Review Results

Comment

The change only bumps pkgver in .SRCINFO from 7.1.pf6 to 7.2.pf1. No build logic, sources, checksums, install scripts, or packaging behavior are modified in the reviewed diff. On its face this is a routine version update with no direct security impact visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = linux-pf
 	pkgdesc = pf-kernel
-	pkgver = 7.1.pf6
+	pkgver = 7.2.pf1
 	pkgrel = 1
 	url = https://pfkernel.natalenko.name
 	arch = x86_64

Comment

The change is a straightforward source tarball pin update in .SRCINFO, with the corresponding checksum updated. The source remains an HTTPS Codeberg archive from the upstream project, and there are no new build steps, scripts, or privilege-related artifacts introduced by this diff. No obvious supply-chain or persistence risk is evident from this metadata-only change.

@@ -26,10 +26,10 @@ pkgbase = linux-pf
 	makedepends = zstd
 	options = !debug
 	options = !strip
-	source = https://codeberg.org/pf-kernel/linux/archive/ac1efe1bab0e49f85b275b3d3f4991ac223f3baa.tar.gz
+	source = https://codeberg.org/pf-kernel/linux/archive/cd3c1bdc841c7a49ccb424e6b9920abdb633da75.tar.gz
 	source = config
 	b2sums = SKIP
-	b2sums = 5ab72e00e584049ee4198da4d91904123ce775de8e8f1fcebec92a10667d1406f433e1eae4da2cfb7250745defcfadc124e4dedf909c0c7fe3c47fb6644ad211
+	b2sums = 7e68a183a4974de797cf43f03f0f621363aa69a5a6c6030980d7153777170892e0f5a054f900274d88be56412790eb4ec7c8fdec4cf9d5da066971442ec01555
 
 pkgname = linux-pf
 	pkgdesc = The pf-kernel and modules

Comment

The change is a straightforward upstream version bump for a kernel package: it updates the pinned commit hash, pkgver, and the corresponding source checksum. The source remains an HTTPS tarball from the same upstream Codeberg repository, with no new build-time downloads, scripts, install hooks, or packaging logic changes. I do not see any new integrity or privilege-escalation concerns in this diff alone.

@@ -3,8 +3,8 @@
 pkgbase="linux-pf"
 _suffix=""
 pkgname=(${pkgbase}${_suffix} ${pkgbase}-headers${_suffix})
-_rev=ac1efe1bab0e49f85b275b3d3f4991ac223f3baa
-pkgver=7.1.pf6
+_rev=cd3c1bdc841c7a49ccb424e6b9920abdb633da75
+pkgver=7.2.pf1
 pkgrel=1
 pkgdesc="pf-kernel"
 arch=(x86_64)

Comment

The change only updates the pinned upstream kernel revision and the corresponding b2 checksum in PKGBUILD. The source remains an HTTPS Codeberg archive, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes. This is a routine version bump with no obvious security red flags in the diff provided.

@@ -15,7 +15,7 @@ options=(!debug !strip)
 source=(https://codeberg.org/pf-kernel/linux/archive/${_rev}.tar.gz
 		config)
 b2sums=(SKIP
-		'5ab72e00e584049ee4198da4d91904123ce775de8e8f1fcebec92a10667d1406f433e1eae4da2cfb7250745defcfadc124e4dedf909c0c7fe3c47fb6644ad211')
+		'7e68a183a4974de797cf43f03f0f621363aa69a5a6c6030980d7153777170892e0f5a054f900274d88be56412790eb4ec7c8fdec4cf9d5da066971442ec01555')
 
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=${pkgbase}

Comment

The change is a kernel config refresh from linux 7.1.0-pf6 to 7.2.0-pf1 with many option toggles, but nothing in the provided diff suggests a supply-chain or persistence risk. There are no added scripts, patches, downloads, privilege changes, or suspicious source changes; this is only a config file update. Some options are enabled/disabled, but they appear to be ordinary kernel feature adjustments consistent with an upstream config refresh. Based on the diff shown, I do not see a security issue in the packaging sense.

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 7.1.0-pf6 Kernel Configuration
+# Linux/x86 7.2.0-pf1 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.1.1 20260625"
 CONFIG_CC_IS_GCC=y

Comment

The change is a one-line bump of CONFIG_RUSTC_VERSION from 109601 to 109700 in the kernel config. This is a straightforward version metadata update with no evidence of added code execution, network access, privilege changes, or packaging behavior changes. I found no suspicious sources or install scripts implicated by this diff hunk. Risk is minimal.

@@ -11,7 +11,7 @@ CONFIG_AS_VERSION=24601
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=24601
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=109601
+CONFIG_RUSTC_VERSION=109700
 CONFIG_RUST_IS_AVAILABLE=y
 CONFIG_RUSTC_LLVM_VERSION=220108
 CONFIG_RUSTC_LLVM_MAJOR_VERSION=22

Comment

The change only removes CONFIG_GENERIC_TIME_VSYSCALL from the kernel config. This is a kernel build-time configuration tweak, not a packaging script or runtime persistence mechanism. I don't see any supply-chain, privilege-escalation, network, or integrity red flags in this diff hunk. The impact is limited to kernel time/vsyscall behavior and does not introduce malicious behavior.

@@ -97,7 +97,6 @@ CONFIG_SPARSE_IRQ=y
 CONFIG_CLOCKSOURCE_WATCHDOG=y
 CONFIG_ARCH_CLOCKSOURCE_INIT=y
 CONFIG_ARCH_WANTS_CLOCKSOURCE_READ_INLINE=y
-CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST_IDLE=y

Comment

The change only enables CONFIG_SCHED_CACHE in the kernel config. This is a normal kernel feature toggle and does not introduce any obvious supply-chain, persistence, privilege-escalation, or build-time execution risk. No scripts, sources, or packaging behavior are affected by this diff hunk.

@@ -229,6 +228,7 @@ CONFIG_GCC_NO_STRINGOP_OVERFLOW=y
 CONFIG_CC_NO_STRINGOP_OVERFLOW=y
 CONFIG_ARCH_SUPPORTS_INT128=y
 CONFIG_NUMA_BALANCING=y
+CONFIG_SCHED_CACHE=y
 CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y
 CONFIG_SLAB_OBJ_EXT=y
 CONFIG_CGROUPS=y

Comment

The change only enables two kernel configuration options related to futex robust unlock support. This is a normal kernel feature toggle, with no evidence of added code execution, network access, persistence, privilege escalation, or packaging/install-script behavior. I did not find any security-relevant red flags in this hunk.

@@ -310,6 +310,8 @@ CONFIG_FUTEX=y
 CONFIG_FUTEX_PI=y
 CONFIG_FUTEX_PRIVATE_HASH=y
 CONFIG_FUTEX_MPOL=y
+CONFIG_HAVE_FUTEX_ROBUST_UNLOCK=y
+CONFIG_FUTEX_ROBUST_UNLOCK=y
 CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y

Comment

The change is a one-line update to the kernel config's recorded Rust compiler version string. It does not alter build logic, sources, install scripts, permissions, or runtime behavior. No security-relevant functionality is introduced by this diff hunk.

@@ -342,7 +344,7 @@ CONFIG_PERF_EVENTS=y
 CONFIG_SYSTEM_DATA_VERIFICATION=y
 CONFIG_PROFILING=y
 CONFIG_RUST=y
-CONFIG_RUSTC_VERSION_TEXT="rustc 1.96.1 (31fca3adb 2026-06-26) (Arch Linux rust 1:1.96.1-1)"
+CONFIG_RUSTC_VERSION_TEXT="rustc 1.97.0 (2d8144b78 2026-07-07) (Arch Linux rust 1:1.97.0-1)"
 CONFIG_BINDGEN_VERSION_TEXT="bindgen 0.72.1"
 CONFIG_TRACEPOINTS=y
 

Comment

The only reviewed change is the removal of `# CONFIG_XEN_DEBUG_FS is not set` from the kernel config. That means Xen debugfs support is now enabled, which increases kernel attack surface and can expose additional internal state via debugfs, but it is not a direct persistence, privilege-escalation, or supply-chain red flag. No suspicious build-time execution, external downloads, install scripts, or packaging changes are present in this hunk. Overall this is a low-risk configuration change with a modest security-hardening concern due to expanded debug interfaces.

@@ -434,7 +436,6 @@ CONFIG_XEN_PV_DOM0=y
 CONFIG_XEN_PVHVM=y
 CONFIG_XEN_PVHVM_SMP=y
 CONFIG_XEN_PVHVM_GUEST=y
-# CONFIG_XEN_DEBUG_FS is not set
 CONFIG_XEN_PVH=y
 CONFIG_XEN_DOM0=y
 CONFIG_XEN_PV_MSR_SAFE=y

Comment

The change is a no-op reordering of a kernel config symbol: CONFIG_BROADCAST_TLB_FLUSH is moved a few lines later with no value change. This does not alter build inputs, package contents, permissions, or introduce any execution path, network access, or persistence mechanism. No security impact is evident from this diff hunk alone.

@@ -460,12 +461,12 @@ CONFIG_X86_MINIMUM_CPU_FAMILY=64
 CONFIG_X86_DEBUGCTLMSR=y
 CONFIG_IA32_FEAT_CTL=y
 CONFIG_X86_VMX_FEATURE_NAMES=y
-CONFIG_BROADCAST_TLB_FLUSH=y
 CONFIG_CPU_SUP_INTEL=y
 CONFIG_CPU_SUP_AMD=y
 CONFIG_CPU_SUP_HYGON=y
 CONFIG_CPU_SUP_CENTAUR=y
 CONFIG_CPU_SUP_ZHAOXIN=y
+CONFIG_BROADCAST_TLB_FLUSH=y
 CONFIG_HPET_TIMER=y
 CONFIG_HPET_EMULATE_RTC=y
 CONFIG_DMI=y

Comment

The only change in the reviewed hunk is removing CONFIG_PREFIX_SYMBOLS=y from the kernel config. That option affects symbol prefixing in the built kernel, but in this package context it is just a build-time kernel configuration toggle and does not introduce any obvious supply-chain, persistence, privilege-escalation, or network-execution risk. I did not see any malicious packaging behavior in the provided diff hunk.

