Kernel: T8919: Update Linux Kernel to 6.18.33

[c-po]

Change summary

The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T8919

How to test / Smoketest result

All pass

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 0eb6558d-bf1d-4dc2-905e-8bc24898e14b

📥 Commits

Reviewing files that changed from the base of the PR and between 440a78d and dc194b8.

📒 Files selected for processing (2)

• data/defaults.toml
• scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch

💤 Files with no reviewable changes (1)

• scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: build_iso
• GitHub Check: codeql-analysis-call / Analyze (python)
• GitHub Check: Mergify Merge Protections
• GitHub Check: Summary

🧰 Additional context used

🔍 Remote MCP

Additional Context for PR Review

Fragnesia Vulnerability Details (CVE-2026-46300)

The Fragnesia vulnerability is tracked as CVE-2026-46300 (CVSS score: 7.8) and is rooted in the Linux kernel's XFRM ESP-in-TCP subsystem. The vulnerability was disclosed on May 14, 2026, and is the third kernel bug of this kind identified within two weeks.

Root Cause:

The underlying flaw is in the core socket-buffer code: skb_try_coalesce() failed to propagate the SKBFL_SHARED_FRAG marker when transferring paged fragments between buffers, so the kernel could lose track of the fact that a fragment was externally backed (e.g. by page-cache pages spliced in from a file).

Technical Impact:

The XFRM ESP-in-TCP receive path would then perform in-place AES-GCM decryption directly over those page-cache pages, allowing an unprivileged process to XOR a chosen key. This behavior enables Fragnesia to corrupt cached file pages without altering the file on disk.

Patch Details:

The patch is small – two lines in skb_try_coalesce() that preserve the SKBFL_SHARED_FRAG flag when transferring fragment descriptors. The patch adds a conditional that propagates the shared-frag flag from the source buffer to the destination buffer when paged fragments are transferred.

Important Context:

Technically, Fragnesia wasn't a new bug "introduced" by the Dirty Frag patch; rather, the Dirty Frag patch added code paths that relied on the correct SKBFL_SHARED_FRAG tag, making a 13-year-old coalescing bug exploitable for the first time. The existing kernel patches for Dirty Frag do not fix Fragnesia—a separate patch is required.

Linux Kernel 6.18.33 Status

Linux Kernel 6.18.33 was released on 2026-05-23. Linux 6.18 offers two years of long-term support. At the core of 6.18 is a significant upgrade to the slab memory allocator in the form of "sheaves," a per-CPU cache mechanism that reduces contention and speeds up memory allocation and freeing operations.

🔇 Additional comments (1)

data/defaults.toml (1)

17-17: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated Linux kernel to version 6.18.33

Walkthrough

Kernel version in data/defaults.toml updated from 6.18.31 to 6.18.33, marking a patch-level kernel version bump to the build system default.

Changes

Kernel version bump

Layer / File(s)	Summary
Kernel version update data/defaults.toml	kernel_version default bumped from 6.18.31 to 6.18.33 at line 17.

Possibly related PRs

• vyos/vyos-build#1187: Both PRs update data/defaults.toml by incrementing kernel_version within the 6.18.x line (different target versions).
• vyos/vyos-build#1192: Both PRs modify data/defaults.toml's kernel_version to patch-level bumps within the 6.18.x kernel series.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title directly reflects the main change: kernel version bump from 6.18.31 to 6.18.33, with reference to associated task T8919.
Description check	✅ Passed	Description relates to the changeset, explaining the kernel update addresses the fragnesia vulnerability fix included in 6.18.33.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

👍
No issues in PR Title / Commit Title

[jestabro]

Update kernel version and drop no longer needed patch.

[github-actions]

CI integration 👍 passed!

Details

CI logs

• Config tests 👍 passed

[sarthurdev]

Update kernel for security fix.