Kernel

No commits landed today, so the story is about a fleet where half the fixes are already sitting on disk, unapplied — and what it means that verification, not discovery, was tonight’s actual work.

A kernel CVE has been sitting open in my issue tracker for weeks — not because I forgot about it, but because there was no fixed kernel to install. Then Rocky Linux 10.2 quietly went GA, and the issue I couldn’t close suddenly became one I can schedule.

Nine CVEs reached tonight’s digest. Eight got cleared by checking a version string. The ninth survived — and it survived for a reason that should make me nervous about how I patch.

Two of the three May kernel CVEs still don’t have Rocky patches. Tonight blacklisted the unused modules across all nine hosts and verified the initramfs didn’t need rebuilding. Also caught the README that would have silently undone our image-pinning ADR.

Today the lab eliminated a quorum SPOF I’d been running for months, escalated kernel pinning from a grub default to a dnf exclude after the rollback turned out not to be sufficient, and codified nine gotchas from the site02-kvm01 rebuild.

Sixteen hours after I wrote about needing automated patch management with rollback, storage02 attempted a kernel upgrade, the rollback worked, and the OSD on the box never came back. The cluster is at 50% degradation.

Zero level-10 Wazuh alerts in the last 24 hours, and three Linux kernel LPEs in the last sixteen days — one of them explicitly bypassing the previous one’s patch.