@@ -597,7 +598,6 @@ CONFIG_FUNCTION_PADDING_BYTES=16
 CONFIG_CALL_PADDING=y
 CONFIG_HAVE_CALL_THUNKS=y
 CONFIG_CALL_THUNKS=y
-CONFIG_PREFIX_SYMBOLS=y
 CONFIG_CPU_MITIGATIONS=y
 CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y
 CONFIG_MITIGATION_RETPOLINE=y

Comment

The change only enables CONFIG_ARCH_MEMORY_ORDER_TSO in the kernel config. This is a build-time kernel configuration toggle, not a packaging script, install hook, or shipped binary. I see no evidence of network access, privilege escalation, persistence, or integrity bypass in this diff hunk. The only impact is on kernel behavior/compatibility for the target architecture, which is expected for a kernel package and not inherently suspicious.

@@ -928,6 +928,7 @@ CONFIG_ARCH_HAS_CPU_PASID=y
 CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y
 CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
 CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_MEMORY_ORDER_TSO=y
 CONFIG_HAVE_ASM_MODVERSIONS=y
 CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
 CONFIG_HAVE_RSEQ=y

Comment

The change only removes two kernel config capability flags: CONFIG_ARCH_SUPPORTS_AUTOFDO_CLANG and CONFIG_ARCH_SUPPORTS_PROPELLER_CLANG. This is a build/configuration adjustment, not an execution-path change, and it does not introduce new sources, scripts, privileges, persistence, or network access. I see no security impact from the diff itself beyond potentially disabling optional compiler optimizations.

@@ -969,8 +970,6 @@ CONFIG_STACKPROTECTOR_STRONG=y
 CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
 CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
 CONFIG_LTO_NONE=y
-CONFIG_ARCH_SUPPORTS_AUTOFDO_CLANG=y
-CONFIG_ARCH_SUPPORTS_PROPELLER_CLANG=y
 CONFIG_ARCH_SUPPORTS_CFI=y
 CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y
 CONFIG_HAVE_CONTEXT_TRACKING_USER=y

Comment

The change only disables CONFIG_BLK_ERROR_INJECTION in the kernel config. This is a defensive hardening change: it removes a kernel testing/debug feature that can inject block-layer errors, reducing the attack surface and preventing accidental or malicious fault injection. No build-time execution, source integrity, install-script, or privilege-related concerns are introduced by this diff hunk.

@@ -1150,6 +1149,7 @@ CONFIG_EFI_PARTITION=y
 CONFIG_BLK_PM=y
 CONFIG_BLOCK_HOLDER_DEPRECATED=y
 CONFIG_BLK_MQ_STACKING=y
+# CONFIG_BLK_ERROR_INJECTION is not set
 
 #
 # IO Schedulers

Comment

The change is a kernel config update with a single visible hunk renaming a slab allocator option from CONFIG_RANDOM_KMALLOC_CACHES to CONFIG_KMALLOC_PARTITION_CACHES. In the surrounding diff, this is part of a broad upstream config refresh that mostly toggles kernel features and drivers. I do not see any supply-chain red flags, build-time code execution, privilege escalation, persistence, or suspicious external sources in this change. The reviewed hunk only adjusts a kernel hardening-related option name and does not introduce executable logic.

@@ -1227,7 +1227,7 @@ CONFIG_SLAB_FREELIST_RANDOM=y
 CONFIG_SLAB_FREELIST_HARDENED=y
 CONFIG_SLAB_BUCKETS=y
 # CONFIG_SLUB_STATS is not set
-# CONFIG_RANDOM_KMALLOC_CACHES is not set
+# CONFIG_KMALLOC_PARTITION_CACHES is not set
 # end of Slab allocator options
 
 CONFIG_SHUFFLE_PAGE_ALLOCATOR=y

Comment

The change only removes CONFIG_READ_ONLY_THP_FOR_FS from the kernel config. This is a kernel feature toggle affecting transparent huge pages on filesystems, not a packaging, integrity, or execution-path change. It does not introduce network access, privilege escalation, persistence, or suspicious build/install behavior. The impact is limited to runtime kernel behavior and is not inherently security-sensitive in a malicious-package sense.

@@ -1295,7 +1295,6 @@ CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ADVISE=y
 # CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_WITHIN_SIZE is not set
 CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ADVISE=y
 CONFIG_THP_SWAP=y
-CONFIG_READ_ONLY_THP_FOR_FS=y
 # CONFIG_NO_PAGE_MAPCOUNT is not set
 CONFIG_PAGE_MAPCOUNT=y
 CONFIG_PGTABLE_HAS_HUGE_LEAVES=y

Comment

The change only removes the explicit comment disabling CONFIG_TLS_TOE from the kernel config. This does not introduce any new code, build-time downloads, privilege changes, or packaging behavior by itself; it merely leaves the option unspecified in the shipped config. In the context of this single-line config edit, there is no direct security issue evident from the diff alone.

@@ -1397,7 +1396,6 @@ CONFIG_AF_UNIX_OOB=y
 CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_TLS_DEVICE=y
-# CONFIG_TLS_TOE is not set
 CONFIG_XFRM=y
 CONFIG_XFRM_OFFLOAD=y
 CONFIG_XFRM_ALGO=m

Comment

The change only removes CONFIG_TCP_SIGPOOL=y from the kernel config. This is a build-time feature toggle in the shipped kernel configuration, not a packaging script or install-time action. I don't see any supply-chain, privilege, persistence, or integrity risk introduced by this diff alone. The rest of the surrounding config still enables TCP AO and MD5SIG, but disabling SIGPOOL is not inherently suspicious from a security-review perspective.

@@ -1479,7 +1477,6 @@ CONFIG_TCP_CONG_BBR=m
 CONFIG_DEFAULT_CUBIC=y
 # CONFIG_DEFAULT_RENO is not set
 CONFIG_DEFAULT_TCP_CONG="cubic"
-CONFIG_TCP_SIGPOOL=y
 CONFIG_TCP_AO=y
 CONFIG_TCP_MD5SIG=y
 CONFIG_IPV6=y

Comment

The change only flips CONFIG_NETFILTER_NETLINK from a module to built-in. This is a kernel configuration change with no evidence of added code execution, persistence, privilege escalation, or supply-chain risk. It may affect runtime behavior or module availability, but it does not introduce a security issue by itself in the reviewed diff.

@@ -1530,7 +1527,7 @@ CONFIG_BRIDGE_NETFILTER=m
 CONFIG_NETFILTER_INGRESS=y
 CONFIG_NETFILTER_EGRESS=y
 CONFIG_NETFILTER_SKIP_EGRESS=y
-CONFIG_NETFILTER_NETLINK=m
+CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_FAMILY_BRIDGE=y
 CONFIG_NETFILTER_FAMILY_ARP=y
 CONFIG_NETFILTER_BPF_LINK=y

Comment

The change only enables a kernel configuration option, CONFIG_NET_DSA_TAG_NETC=m, in the shipped kernel config. This is a normal feature toggle for a DSA tag driver and does not introduce build-time downloads, script execution, privilege escalation, persistence, or packaging integrity issues. No suspicious sources or install scripts are involved in this hunk.

@@ -1926,6 +1923,7 @@ CONFIG_NET_DSA_TAG_MTK=m
 CONFIG_NET_DSA_TAG_MXL_862XX=m
 CONFIG_NET_DSA_TAG_MXL_GSW1XX=m
 CONFIG_NET_DSA_TAG_KSZ=m
+CONFIG_NET_DSA_TAG_NETC=m
 CONFIG_NET_DSA_TAG_OCELOT=m
 CONFIG_NET_DSA_TAG_OCELOT_8021Q=m
 CONFIG_NET_DSA_TAG_QCA=m

Comment

The change only removes CONFIG_ATALK=m from the kernel config. This disables AppleTalk support in the built kernel; it does not introduce new code execution, persistence, privilege escalation, network fetching, or packaging integrity issues. No suspicious build or install behavior is present in the provided diff hunk.

@@ -1943,7 +1941,6 @@ CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
 CONFIG_LLC=m
 CONFIG_LLC2=m
-CONFIG_ATALK=m
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
 CONFIG_PHONET=m

Comment

The change only removes three Bluetooth HCI driver modules (BT_HCIDTL1, BT_HCIBT3C, BT_HCIBLUECARD) from the kernel config. This is a reduction in functionality, not an added execution path or packaging/integrity risk. I don't see any source, build, install-script, or privilege-related concerns in this diff hunk.

@@ -2179,9 +2176,6 @@ CONFIG_BT_HCIBCM203X=m
 CONFIG_BT_HCIBCM4377=m
 CONFIG_BT_HCIBPA10X=m
 CONFIG_BT_HCIBFUSB=m
-CONFIG_BT_HCIDTL1=m
-CONFIG_BT_HCIBT3C=m
-CONFIG_BT_HCIBLUECARD=m
 CONFIG_BT_HCIVHCI=m
 CONFIG_BT_MRVL=m
 CONFIG_BT_MRVL_SDIO=m

Comment

The only change in this hunk is removing CONFIG_SENSORS_APDS990X=m from the kernel config. That disables a specific ambient light/proximity sensor driver and does not introduce any new code execution, privilege, persistence, network, or integrity risk. It is a straightforward feature removal in a shipped kernel configuration.

