAGS\b/ccflags-y/g' {} + || die
+
+	# Linux 6.15 renamed del_timer_sync() to timer_delete_sync() (commit
+	# d4b4c87). NVIDIA 550 calls del_timer_sync in nv.c and nv-nano-timer.c.
+	find "${S}" \( -name '*.c' -o -name '*.h' \) \
+		-exec sed -i 's/\bdel_timer_sync\b/timer_delete_sync/g' {} + || die


+FLATCAR_VERSION=4797.0.0+nightly-20260819-2100-227-g817d9a80b9
+FLATCAR_VERSION_ID=4797.0.0
+FLATCAR_BUILD_ID="nightly-20260819-2100-227-g817d9a80b9"
 FLATCAR_SDK_VERSION=4803.0.0+nightly-20260825-2100


Copilot AI lite review requested due to automatic review settings August 6, 2026 14:24

sayanchowdhury requested a review from a team as a code owner August 6, 2026 14:24

sayanchowdhury had a problem deploying to development August 6, 2026 14:24 — with GitHub Actions Error

Copilot started reviewing on behalf of sayanchowdhury August 6, 2026 14:25 View session

Copilot AI reviewed Aug 6, 2026

View reviewed changes

dongsupark added the main label Aug 6, 2026

dongsupark added this to Flatcar tactical, release planning, and roadmap Aug 6, 2026

dongsupark moved this to ⚒️ In Progress in Flatcar tactical, release planning, and roadmap Aug 6, 2026

dongsupark reviewed Aug 6, 2026

View reviewed changes

ader1990 reviewed Aug 7, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 26, 2026 10:48

sayanchowdhury force-pushed the sayan/linux-main-6.18-w-nvidia branch from 8c7ac50 to 04c95aa Compare August 26, 2026 10:48

sayanchowdhury had a problem deploying to development August 26, 2026 10:48 — with GitHub Actions Error

Copilot started reviewing on behalf of sayanchowdhury August 26, 2026 10:49 View session

Copilot AI reviewed Aug 26, 2026

View reviewed changes

chewi reviewed Aug 26, 2026

View reviewed changes

sayanchowdhury added 7 commits August 26, 2026 20:06

sys-kernel/coreos-kernel: Version bump to 6.18.26

0d78f3e

Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

sys-kernel/coreos-modules: Version bump to 6.18.26

6514593

Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

sys-kernel/coreos-sources: Version bump to 6.18.26

e46cfd9

Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

x11-drivers/old-nvidia-drivers: Adjust the patches for 550 for Linux …

94a8563

…6.18 Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

coreos-sources: Drop 6.12 files and patches

6c661b8

Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

coreos-{kernel, modules}: Drop the 6.12 ebuilds and patches

228b083

Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

coreos-sources: Update the cross-compilation patch to upstream

431311e

This commits also retabs the ebuilds Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

Copilot AI review requested due to automatic review settings August 26, 2026 18:40

sayanchowdhury force-pushed the sayan/linux-main-6.18-w-nvidia branch from 04c95aa to 431311e Compare August 26, 2026 18:40

sayanchowdhury requested a deployment to development August 26, 2026 18:40 — with GitHub Actions Waiting

Copilot started reviewing on behalf of sayanchowdhury August 26, 2026 18:41 View session

Copilot AI reviewed Aug 26, 2026

View reviewed changes

Navigation Menu

Uh oh!

Update Linux to 6.18 - #4191

Update Linux to 6.18#4191
sayanchowdhury wants to merge 7 commits into
mainfrom
sayan/linux-main-6.18-w-nvidia

sayanchowdhury commented Aug 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

chewi Aug 12, 2026

Uh oh!

dongsupark left a comment

Uh oh!

dongsupark Aug 6, 2026 •

edited

Loading

Uh oh!

dongsupark Aug 6, 2026

Uh oh!

sayanchowdhury Aug 11, 2026

Uh oh!

ader1990 Aug 7, 2026

Uh oh!

ader1990 Aug 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

chewi Aug 26, 2026

Uh oh!

chewi Aug 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		@@ -0,0 +1,155 @@
		From d1154945f8b2d22392d30a5e522612dfbcf17cff Mon Sep 17 00:00:00 2001

Uh oh!

Conversation

sayanchowdhury commented Aug 6, 2026

Testing done

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

chewi Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

dongsupark left a comment

Choose a reason for hiding this comment

Uh oh!

dongsupark Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dongsupark Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

sayanchowdhury Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

ader1990 Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

ader1990 Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

chewi Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

chewi Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

dongsupark Aug 6, 2026 •

edited

Loading