kernel-livepatch-SLE16_Update_12-2-160000.1.1

- Bump up the version number in spec file
- commit f009aae

- Fix for CVE-2026-46243 ("smb: client: reject userspace cifs.spnego descriptions (CIFSwitch)")
  Live patch for CVE-2026-46243. Upstream commit:
  KLP: CVE-2026-46243
  References: bsc#1266265 CVE-2026-46243
- commit f83aad7

- Fix for CVE-2026-52909 ("ip6_vti: set netns_immutable on the fallback device.")
  Live patch for CVE-2026-52909. Upstream commit:
- d289d5307762 ("ip6_vti: set netns_immutable on the fallback device.")
  KLP: CVE-2026-52909
  References: bsc#1268662 CVE-2026-52909
- commit f5a6159

- Fix for CVE-2026-46120 ("ip6_gre: Use cached t->net in ip6erspan_changelink().")
  Live patch for CVE-2026-46120. Upstream commit:
- 1d324c2f43f7 ("ip6_gre: Use cached t->net in ip6erspan_changelink().")
  KLP: CVE-2026-46120
  References: bsc#1267893 CVE-2026-46120
- commit c30d978

- Fix for CVE-2026-46173 ("exit: prevent preemption of oopsing TASK_DEAD task")
  Live patch for CVE-2026-46173. Upstream commit:
- c1fa0bb633e4 ("exit: prevent preemption of oopsing TASK_DEAD task")
  KLP: CVE-2026-46173
  References: bsc#1267723 CVE-2026-46173
- commit c63299e

- Fix for CVE-2026-46227 ("sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL")
  Live patch for CVE-2026-46227. Upstream commit:
- abb5f36771cc ("sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL")
  KLP: CVE-2026-46227
  References: bsc#1267698 CVE-2026-46227
- commit 05c919f

- Fix for CVE-2026-52943 ("net: skbuff: fix missing zerocopy reference in pskb_carve helpers")
  Live patch for CVE-2026-52943. Upstream commit:
- 98d0912e9f84 ("net: skbuff: fix missing zerocopy reference in pskb_carve helpers")
  KLP: CVE-2026-52943
  References: bsc#1269023 CVE-2026-52943
- commit ef0b689

- Fix for CVE-2026-53362 ("ipv6: account for fraggap on the paged allocation path (ipv6_frag_escape)")
  Live patch for bsc#1269495. Upstream commit:
- 736b380e28d ("ipv6: account for fraggap on the paged allocation path")
  KLP: CVE-2026-53362
  References: CVE-2026-53362 bsc#1269495
- commit 1f53f43

- Fix for CVE-2026-45970 ("bonding: alb: fix UAF in rlb_arp_recv during bond up/down")
  Live patch for CVE-2026-45970. Upstream commit:
- e6834a4c4746 ("bonding: alb: fix UAF in rlb_arp_recv during bond up/down")
  KLP: CVE-2026-45970
  References: bsc#1267206 CVE-2026-45970
- commit a268de0

- Adding buildenv and patchinfo
- commit 3568761

- New branch for SLE16_Update_12
- commit ab1f24e

- klp_syscalls.h: arm64: add missing underscore
- commit 27095da

- scripts/tar-up.sh: Enable aarch64 for SLFO-Main branches
  Enable aarch64 for SLFO-Main branches and packages as they are used by
  QA.
  References: jsc#PED-7906
- commit 9369b83

- klp_syscalls.h: Add arm64 syscall wrappers
  Add arm64 syscall wrappers to klp_syscalls.h per upstream
  arch/arm64/include/asm/syscall_wrapper.h.
- commit 35cec22

- scripts/tar-up.sh: Enable aarch64 from SLE16-SP1 onwards
  Enable aarch64 starting with SLE16-SP1. Only -default kernel for now as
  the situation around -rt is not clear yet.
  References: PED-7906
- commit 5312a73