@@ -2847,7 +2841,6 @@ CONFIG_ISL29003=m
 CONFIG_ISL29020=m
 CONFIG_SENSORS_TSL2550=m
 CONFIG_SENSORS_BH1770=m
-CONFIG_SENSORS_APDS990X=m
 CONFIG_HMC6352=m
 CONFIG_DS1682=m
 CONFIG_VMWARE_BALLOON=m

Comment

The change only enables CONFIG_DM_INLINECRYPT as a loadable kernel module in the kernel config. This is a normal upstream kernel feature toggle related to device-mapper inline encryption support and does not introduce build-time downloads, privilege escalation, persistence, or packaging-script execution. No suspicious sources or artifacts are involved in this hunk.

@@ -3202,6 +3195,7 @@ CONFIG_DM_BIO_PRISON=m
 CONFIG_DM_PERSISTENT_DATA=m
 CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
+CONFIG_DM_INLINECRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
 CONFIG_DM_CACHE=m

Comment

The change only enables two additional kernel driver options in the shipped kernel config: CONFIG_NET_VENDOR_ALIBABA and CONFIG_ALIBABA_EEA. This is a standard configuration change, not a build-time code execution path, and it does not introduce any packaging-time network access, privilege escalation, persistence, or install-script behavior. I did not see any suspicious source, patch, or binary changes associated with this hunk. Security risk appears minimal.

@@ -3380,6 +3374,8 @@ CONFIG_NET_VENDOR_AGERE=y
 CONFIG_ET131X=m
 CONFIG_NET_VENDOR_ALACRITECH=y
 CONFIG_SLICOSS=m
+CONFIG_NET_VENDOR_ALIBABA=y
+CONFIG_ALIBABA_EEA=m
 CONFIG_ALTERA_TSE=m
 CONFIG_NET_VENDOR_AMAZON=y
 CONFIG_ENA_ETHERNET=m

Comment

The change only removes several Wiznet Ethernet driver options from the kernel config (WIZNET_W5300, bus selection, and WIZNET_W5100_SPI) while leaving the package build, sources, and install-time behavior untouched. This is a straightforward feature reduction in a kernel configuration file and does not introduce any obvious supply-chain, privilege-escalation, persistence, or code-execution risk. The only impact is loss of support for those specific drivers/devices.

@@ -3720,11 +3716,6 @@ CONFIG_TXGBEVF=m
 CONFIG_NGBEVF=m
 CONFIG_NET_VENDOR_WIZNET=y
 CONFIG_WIZNET_W5100=m
-CONFIG_WIZNET_W5300=m
-# CONFIG_WIZNET_BUS_DIRECT is not set
-# CONFIG_WIZNET_BUS_INDIRECT is not set
-CONFIG_WIZNET_BUS_ANY=y
-CONFIG_WIZNET_W5100_SPI=m
 CONFIG_NET_VENDOR_XILINX=y
 CONFIG_XILINX_EMACLITE=m
 CONFIG_XILINX_AXI_EMAC=m

Comment

The only change in scope enables two additional PHY driver modules in the kernel config: CONFIG_AIR_AN8801_PHY and CONFIG_AIR_NET_PHYLIB. These are standard in-tree kernel options, added as modules, with no accompanying build-time downloads, scripts, or privilege-related artifacts. I did not find any security-relevant red flags in this hunk itself; it is a routine kernel configuration expansion for hardware support.

@@ -3747,7 +3738,9 @@ CONFIG_SFP=m
 # MII PHY device drivers
 #
 CONFIG_AS21XXX_PHY=m
+CONFIG_AIR_AN8801_PHY=m
 CONFIG_AIR_EN8811H_PHY=m
+CONFIG_AIR_NET_PHYLIB=m
 CONFIG_AMD_PHY=m
 CONFIG_ADIN_PHY=m
 CONFIG_ADIN1100_PHY=m

Comment

The change only enables the in-kernel virtio CAN driver as a module in the kernel config. This does not introduce any build-time downloads, scripts, privilege changes, or packaging behavior, and it stays within the normal kernel feature set. No security red flags are apparent from this one-line config addition.

@@ -3825,6 +3818,7 @@ CONFIG_CAN_CAN327=m
 CONFIG_CAN_JANZ_ICAN3=m
 CONFIG_CAN_KVASER_PCIEFD=m
 CONFIG_CAN_SLCAN=m
+CONFIG_CAN_VIRTIO_CAN=m
 CONFIG_CAN_C_CAN=m
 CONFIG_CAN_C_CAN_PLATFORM=m
 CONFIG_CAN_C_CAN_PCI=m

Comment

The change only enables the kernel PPPoX module in the shipped kernel config. This is a normal feature toggle with no evidence of added code execution, network fetching, privilege escalation, persistence, or packaging hygiene issues. I found no suspicious sources or scripts associated with this diff hunk.

@@ -3921,6 +3915,7 @@ CONFIG_PPP_FILTER=y
 CONFIG_PPP_MPPE=m
 CONFIG_PPP_MULTILINK=y
 CONFIG_PPPOATM=m
+CONFIG_PPPOX=m
 CONFIG_PPPOE=m
 # CONFIG_PPPOE_HASH_BITS_1 is not set
 # CONFIG_PPPOE_HASH_BITS_2 is not set

Comment

The change only enables an additional Realtek Wi‑Fi driver option in the kernel config: CONFIG_RTW89_8922AU=m. This is a normal kernel module selection, with no evidence of network fetches, script execution, privilege escalation, or packaging integrity issues. I did not see any suspicious build-time behavior in this hunk itself.

@@ -4304,6 +4299,7 @@ CONFIG_RTW89_8852BTE=m
 CONFIG_RTW89_8852CE=m
 CONFIG_RTW89_8852CU=m
 CONFIG_RTW89_8922AE=m
+CONFIG_RTW89_8922AU=m
 CONFIG_RTW89_DEBUG=y
 CONFIG_RTW89_DEBUGMSG=y
 CONFIG_RTW89_DEBUGFS=y

Comment

The change only enables an additional kernel touchscreen driver module (CONFIG_TOUCHSCREEN_WACOM_W9000=m) in the kernel config. This is a normal hardware-support adjustment, with no evidence of network access, script execution, privilege escalation, persistence, or packaging integrity issues. It does not alter build/install logic or introduce suspicious sources/artifacts.

@@ -4547,6 +4543,7 @@ CONFIG_TOUCHSCREEN_ELAN=m
 CONFIG_TOUCHSCREEN_ELO=m
 CONFIG_TOUCHSCREEN_WACOM_W8001=m
 CONFIG_TOUCHSCREEN_WACOM_I2C=m
+CONFIG_TOUCHSCREEN_WACOM_W9000=m
 CONFIG_TOUCHSCREEN_MAX11801=m
 CONFIG_TOUCHSCREEN_MMS114=m
 CONFIG_TOUCHSCREEN_MELFAS_MIP4=m

Comment

The change is a single kernel config adjustment that removes CONFIG_TOUCHSCREEN_PCAP from the build. This does not introduce any new code execution, network access, privilege escalation, persistence, or packaging integrity concerns. It only disables one touchscreen driver module, which is a normal functional change and not a security risk by itself.

@@ -4593,7 +4590,6 @@ CONFIG_TOUCHSCREEN_TSC2004=m
 CONFIG_TOUCHSCREEN_TSC2005=m
 CONFIG_TOUCHSCREEN_TSC2007=m
 CONFIG_TOUCHSCREEN_TSC2007_IIO=y
-CONFIG_TOUCHSCREEN_PCAP=m
 CONFIG_TOUCHSCREEN_RM_TS=m
 CONFIG_TOUCHSCREEN_SILEAD=m
 CONFIG_TOUCHSCREEN_SIS_I2C=m

Comment

The reviewed change is a single kernel config line removal: CONFIG_INPUT_PCAP=m. This disables one input driver and does not introduce any new code execution, network access, privilege escalation, packaging, or persistence behavior. Based on the provided hunk, it is a low-risk functional config adjustment only.

@@ -4659,7 +4655,6 @@ CONFIG_INPUT_DA9052_ONKEY=m
 CONFIG_INPUT_DA9055_ONKEY=m
 CONFIG_INPUT_DA9063_ONKEY=m
 CONFIG_INPUT_WM831X_ON=m
-CONFIG_INPUT_PCAP=m
 CONFIG_INPUT_ADXL34X=m
 CONFIG_INPUT_ADXL34X_I2C=m
 CONFIG_INPUT_ADXL34X_SPI=m

Comment

The change is a one-line kernel config removal: CONFIG_APPLICOM=m. This disables building the Applicom PCI communication driver as a module. It does not introduce new code, network access, privilege escalation, persistence, or packaging/install-script behavior. The impact is limited to reduced hardware support for that specific driver, so there is no security concern in the diff itself.

@@ -4835,7 +4830,6 @@ CONFIG_HW_RANDOM_BA431=m
 CONFIG_HW_RANDOM_VIA=m
 CONFIG_HW_RANDOM_VIRTIO=m
 CONFIG_HW_RANDOM_XIPHERA=m
-CONFIG_APPLICOM=m
 CONFIG_DEVMEM=y
 CONFIG_NVRAM=y
 CONFIG_DEVPORT=y

Comment

The change is a single kernel config toggle enabling CONFIG_GPIO_WAVESHARE_DSI_TOUCH as a module. This is a normal upstream kernel driver option and does not introduce build-time code execution, network access, privilege escalation, or packaging hygiene issues. No suspicious sources, scripts, or install-time behavior are involved in this diff hunk.

