Minutes:
https://meetbot-raw.fedoraproject.org/meeting-1_matrix_fedoraproject-org/20…
Minutes (text):
https://meetbot-raw.fedoraproject.org/meeting-1_matrix_fedoraproject-org/20…
Log:
https://meetbot-raw.fedoraproject.org/meeting-1_matrix_fedoraproject-org/20…
=====================================
# #meeting-1:fedoraproject.org: fedora_coreos_meeting
=====================================
Meeting started by @angelcr:matrix.org at 2026-05-20 15:30:09
Meeting summary
---------------
* TOPIC: roll call (@angelcr:matrix.org, 15:30:42)
* TOPIC: Action items from last meeting (@angelcr:matrix.org, 15:34:26)
* TOPIC: Review Fedora 45 Release Schedule (@angelcr:matrix.org, 15:37:06)
* LINK:
https://fedorapeople.org/groups/schedule/f-45/f-45-key-tasks.html (@angelcr:
matrix.org, 15:37:16)
* TOPIC: Rework and evaluate kola-upgrade testing strategy (@angelcr:
matrix.org, 15:42:20)
* LINK: https://github.com/coreos/fedora-coreos-tracker/issues/2146
(@angelcr:matrix.org, 15:42:36)
* TOPIC: use chunkah to split container images and increase max layers
(@angelcr:matrix.org, 16:14:26)
* LINK: https://github.com/coreos/fedora-coreos-tracker/issues/2145
(@angelcr:matrix.org, 16:15:04)
* AGREED: we will try to use chunkah for chunking up our container
layers and experiment rolling out a relatively high limit for the number of
layers. we'll start in rawhide and next to see if there are any issues
(@angelcr:matrix.org, 16:31:21)
Meeting ended at 2026-05-20 16:32:45
Action items
------------
People Present (lines said)
---------------------------
* @dustymabe:matrix.org (64)
* @siosm:fedora.im (24)
* @angelcr:matrix.org (24)
* @jbtrystram:matrix.org (16)
* @marmijo:fedora.im (12)
* @zodbot:fedora.im (10)
* @ydesouza:fedora.im (2)
* @meetbot:fedora.im (2)
* @peytonrobertson:matrix.org (2)
* @thilofm:matrix.org (1)
* @nemric:relativit.fr (1)
* @spresti:fedora.im (1)
* @rapneset:matrix.org (1)
The "Fragnesia" (CVE-2026-46300) [1] and "ssh-keysign-pwn"
(CVE-2026-46333) [2] vulnerabilities have been resolved in the
following Fedora CoreOS releases:
- next: 44.20260510.1.3
- testing: 44.20260510.2.3
Since the fixed kernels are 7.0 kernels, a `stable` stream fix will be
promoted when `testing` is promoted to `stable` next week. In the
meantime, we recommend applying the mitigations below to `stable` stream
nodes.
== Fragnesia (CVE-2026-46300) ==
This vulnerability can be mitigated by disabling the affected kernel
modules via the following Butane config snippet:
storage:
files:
- path: /etc/modprobe.d/dirtyfrag.conf
contents:
inline: |
install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false
blacklist esp4
blacklist esp6
blacklist rxrpc
alias net-pf-33 off
alias xfrm-type-2-50 off
alias xfrm-type-10-50 off
or by creating the same file on already running systems.
If the impacted modules are already loaded on the system then a reboot
will be required and the functionality (IPsec and AFS) will be
disabled. Otherwise, the mitigation will be effective immediately.
== ssh-keysign-pwn (CVE-2026-46333) ==
This vulnerability can be mitigated by disabling ptrace access via the
following Butane config snippet:
storage:
files:
- path: /etc/sysctl.d/10-default-yama-scope.conf
contents:
inline: |
kernel.yama.ptrace_scope = 3
or by creating the same file on already running systems and running:
/usr/lib/systemd/systemd-sysctl 10-default-yama-scope.conf
== Reference ==
For detailed information regarding these CVEs, see our tracking
issues [1] [2].
Michael Armijo
for The Fedora CoreOS Team
[1] https://github.com/coreos/fedora-coreos-tracker/issues/2144
[2] https://github.com/coreos/fedora-coreos-tracker/issues/2147