- kernel-livepatch.spec: Pre-generate klp info when supported (jsc#PED-14811)
  The command "klp -v patches" shows an extra information about the currently
  loaded livepatches, namely the related rpm package name, CVE and feature
  ids. It gets the information using rpm queries. It stores the information
  under "/var/cache/livepatch" to make the next call faster. Also the cache
  is used to pass the info from a hidden snapshot to the currently running
  system on transactional systems.
  Products derived from SLE 16.1, such as UC, want to use technologies like
  systemd-sysexts. The software will be distributed using images and rpmdb
  may not be present.
  Remove the dependency on rpmdb by pre-generating the cached file during
  the livepatch package build. Store it under "/usr/share/livepatch/info"
  because packages could not contain files under "/var/cache/" directly.
  The last problem is that %%files section is defined in the generic stub
  "/usr/lib/rpm/kernel-livepatch-subpackage" provided by the package
  "kernel-livepatch-tools-devel". But the %%build and %%install phases
  are defined by "rpm/kernel-livepatch.spec" template in the master branch
  for particular livepatch sources.
  Keep the life easy by supporting all combinations of
  "kernel-livepatch.spec" template and "kernel-livepatch-tools-devel"
  packages. The solution uses the fact that the generic stub
  "kernel-livepatch-subpackage" is included into the generic template
  "kernel-livepatch.spec" after the initial metadata but before
  the %%build and %%install sections. It works the following way:
  + The generic stub "kernel-livepatch-subpackage" adds
    "/usr/share/livepatch/info/*" into %%files section only when
    the generic template "kernel-livepatch.spec" defines
    "%%with_klp_info 1" macro before the stub in included.
  + The generic "kernel-livepatch.spec" template builds and installs
    the klp info file only when "%klp_package_name" macro is defined by
    the generic "kernel-livepatch-subpackage" stub.
  Note that this solution supports any combination of the "klp" tool
  and livepatch package:
  + Older "klp" tool versions are not aware of the pre-generated info file.
    They will generate the cache using rpm queries.
  + Newer "klp" tool versions use the pre-generated info file when
    available. They are still able to generate it using rpm queries
    as a fallback.
  + SLE 16.1 will use only new "klp" tool and livepatches with
    the pre-generated info file.
- commit 78e4366

- klp_trace.h: add KLPR_TRACE_EVENT_CONDITION macro
- commit 17e9fce

- scripts/tar-up.sh: unconditionally enable s390x on SLE default
  Nowadays, s390x builds should be enabed for all SLE default kernels
  - - the versions from before the point where s390x coverage got
  added to the product have gone out of support a long time ago.
  Remove the conditional s390x enablement logic from tar-up.sh.
- commit 9bcbefb

- kernel-livepatch.spec: Replace kernel-syms with kernel-<flavor>-specific dependencies (bsc#1248108)
  The commit ead79afe7cbfae ("kernel-livepatch.spec: Update build
  dependencies for non-default flavors") broke build of livepatches
  which were built with kernel-syms-rt.
  The problem is that livepatch packages for already released kernels
  are built in exactly the same build environment as the initial livepatch.
  The BS (Build Service) installs the build environment using the given
  _buildinfo-*.xml and ignores BuildRequires. But the BuildRequires are
  later checked by rpmbuild tool. It would complain when new dependencies
  were added.
  Unfortunately, kernel-syms-rt does not exist on SLE16. This was the main
  motivation for the above mentioned commit.
  But the package kernel-syms is empty. Its only purpose is to add other
  dependencies. Replace it by opencoding the dependencies.
  Note that the kernel devel files are historically split into various
  packages, kernel-<flavor>-devel, kernel-devel-<flavor>, and
  even kernel-devel. But it is enough to require kernel-<flavor>-devel
  because it requires the other devel files on its own. This seems
  to be true back to SLE15-SP4 at minimum.
- commit 7696578

- kernel-livepatch.spec: Update build dependencies for non-default flavors
  Starting with commit 7c95ae0ac0bb ("mkspec: Exclude rt flavor from
  kernel-syms dependencies (bsc#1244337).") kernel-syms does not pull
  kernel-%variant-devel package for non-default %variant. It needs to be
  required alongside.
  Hence, add new BuildRequires for these cases (-rt flavor only at the
  time).
- commit ead79af