@@ -5185,6 +5179,7 @@ CONFIG_GPIO_MENZ127=m
 # CONFIG_GPIO_POLARFIRE_SOC is not set
 CONFIG_GPIO_SIOX=m
 CONFIG_GPIO_TANGIER=m
+CONFIG_GPIO_WAVESHARE_DSI_TOUCH=m
 CONFIG_GPIO_WCD934X=m
 CONFIG_GPIO_XILINX=m
 CONFIG_GPIO_AMD_FCH=m

Comment

The change only enables CONFIG_GPIO_LTC4283 as a loadable kernel module in the kernel config. This is a straightforward addition of a GPIO driver option, with no build-script changes, no network activity, no install hooks, and no privilege/persistence mechanisms. I don't see any supply-chain or packaging integrity risk in this diff hunk.

@@ -5256,6 +5251,12 @@ CONFIG_GPIO_WM8994=m
 # end of MFD GPIO expanders
 
 #
+# Auxiliary Bus GPIO drivers
+#
+CONFIG_GPIO_LTC4283=m
+# end of Auxiliary Bus GPIO drivers
+
+#
 # PCI GPIO expanders
 #
 CONFIG_GPIO_AMD8111=m

Comment

The change only enables one additional kernel config option, CONFIG_BATTERY_CHARGER_SURFACE_RT=m, in the shipped kernel configuration. This is a normal feature toggle for a Surface battery charger driver and does not introduce any build-time downloads, scripts, privilege escalation, persistence, or packaging integrity issues. No suspicious sources or install-time behavior are involved in this diff hunk.

@@ -5439,6 +5440,7 @@ CONFIG_CHARGER_WILCO=m
 CONFIG_BATTERY_SURFACE=m
 CONFIG_CHARGER_SURFACE=m
 CONFIG_BATTERY_UG3105=m
+CONFIG_BATTERY_CHARGER_SURFACE_RT=m
 CONFIG_FUEL_GAUGE_MM8013=m
 CONFIG_HWMON=y
 CONFIG_HWMON_VID=m

Comment

The change only enables the kernel config option CONFIG_SENSORS_ARCTIC_FAN_CONTROLLER as a module. This is a standard upstream kernel driver selection in the package config, with no evidence of added scripts, downloads, privilege changes, or packaging behavior changes. I did not find any security-relevant red flags in this diff hunk.

@@ -5478,6 +5480,7 @@ CONFIG_SENSORS_KBATT=m
 CONFIG_SENSORS_KFAN=m
 CONFIG_SENSORS_FAM15H_POWER=m
 CONFIG_SENSORS_APPLESMC=m
+CONFIG_SENSORS_ARCTIC_FAN_CONTROLLER=m
 CONFIG_SENSORS_ASB100=m
 CONFIG_SENSORS_ATXP1=m
 CONFIG_SENSORS_CGBC=m

Comment

The change is a one-line kernel config addition enabling CONFIG_SENSORS_PROM21_XHCI as a module. This is a normal upstream-style kernel feature toggle, with no evidence of network access, privilege escalation, persistence, or packaging-time execution. I did not see any suspicious source, script, or install-time behavior in the provided diff hunk.

@@ -5519,6 +5522,7 @@ CONFIG_SENSORS_IT87=m
 CONFIG_SENSORS_JC42=m
 CONFIG_SENSORS_POWERZ=m
 CONFIG_SENSORS_POWR1220=m
+CONFIG_SENSORS_PROM21_XHCI=m
 CONFIG_SENSORS_LATTEPANDA_SIGMA_EC=m
 CONFIG_SENSORS_LENOVO_EC=m
 CONFIG_SENSORS_LINEAGE=m

Comment

The change is a single kernel config toggle enabling the LTC4283 hardware monitoring driver as a module. It does not introduce any build-time downloads, scripts, privilege changes, persistence mechanisms, or packaging behavior changes. No security-relevant red flags are present in this diff hunk.

@@ -5536,6 +5540,7 @@ CONFIG_SENSORS_LTC4245=m
 CONFIG_SENSORS_LTC4260=m
 CONFIG_SENSORS_LTC4261=m
 CONFIG_SENSORS_LTC4282=m
+CONFIG_SENSORS_LTC4283=m
 CONFIG_SENSORS_MAX1111=m
 CONFIG_SENSORS_MAX127=m
 CONFIG_SENSORS_MAX16065=m

Comment

The change only enables two additional Linux kernel hardware-monitoring drivers in the shipped kernel config: CONFIG_SENSORS_D1U74T and CONFIG_SENSORS_E50SN12051. This is a normal feature expansion, with no evidence of network access, script execution, privilege escalation, persistence, or integrity issues. The diff does not introduce suspicious sources, install scripts, or packaging behavior.

@@ -5607,11 +5612,13 @@ CONFIG_SENSORS_APS_379=m
 CONFIG_SENSORS_BEL_PFE=m
 CONFIG_SENSORS_BPA_RS600=m
 CONFIG_SENSORS_CRPS=m
+CONFIG_SENSORS_D1U74T=m
 CONFIG_SENSORS_DELTA_AHE50DC_FAN=m
 CONFIG_SENSORS_FSP_3Y=m
 CONFIG_SENSORS_HAC300S=m
 CONFIG_SENSORS_IBM_CFFPS=m
 CONFIG_SENSORS_DPS920AB=m
+CONFIG_SENSORS_E50SN12051=m
 CONFIG_SENSORS_INA233=m
 CONFIG_SENSORS_INSPUR_IPSPS=m
 CONFIG_SENSORS_IR35221=m

Comment

The change only enables additional kernel config options for hardware drivers and related subsystems (mostly hwmon/power, USB, audio, DRM, etc.). I do not see any supply-chain red flags, build-time code execution, privilege escalation, persistence mechanisms, or suspicious external sources in this hunk. It is a broad config expansion, but it stays within normal kernel feature toggles and does not introduce packaging-script behavior. Risk is low.

@@ -5629,12 +5636,16 @@ CONFIG_SENSORS_LTC2978=m
 # CONFIG_SENSORS_LTC2978_REGULATOR is not set
 CONFIG_SENSORS_LTC3815=m
 CONFIG_SENSORS_LTC4286=y
+CONFIG_SENSORS_LX1308=m
 CONFIG_SENSORS_MAX15301=m
 CONFIG_SENSORS_MAX16064=m
 CONFIG_SENSORS_MAX16601=m
 CONFIG_SENSORS_MAX17616=m
 CONFIG_SENSORS_MAX20730=m
 CONFIG_SENSORS_MAX20751=m
+CONFIG_SENSORS_MAX20830=m
+CONFIG_SENSORS_MAX20860A=m
+CONFIG_SENSORS_MAX20860A_REGULATOR=y
 CONFIG_SENSORS_MAX31785=m
 CONFIG_SENSORS_MAX34440=m
 CONFIG_SENSORS_MAX8688=m

Comment

The change is a single kernel config toggle enabling the MP2985 hardware sensor driver as a module. It does not introduce any build-time downloads, scripts, privilege changes, persistence mechanisms, or packaging/install logic. This is a routine feature enablement in a kernel package and is low risk.

@@ -5645,6 +5656,7 @@ CONFIG_SENSORS_MP2891=m
 CONFIG_SENSORS_MP2925=m
 CONFIG_SENSORS_MP29502=m
 CONFIG_SENSORS_MP2975=m
+CONFIG_SENSORS_MP2985=m
 CONFIG_SENSORS_MP2993=m
 CONFIG_SENSORS_MP2975_REGULATOR=y
 CONFIG_SENSORS_MP5023=m

Comment

The change is a single kernel config toggle enabling the EMC1812 hardware monitoring driver as a module. It does not introduce build-time execution, network access, privilege escalation, persistence, or packaging-script behavior. The option is consistent with surrounding sensor drivers and only broadens hardware support. No security concerns are evident from this diff hunk alone.

@@ -5693,6 +5705,7 @@ CONFIG_SENSORS_SIS5595=m
 CONFIG_SENSORS_SY7636A=m
 CONFIG_SENSORS_DME1737=m
 CONFIG_SENSORS_EMC1403=m
+CONFIG_SENSORS_EMC1812=m
 CONFIG_SENSORS_EMC2103=m
 CONFIG_SENSORS_EMC2305=m
 CONFIG_SENSORS_EMC6W201=m

Comment

The change only enables the kernel GPIO watchdog driver as a module in the shipped kernel config. This is a normal hardware-support configuration change with no evidence of malicious behavior: no new sources, scripts, install hooks, privilege changes, or build-time network access. The added option does not by itself introduce persistence or security risk beyond the usual kernel driver surface already present in the kernel tree.

@@ -5829,6 +5842,7 @@ CONFIG_DA9052_WATCHDOG=m
 CONFIG_DA9055_WATCHDOG=m
 CONFIG_DA9063_WATCHDOG=m
 CONFIG_DA9062_WATCHDOG=m
+CONFIG_GPIO_WATCHDOG=m
 CONFIG_LENOVO_SE10_WDT=m
 CONFIG_LENOVO_SE30_WDT=m
 CONFIG_MENF21BMC_WATCHDOG=m

Comment

The change only removes CONFIG_MACHZ_WDT from the kernel config. This disables one watchdog driver module and does not introduce any new code execution, privilege escalation, persistence, network access, or packaging integrity issues. No suspicious sources, scripts, or install-time behavior are involved in this hunk.

@@ -5881,7 +5895,6 @@ CONFIG_VIA_WDT=m
 CONFIG_W83627HF_WDT=m
 CONFIG_W83877F_WDT=m
 CONFIG_W83977F_WDT=m
-CONFIG_MACHZ_WDT=m
 CONFIG_SBC_EPX_C3_WATCHDOG=m
 CONFIG_INTEL_MEI_WDT=m
 CONFIG_NI903X_WDT=m

Comment

The change only disables CONFIG_EZX_PCAP in the kernel config, removing support for that specific MFD/PMIC driver. This is a narrow functional change with no evidence of malicious behavior, privilege escalation, persistence, network access, or packaging integrity issues. No suspicious scripts or build-time execution are involved in the provided diff.

@@ -6000,7 +6013,6 @@ CONFIG_MFD_MT6397=m
 CONFIG_MFD_MENF21BMC=m
 CONFIG_MFD_NCT6694=m
 CONFIG_MFD_OCELOT=m
-CONFIG_EZX_PCAP=y
 CONFIG_MFD_VIPERBOARD=m
 CONFIG_MFD_RETU=m
 CONFIG_MFD_SY7636A=m

Comment

The change only removes CONFIG_REGULATOR_PCAP from the kernel config. This is a normal feature toggle in a Linux kernel package and does not introduce code execution, privilege escalation, network access, or packaging integrity issues. I found no suspicious sources, scripts, or install-time behavior associated with this diff hunk.

@@ -6143,7 +6155,6 @@ CONFIG_REGULATOR_MT6397=m
 CONFIG_REGULATOR_PALMAS=m
 CONFIG_REGULATOR_PCA9450=m
 CONFIG_REGULATOR_PF9453=m
-CONFIG_REGULATOR_PCAP=m
 CONFIG_REGULATOR_PF0900=m
 CONFIG_REGULATOR_PV88060=m
 CONFIG_REGULATOR_PV88080=m

Comment

The change only enables a single additional kernel module option in the shipped kernel config: CONFIG_VIDEO_HWS=m. This is a normal kernel feature toggle, not a build-time download, script execution, privilege change, or packaging/persistence mechanism. I did not find any security-relevant behavior in this diff hunk itself.

@@ -6464,6 +6475,7 @@ CONFIG_MEDIA_PCI_SUPPORT=y
 #
 # Media capture support
 #
+CONFIG_VIDEO_HWS=m
 CONFIG_VIDEO_MGB4=m
 CONFIG_VIDEO_SOLO6X10=m
 CONFIG_VIDEO_TW5864=m

Comment

The change is a kernel config update adding one additional media driver (CONFIG_VIDEO_AMD_ISP4_CAPTURE=m) alongside a broad set of unrelated config churn. For the specific hunk under review, there is no evidence of malicious build logic, network fetches, privilege escalation, or persistence mechanisms. It only enables a loadable kernel module, which is normal for a kernel package config. Risk is low, though kernel config changes can expand attack surface in general.

@@ -6562,6 +6574,7 @@ CONFIG_VIDEO_MEM2MEM_DEINTERLACE=m
 #
 # Allegro DVT media platform drivers
 #
+CONFIG_VIDEO_AMD_ISP4_CAPTURE=m
 
 #
 # Amlogic media platform drivers

Comment

The change only removes two kernel DRM bridge driver options from the kernel config: CONFIG_DRM_ANALOGIX_ANX78XX and CONFIG_DRM_ANALOGIX_DP. This is a build-time feature reduction, not an added execution path, persistence mechanism, or integrity issue. I did not find any suspicious source, install script, or packaging behavior in the provided hunk. Security impact is low; the main effect is reduced hardware support for certain DisplayPort/bridge devices.

@@ -7203,8 +7216,6 @@ CONFIG_DRM_PANEL_BRIDGE=y
 # Display Interface Bridges
 #
 CONFIG_DRM_I2C_NXP_TDA998X=m
-CONFIG_DRM_ANALOGIX_ANX78XX=m
-CONFIG_DRM_ANALOGIX_DP=m
 # end of Display Interface Bridges
 
 # CONFIG_DRM_ETNAVIV is not set

Comment

The change only enables one additional kernel module in the shipped Arch kernel config: CONFIG_DRM_PANEL_FOCALTECH_OTA7290B=m. This is a normal upstream driver selection change, with no evidence of network access, script execution, privilege escalation, persistence, or packaging integrity issues. No suspicious sources or install-time behavior are involved in this diff.

@@ -7247,6 +7258,7 @@ CONFIG_DRM_PANEL=y
 # Display Panels
 #
 CONFIG_DRM_PANEL_AUO_A030JTN01=m
+CONFIG_DRM_PANEL_FOCALTECH_OTA7290B=m
 CONFIG_DRM_PANEL_ILITEK_ILI9341=m
 CONFIG_DRM_PANEL_ORISETECH_OTA5601A=m
 CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m

Comment

The change only removes a single kernel config line disabling CONFIG_FB_HGA. This is a benign kernel framebuffer option toggle in the shipped config, with no evidence of added code execution, network access, privilege escalation, or packaging-time behavior changes. I did not find any security-relevant impact from this diff alone.

@@ -7329,7 +7341,6 @@ CONFIG_FB=y
 CONFIG_FB_VESA=y
 CONFIG_FB_EFI=y
 # CONFIG_FB_N411 is not set
-# CONFIG_FB_HGA is not set
 # CONFIG_FB_OPENCORES is not set
 # CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_NVIDIA is not set

Comment

The change only enables an additional Linux kernel backlight driver (CONFIG_BACKLIGHT_MAX25014=m) in the shipped kernel config. This is a normal feature toggle in a kernel package, with no evidence of network access, privilege escalation, persistence, or other malicious behavior. The module is built as a loadable kernel module and does not by itself introduce packaging integrity issues.

@@ -7405,6 +7416,7 @@ CONFIG_BACKLIGHT_PWM=m
 CONFIG_BACKLIGHT_CGBC=m
 CONFIG_BACKLIGHT_DA903X=m
 CONFIG_BACKLIGHT_DA9052=m
+CONFIG_BACKLIGHT_MAX25014=m
 CONFIG_BACKLIGHT_MAX8925=m
 CONFIG_BACKLIGHT_MT6370=m
 CONFIG_BACKLIGHT_APPLE=m

Comment

The change only enables an additional upstream kernel configuration option, CONFIG_SND_SOC_AMD_ACP7X=m, in the package's kernel config. This is a normal feature toggle for AMD audio support and does not introduce any build-time downloads, scripts, privilege changes, persistence mechanisms, or packaging integrity issues. No suspicious sources or executable artifacts are involved in this hunk.

@@ -7775,6 +7787,7 @@ CONFIG_SND_SOC_AMD_SOUNDWIRE_LINK_BASELINE=m
 CONFIG_SND_SOC_AMD_SOUNDWIRE=m
 CONFIG_SND_SOC_AMD_PS=m
 CONFIG_SND_SOC_AMD_PS_MACH=m
+CONFIG_SND_SOC_AMD_ACP7X=m
 # end of AMD
 
 #

Comment

The change is a one-line kernel config addition enabling CONFIG_SND_SOC_CS42XX8_SPI as a module. This is a normal driver option for an existing audio codec family and does not introduce any build-time downloads, scripts, privilege changes, persistence mechanisms, or suspicious packaging behavior. No security-relevant red flags are present in the provided diff hunk.

@@ -8152,6 +8165,7 @@ CONFIG_SND_SOC_CS4271=m
 CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_CS4271_SPI=m
 CONFIG_SND_SOC_CS42XX8=m
+CONFIG_SND_SOC_CS42XX8_SPI=m
 CONFIG_SND_SOC_CS42XX8_I2C=m
 CONFIG_SND_SOC_CS43130=m
 CONFIG_SND_SOC_CS4341=m

Comment

The change only enables an additional Linux kernel sound codec driver (CONFIG_SND_SOC_ES9356=m) in the kernel config. This is a normal feature toggle in a kernel package, with no evidence of network access, script execution, privilege escalation, persistence, or packaging integrity issues. I found no suspicious source, install script, or build-time behavior associated with this one-line config change.

@@ -8178,6 +8192,7 @@ CONFIG_SND_SOC_ES8328_I2C=m
 CONFIG_SND_SOC_ES8328_SPI=m
 CONFIG_SND_SOC_ES8375=m
 CONFIG_SND_SOC_ES8389=m
+CONFIG_SND_SOC_ES9356=m
 CONFIG_SND_SOC_FS_AMP_LIB=m
 CONFIG_SND_SOC_FS210X=m
 CONFIG_SND_SOC_GTM601=m

Comment

The change is a one-line kernel config addition enabling CONFIG_SND_SOC_TAC5XX2_SDW as a module. This is a normal upstream-style kernel feature toggle with no evidence of malicious behavior, no build-time code execution, no network access, and no packaging/script changes. It only affects which kernel driver is built, and the diff itself does not introduce persistence, privilege escalation, or integrity risks.

@@ -8298,6 +8313,7 @@ CONFIG_SND_SOC_SSM4567=m
 CONFIG_SND_SOC_STA32X=m
 CONFIG_SND_SOC_STA350=m
 CONFIG_SND_SOC_STI_SAS=m
+CONFIG_SND_SOC_TAC5XX2_SDW=m
 CONFIG_SND_SOC_TAS2552=m
 CONFIG_SND_SOC_TAS2562=m
 CONFIG_SND_SOC_TAS2764=m

Comment

The reviewed change is a single kernel config addition enabling CONFIG_SND_SOC_TAS675X=m. This is a normal upstream driver toggle in a kernel configuration file, with no evidence of network fetches, install-script behavior, privilege escalation, or suspicious packaging actions. The broader config diff contains many unrelated kernel option changes, but this specific hunk only adds a sound codec module and does not introduce an obvious security risk by itself.

@@ -8313,6 +8329,7 @@ CONFIG_SND_SOC_TAS571X=m
 CONFIG_SND_SOC_TAS5720=m
 CONFIG_SND_SOC_TAS5805M=m
 CONFIG_SND_SOC_TAS6424=m
+CONFIG_SND_SOC_TAS675X=m
 CONFIG_SND_SOC_TDA7419=m
 CONFIG_SND_SOC_TFA9879=m
 CONFIG_SND_SOC_TFA989X=m

Comment

The change is a one-line kernel config addition enabling CONFIG_HID_RAKK as a module. This is a normal hardware-driver toggle in the shipped kernel config, with no evidence of network access, script execution, privilege escalation, persistence, or packaging hygiene issues. It does not alter build/install logic or introduce suspicious sources/artifacts. Low risk.

@@ -8503,6 +8520,7 @@ CONFIG_HID_MAGICMOUSE=m
 CONFIG_HID_MALTRON=m
 CONFIG_HID_MAYFLASH=m
 CONFIG_HID_MEGAWORLD_FF=m
+CONFIG_HID_RAKK=m
 CONFIG_HID_REDRAGON=m
 CONFIG_HID_MICROSOFT=m
 CONFIG_HID_MONTEREY=m

Comment

The change is a one-line kernel config addition enabling CONFIG_HID_OXP as a module. This is a normal hardware-driver toggle in the kernel config, with no evidence of network access, privilege escalation, persistence, or packaging abuse. It does not alter build scripts, install scripts, or introduce external sources/binaries. Low risk.

@@ -8514,6 +8532,7 @@ CONFIG_HID_NTRIG=m
 CONFIG_HID_NVIDIA_SHIELD=m
 CONFIG_NVIDIA_SHIELD_FF=y
 CONFIG_HID_ORTEK=m
+CONFIG_HID_OXP=m
 CONFIG_HID_PANTHERLORD=m
 CONFIG_PANTHERLORD_FF=y
 CONFIG_HID_PENMOUNT=m

Comment

The change only enables CONFIG_USB_XHCI_PCI_PROM21 in the kernel config. This is a normal upstream kernel driver toggle, with no evidence of malicious build-time behavior, privilege escalation, persistence, or integrity bypass in the diff. I did not see any suspicious source changes, install scripts, or executable artifacts associated with this hunk. Risk is therefore minimal.

@@ -8655,6 +8674,7 @@ CONFIG_USB_C67X00_HCD=m
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_DBGCAP=y
 CONFIG_USB_XHCI_PCI=y
+CONFIG_USB_XHCI_PCI_PROM21=y
 CONFIG_USB_XHCI_PCI_RENESAS=m
 CONFIG_USB_XHCI_PLATFORM=m
 CONFIG_USB_XHCI_SIDEBAND=y

Comment

The reviewed hunk only changes kernel config options for USB dual-mode controller support: it removes CONFIG_USB_CDNS_HOST and the CONFIG_USB_CDNSP_{GADGET,HOST} selections, while keeping CONFIG_USB_CDNS3_HOST/GADGET enabled and adding a comment block for platform glue drivers. This is a normal feature-selection change in a kernel config, with no evidence of code execution, network access, privilege escalation, or packaging-time persistence mechanisms. The change does not introduce suspicious sources, install scripts, or binaries. Risk is low.

@@ -8726,14 +8746,15 @@ CONFIG_USBIP_VUDC=m
 # USB dual-mode controller drivers
 #
 CONFIG_USB_CDNS_SUPPORT=m
-CONFIG_USB_CDNS_HOST=y
 CONFIG_USB_CDNS3=m
-CONFIG_USB_CDNS3_GADGET=y
 CONFIG_USB_CDNS3_HOST=y
+CONFIG_USB_CDNS3_GADGET=y
+
+#
+# Platform glue driver support
+#
 CONFIG_USB_CDNS3_PCI_WRAP=m
 CONFIG_USB_CDNSP_PCI=m
-CONFIG_USB_CDNSP_GADGET=y
-CONFIG_USB_CDNSP_HOST=y
 CONFIG_USB_MUSB_HDRC=m
 # CONFIG_USB_MUSB_HOST is not set
 # CONFIG_USB_MUSB_GADGET is not set

Comment

The change only enables CONFIG_INFINIBAND_USER_ACCESS_CORE=y in the kernel config. This is a kernel feature toggle, not a packaging script or install-time action, and it does not introduce network fetches, privilege escalation, persistence, or other supply-chain red flags. I did not see any accompanying patch or script changes in the provided diff. Risk is therefore minimal.

@@ -9251,6 +9272,7 @@ CONFIG_SPEAKUP_SYNTH_DUMMY=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_MAD=m
 CONFIG_INFINIBAND_USER_ACCESS=m
+CONFIG_INFINIBAND_USER_ACCESS_CORE=y
 CONFIG_INFINIBAND_USER_MEM=y
 CONFIG_INFINIBAND_ON_DEMAND_PAGING=y
 CONFIG_INFINIBAND_ADDR_TRANS=y

Comment

The change only removes one kernel config option, CONFIG_RTC_DRV_PCAP, from the linux-pf config file. This disables building that RTC driver as a module; it does not add code, scripts, network access, privilege escalation, or packaging behavior. I see no security impact from this diff alone.

@@ -9446,7 +9468,6 @@ CONFIG_RTC_DRV_CROS_EC=m
 # on-CPU RTC drivers
 #
 CONFIG_RTC_DRV_FTRTC010=m
-CONFIG_RTC_DRV_PCAP=m
 CONFIG_RTC_DRV_MC13XXX=m
 CONFIG_RTC_DRV_MT6397=m
 CONFIG_RTC_DRV_GOLDFISH=m

Comment

The change only enables CONFIG_DMABUF_HEAPS_SYSTEM_CC_SHARED in the kernel config and removes an explicit comment disabling DMABUF_SELFTESTS. This is a kernel build-time configuration change, not a runtime script or packaging action. I don't see any supply-chain, persistence, privilege-escalation, or integrity red flags in this hunk. The new option appears to be a normal kernel feature toggle related to dmabuf heap sharing; without evidence of malicious downstream code or unsafe install logic, this looks low risk.

@@ -9505,9 +9526,9 @@ CONFIG_SYNC_FILE=y
 # CONFIG_SW_SYNC is not set
 CONFIG_UDMABUF=y
 # CONFIG_DMABUF_DEBUG is not set
-# CONFIG_DMABUF_SELFTESTS is not set
 CONFIG_DMABUF_HEAPS=y
 CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMABUF_HEAPS_SYSTEM_CC_SHARED=y
 CONFIG_DMABUF_HEAPS_CMA=y
 # end of DMABUF options
 

Comment

The only reviewed change is enabling CONFIG_TDX_HOST_SERVICES=m in the kernel config. This is a normal kernel feature toggle, not a packaging or install-script change, and it does not introduce any obvious supply-chain, persistence, privilege-escalation, or network-fetch risk by itself. No suspicious sources, scripts, or post-install actions are involved in this hunk.

@@ -9563,6 +9584,7 @@ CONFIG_TDX_GUEST_DRIVER=m
 CONFIG_TSM_GUEST=y
 CONFIG_TSM_REPORTS=m
 CONFIG_TSM_MEASUREMENTS=y
+CONFIG_TDX_HOST_SERVICES=m
 CONFIG_TSM=y
 CONFIG_VIRTIO_ANCHOR=y
 CONFIG_VIRTIO=y

Comment

The change only enables CONFIG_VIDEO_MAX96712 as a loadable kernel module in the kernel config. This is a normal upstream-style configuration toggle for a video bridge/serializer driver and does not introduce any packaging-time code execution, network access, privilege escalation, persistence, or suspicious source/integrity changes. No accompanying patch or install script changes are present in the reviewed hunk.

@@ -9727,6 +9749,7 @@ CONFIG_DVB_AV7110_OSD=y
 CONFIG_DVB_SP8870=m
 CONFIG_VIDEO_IPU3_IMGU=m
 CONFIG_VIDEO_INTEL_IPU7=m
+CONFIG_VIDEO_MAX96712=m
 # CONFIG_STAGING_MEDIA_DEPRECATED is not set
 # CONFIG_FB_TFT is not set
 CONFIG_MOST_COMPONENTS=m

Comment

The change only enables CONFIG_DELL_DW5826E_RESET as a loadable kernel module in the shipped kernel config. This is a normal hardware-support addition for Dell WWAN reset functionality and does not introduce any obvious supply-chain, persistence, privilege-escalation, or build-time integrity concerns. No suspicious sources, scripts, or packaging changes are involved in this hunk.

@@ -9851,6 +9874,7 @@ CONFIG_DELL_WMI_DESCRIPTOR=m
 CONFIG_DELL_WMI_DDV=m
 CONFIG_DELL_WMI_LED=m
 CONFIG_DELL_WMI_SYSMAN=m
+CONFIG_DELL_DW5826E_RESET=m
 CONFIG_AMILO_RFKILL=m
 CONFIG_FUJITSU_LAPTOP=m
 CONFIG_FUJITSU_TABLET=m

Comment

The change only enables an additional upstream kernel configuration option, CONFIG_INTEL_PMC_PWRM_TELEMETRY=m. This is a normal kernel module selection change with no evidence of added scripts, downloads, privilege changes, persistence, or packaging-time execution. I found no security-relevant red flags in this hunk.

@@ -9870,6 +9894,7 @@ CONFIG_INTEL_SAR_INT1092=m
 CONFIG_INTEL_SKL_INT3472=m
 CONFIG_INTEL_PMC_CORE=m
 CONFIG_INTEL_PMC_SSRAM_TELEMETRY=m
+CONFIG_INTEL_PMC_PWRM_TELEMETRY=m
 CONFIG_INTEL_PMT_CLASS=m
 CONFIG_INTEL_PMT_TELEMETRY=m
 CONFIG_INTEL_PMT_CRASHLOG=m

Comment

The change only disables CONFIG_HYPERV_IOMMU in the kernel config. This is a build-time feature toggle, not a code execution path or packaging/persistence mechanism. It reduces functionality for Hyper-V guests but does not introduce supply-chain, privilege escalation, or hidden-install behavior. No suspicious sources, scripts, or runtime artifacts are involved in this diff hunk.

@@ -10041,7 +10066,6 @@ CONFIG_INTEL_IOMMU_PERF_EVENTS=y
 CONFIG_IOMMUFD_DRIVER_CORE=y
 CONFIG_IOMMUFD=m
 CONFIG_IRQ_REMAP=y
-CONFIG_HYPERV_IOMMU=y
 CONFIG_VIRTIO_IOMMU=m
 CONFIG_GENERIC_PT=y
 # CONFIG_DEBUG_GENERIC_PT is not set

Comment

The change only enables the kernel driver CONFIG_AD4691 as a module in the shipped kernel config. This is a normal hardware-support addition with no evidence of malicious behavior, privilege escalation, network access, persistence, or packaging integrity issues. No suspicious build-time execution or install-script changes are present in the reviewed hunk.

@@ -10302,6 +10326,7 @@ CONFIG_AD4080=m
 CONFIG_AD4130=m
 CONFIG_AD4134=m
 CONFIG_AD4170_4=m
+CONFIG_AD4691=m
 CONFIG_AD4695=m
 CONFIG_AD4851=m
 CONFIG_AD7091R=m

Comment

The change is a single kernel config addition enabling CONFIG_AD5706R=m. This is a normal upstream driver toggle in a generated kernel configuration, with no evidence of malicious build logic, external downloads, privilege escalation, or packaging-script changes. The surrounding diff shows many routine kernel config updates, and this specific hunk only adds support for an Analog Devices IIO driver module. Low risk.

@@ -10523,6 +10548,7 @@ CONFIG_AD5592R=m
 CONFIG_AD5593R=m
 CONFIG_AD5504=m
 CONFIG_AD5624R_SPI=m
+CONFIG_AD5706R=m
 CONFIG_AD9739A=m
 CONFIG_LTC2688=m
 CONFIG_AD5686=m

Comment

The only change in this diff is enabling CONFIG_APDS9999=m in the kernel config. This is a normal kernel driver option addition, with no evidence of malicious build steps, external downloads, privilege escalation, persistence, or packaging hygiene issues. The surrounding diff is a broad config refresh, but this specific hunk is low risk and appears to simply add support for an additional sensor driver module.

@@ -10715,6 +10741,7 @@ CONFIG_APDS9160=m
 CONFIG_APDS9300=m
 CONFIG_APDS9306=m
 CONFIG_APDS9960=m
+CONFIG_APDS9999=m
 CONFIG_AS73211=m
 CONFIG_BH1745=m
 CONFIG_BH1750=m

Comment

The change is a one-line kernel config addition enabling the VEML3328 ambient light sensor driver as a module. This is a normal hardware-support toggle in a kernel package config, with no evidence of network access, script execution, privilege changes, or packaging integrity issues. No suspicious sources or install-time behavior are involved in the provided diff.

@@ -10766,6 +10793,7 @@ CONFIG_US5182D=m
 CONFIG_VCNL4000=m
 CONFIG_VCNL4035=m
 CONFIG_VEML3235=m
+CONFIG_VEML3328=m
 CONFIG_VEML6030=m
 CONFIG_VEML6040=m
 CONFIG_VEML6046X00=m

Comment

The change only enables the MMC5983 magnetometer kernel module in the packaged kernel config. This is a normal hardware-support addition with no evidence of code execution, privilege changes, network access, or packaging integrity issues. No suspicious sources or install scripts are involved in this diff hunk.

@@ -10789,6 +10817,7 @@ CONFIG_MAG3110=m
 CONFIG_HID_SENSOR_MAGNETOMETER_3D=m
 CONFIG_MMC35240=m
 CONFIG_MMC5633=m
+CONFIG_MMC5983=m
 CONFIG_IIO_ST_MAGN_3AXIS=m
 CONFIG_IIO_ST_MAGN_I2C_3AXIS=m
 CONFIG_IIO_ST_MAGN_SPI_3AXIS=m

Comment

The change only removes CONFIG_IIO_INTERRUPT_TRIGGER from the kernel config. This is a normal kernel feature toggle and does not introduce any obvious supply-chain, privilege-escalation, persistence, or build-time execution risk. No suspicious scripts, downloads, or packaging changes are involved in this hunk.

@@ -10821,7 +10850,6 @@ CONFIG_HID_SENSOR_DEVICE_ROTATION=m
 # Triggers - standalone
 #
 CONFIG_IIO_HRTIMER_TRIGGER=m
-CONFIG_IIO_INTERRUPT_TRIGGER=m
 CONFIG_IIO_TIGHTLOOP_TRIGGER=m
 CONFIG_IIO_SYSFS_TRIGGER=m
 # end of Triggers - standalone

Comment

The change only enables the in-tree kernel driver CONFIG_PHY_NXP_TJA1145 as a module in the shipped kernel config. This is a normal upstream kernel configuration toggle, not a build-time download, script execution, privilege escalation, or persistence mechanism. I did not find any security-relevant red flags in this diff hunk alone.

@@ -11014,6 +11042,7 @@ CONFIG_GENERIC_PHY_MIPI_DPHY=y
 CONFIG_PHY_CAN_TRANSCEIVER=m
 CONFIG_PHY_GOOGLE_USB=m
 CONFIG_USB_LGM_PHY=m
+CONFIG_PHY_NXP_TJA1145=m
 
 #
 # PHY drivers for Broadcom platforms

Comment

The change only enables two additional kernel configuration options: USB4_CONFIGFS and USB4_STREAM as modules. This is a kernel config adjustment, not a packaging or install-script change, and it does not introduce any obvious supply-chain, persistence, privilege-escalation, or network-fetch behavior. The main security consideration is that it expands kernel attack surface by enabling more USB4-related functionality, but that is a normal tradeoff for a kernel package and not inherently malicious in this context.

@@ -11054,8 +11083,10 @@ CONFIG_AMD_ATL=m
 CONFIG_AMD_ATL_PRM=y
 CONFIG_RAS_FMPM=m
 CONFIG_USB4=m
+CONFIG_USB4_CONFIGFS=m
 # CONFIG_USB4_DEBUGFS_WRITE is not set
 # CONFIG_USB4_DMA_TEST is not set
+CONFIG_USB4_STREAM=m
 
 #
 # Android

Comment

The change only enables an additional kernel config option, CONFIG_FPGA_MGR_EFINIX_SPI=m. This is a normal upstream kernel feature toggle and does not introduce any build-time downloads, scripts, privilege changes, or packaging behavior. No suspicious sources or persistence mechanisms are involved in this diff hunk.

@@ -11135,6 +11166,7 @@ CONFIG_FPGA_M10_BMC_SEC_UPDATE=m
 CONFIG_FPGA_MGR_MICROCHIP_SPI=m
 CONFIG_FPGA_MGR_LATTICE_SYSCONFIG=m
 CONFIG_FPGA_MGR_LATTICE_SYSCONFIG_SPI=m
+CONFIG_FPGA_MGR_EFINIX_SPI=m
 CONFIG_TEE=m
 CONFIG_TEE_DMABUF_HEAPS=y
 CONFIG_OPTEE_STATIC_PROTMEM_POOL=y

Comment

The change is a kernel config tweak only, with no evidence of malicious build-time execution, external downloads, install scripts, or privilege/persistence mechanisms. The specific hunk removes CONFIG_EROFS_FS_ONDEMAND and adds a disabled CONFIG_EROFS_FS_PAGE_CACHE_SHARE setting, which looks like a normal upstream config adjustment rather than a security-sensitive backdoor. Based on the reviewed diff, risk is very low.

@@ -11438,9 +11470,9 @@ CONFIG_EROFS_FS_ZIP_LZMA=y
 CONFIG_EROFS_FS_ZIP_DEFLATE=y
 CONFIG_EROFS_FS_ZIP_ZSTD=y
 CONFIG_EROFS_FS_ZIP_ACCEL=y
-CONFIG_EROFS_FS_ONDEMAND=y
 CONFIG_EROFS_FS_PCPU_KTHREAD=y
 CONFIG_EROFS_FS_PCPU_KTHREAD_HIPRI=y
+# CONFIG_EROFS_FS_PAGE_CACHE_SHARE is not set
 CONFIG_VBOXSF_FS=m
 CONFIG_NETWORK_FILESYSTEMS=y
 CONFIG_NFS_FS=m

Comment

The change only removes three kernel config options enabling specific RPCSEC_GSS Kerberos encryption types (AES-SHA1, Camellia, AES-SHA2). This is a functional hardening/feature reduction, not an integrity or supply-chain risk. It does not introduce code execution, privilege escalation, network fetching, persistence, or packaging hygiene issues. The impact is limited to reduced kernel RPCSEC_GSS/Kerberos cipher support, which may break some NFS/RPC auth setups but is not a security vulnerability in the package build itself.

@@ -11488,9 +11520,6 @@ CONFIG_SUNRPC_GSS=m
 CONFIG_SUNRPC_BACKCHANNEL=y
 CONFIG_SUNRPC_SWAP=y
 CONFIG_RPCSEC_GSS_KRB5=m
-CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1=y
-CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_CAMELLIA=y
-CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2=y
 CONFIG_SUNRPC_DEBUG=y
 # CONFIG_SUNRPC_DEBUG_TRACE is not set
 CONFIG_SUNRPC_XPRT_RDMA=m

Comment

The change is a kernel config update that mostly adds/removes driver and feature options. I do not see any supply-chain red flags, build-time code execution, privilege escalation, or packaging-script behavior in this hunk. The only security-relevant item is enabling trusted-keys debug support while leaving TRUSTED_KEYS_DEBUG disabled, which does not itself expose a new attack surface. Overall this looks like a routine config refresh with no high-confidence malicious behavior.

@@ -11594,6 +11623,8 @@ CONFIG_PERSISTENT_KEYRINGS=y
 CONFIG_BIG_KEYS=y
 CONFIG_TRUSTED_KEYS=m
 CONFIG_HAVE_TRUSTED_KEYS=y
+CONFIG_HAVE_TRUSTED_KEYS_DEBUG=y
+# CONFIG_TRUSTED_KEYS_DEBUG is not set
 CONFIG_TRUSTED_KEYS_TPM=y
 CONFIG_TRUSTED_KEYS_TEE=y
 CONFIG_ENCRYPTED_KEYS=m

Comment

The change is a kernel config update with one notable removal: CONFIG_CRYPTO_FCRYPT=m. This is a routine feature toggle in a large config diff and does not introduce any obvious supply-chain, persistence, privilege-escalation, or build-time execution risk. I did not see any suspicious source changes, install scripts, or executable artifacts in the reviewed hunk. The removed option only disables an old crypto algorithm module, which is not security-sensitive in the malicious-change sense.

@@ -11787,7 +11818,6 @@ CONFIG_CRYPTO_CAST_COMMON=m
 CONFIG_CRYPTO_CAST5=m
 CONFIG_CRYPTO_CAST6=m
 CONFIG_CRYPTO_DES=m
-CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_SM4=m
 CONFIG_CRYPTO_SM4_GENERIC=m

Comment

The change only removes CONFIG_CRYPTO_PCBC from the kernel config, disabling the PCBC block cipher mode module. This is a narrow hardening/feature-reduction change with no evidence of malicious behavior, privilege escalation, persistence, network access, or integrity bypass. No suspicious packaging scripts or external fetches are involved in this hunk.

@@ -11806,7 +11836,6 @@ CONFIG_CRYPTO_CTS=y
 CONFIG_CRYPTO_ECB=y
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_XCTR=m
 CONFIG_CRYPTO_XTS=y
 # end of Length-preserving ciphers and modes

Comment

The change only flips CONFIG_CRYPTO_LZ4 from module to built-in in the kernel config. This does not introduce new code, network access, privilege escalation, persistence, or packaging-time execution. It is a normal kernel configuration adjustment with no obvious security impact from the diff alone.

@@ -11857,7 +11886,7 @@ CONFIG_CRYPTO_CRC32=m
 CONFIG_CRYPTO_DEFLATE=m
 CONFIG_CRYPTO_LZO=y
 CONFIG_CRYPTO_842=m
-CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4=y
 CONFIG_CRYPTO_LZ4HC=m
 CONFIG_CRYPTO_ZSTD=y
 # end of Compression

Comment

The change is limited to Linux kernel config toggles in the random-number-generation and crypto userspace-interface sections. It removes some DRBG sub-options and one KDF option, and marks the userspace crypto API section as deprecated, but does not introduce any new build-time code execution, network access, privilege escalation, persistence, or suspicious sources. This appears to be a normal kernel configuration adjustment with no security red flags in the diff provided.

@@ -11865,21 +11894,16 @@ CONFIG_CRYPTO_ZSTD=y
 #
 # Random number generation
 #
-CONFIG_CRYPTO_DRBG_MENU=y
-CONFIG_CRYPTO_DRBG_HMAC=y
-CONFIG_CRYPTO_DRBG_HASH=y
-CONFIG_CRYPTO_DRBG_CTR=y
 CONFIG_CRYPTO_DRBG=y
 CONFIG_CRYPTO_JITTERENTROPY=y
 CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64
 CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32
 CONFIG_CRYPTO_JITTERENTROPY_OSR=1
 CONFIG_CRYPTO_KDF800108_CTR=y
-CONFIG_CRYPTO_DF80090A=y
 # end of Random number generation
 
 #
-# Userspace interface
+# Userspace interface (deprecated)
 #
 CONFIG_CRYPTO_USER_API=m
 CONFIG_CRYPTO_USER_API_HASH=m

Comment

This change is a comment-only update in the kernel config, renaming a section footer from '# end of Userspace interface' to '# end of Userspace interface (deprecated)'. It does not alter any enabled kernel options, build logic, sources, install scripts, or runtime behavior. No security impact is evident from the provided diff hunk.

@@ -11888,7 +11912,7 @@ CONFIG_CRYPTO_USER_API_RNG=m
 # CONFIG_CRYPTO_USER_API_RNG_CAVP is not set
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set
-# end of Userspace interface
+# end of Userspace interface (deprecated)
 
 #
 # Accelerated Cryptographic Algorithms for CPU (x86)

Comment

The change is a small kernel config adjustment in the linux-pf package and does not introduce any obvious supply-chain, persistence, privilege-escalation, or build-time execution risk. The diff only toggles kernel options and reorders/updates related config symbols (e.g. RAID6/bitreverse/LZ4/crypto library settings), with no added scripts, downloads, patches, or install hooks. I do not see evidence of malicious behavior in this hunk.

@@ -11986,11 +12010,10 @@ CONFIG_BINARY_PRINTF=y
 #
 # Library routines
 #
-CONFIG_RAID6_PQ=y
-# CONFIG_RAID6_PQ_BENCHMARK is not set
 CONFIG_LINEAR_RANGES=y
 CONFIG_PACKING=y
 CONFIG_BITREVERSE=y
+CONFIG_GENERIC_BITREVERSE=y
 CONFIG_GENERIC_STRNCPY_FROM_USER=y
 CONFIG_GENERIC_STRNLEN_USER=y
 CONFIG_GENERIC_NET_UTILS=y

Comment

The change only flips CONFIG_CRYPTO_LIB_AES_CBC_MACS from a loadable module to built-in. This is a kernel configuration adjustment, not a packaging or supply-chain risk by itself. It does not introduce new sources, scripts, network access, privilege changes, or persistence mechanisms. The impact is limited to when the crypto helper is available at runtime, which is expected for a kernel config change.

@@ -12019,7 +12042,7 @@ CONFIG_CRYPTO_LIB_UTILS=y
 CONFIG_CRYPTO_LIB_AES=y
 CONFIG_CRYPTO_LIB_AES_ARCH=y
 CONFIG_CRYPTO_LIB_AESCFB=y
-CONFIG_CRYPTO_LIB_AES_CBC_MACS=m
+CONFIG_CRYPTO_LIB_AES_CBC_MACS=y
 CONFIG_CRYPTO_LIB_AESGCM=y
 CONFIG_CRYPTO_LIB_ARC4=m
 CONFIG_CRYPTO_LIB_GF128MUL=m

Comment

The change only enables the kernel RAID6 parity/quadratic helper and its arch-optimized variant, while explicitly leaving the benchmark self-test disabled. This is a normal kernel configuration adjustment with no evidence of network access, privilege escalation, persistence, or packaging integrity issues. No suspicious scripts, sources, or install-time behavior are involved in this hunk.

@@ -12053,6 +12076,9 @@ CONFIG_CRYPTO_LIB_SM3=m
 CONFIG_CRYPTO_LIB_SM3_ARCH=y
 CONFIG_XOR_BLOCKS=y
 CONFIG_XOR_BLOCKS_ARCH=y
+CONFIG_RAID6_PQ=y
+CONFIG_RAID6_PQ_ARCH=y
+# CONFIG_RAID6_PQ_BENCHMARK is not set
 CONFIG_XXHASH=y
 # CONFIG_RANDOM32_SELFTEST is not set
 CONFIG_842_COMPRESS=m

Comment

The change only flips CONFIG_LZ4_COMPRESS from module to built-in in the kernel config. This does not introduce new code, network access, privilege escalation, persistence, or packaging-time execution. It slightly changes how the kernel is built and loaded, but there is no security red flag in the diff itself.

@@ -12061,7 +12087,7 @@ CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_LZO_COMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
-CONFIG_LZ4_COMPRESS=m
+CONFIG_LZ4_COMPRESS=y
 CONFIG_LZ4HC_COMPRESS=m
 CONFIG_LZ4_DECOMPRESS=y
 CONFIG_ZSTD_COMMON=y

Comment

The change only disables CONFIG_RING_BUFFER_PERSISTENT_INJECT in the kernel config. This is a test/debug feature related to ftrace/ring buffer injection, not a packaging or runtime persistence mechanism. Disabling it reduces attack surface and does not introduce network access, privilege escalation, install-script behavior, or suspicious source changes. No security concern is evident from this hunk.

@@ -12497,6 +12523,7 @@ CONFIG_HIST_TRIGGERS=y
 # CONFIG_FTRACE_SORT_STARTUP_TEST is not set
 # CONFIG_RING_BUFFER_STARTUP_TEST is not set
 # CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set
+# CONFIG_RING_BUFFER_PERSISTENT_INJECT is not set
 # CONFIG_MMIOTRACE_TEST is not set
 # CONFIG_PREEMPTIRQ_DELAY_TEST is not set
 # CONFIG_SYNTH_EVENT_GEN_TEST is not set