Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 7.3.pf3 to 7.3.pf4. There are no changes to source URLs, checksums, build logic, dependencies, install scripts, or packaging permissions. On its face this is a routine metadata update with no security-relevant behavior introduced by the diff shown.

@@ -1,6 +1,6 @@
 pkgbase = linux-pf
 	pkgdesc = pf-kernel
-	pkgver = 7.3.pf3
+	pkgver = 7.3.pf4
 	pkgrel = 1
 	url = https://pfkernel.natalenko.name
 	arch = x86_64

Comment

The change is a straightforward source/version bump in .SRCINFO: pkgver advances from 7.3.pf3 to 7.3.pf4 and the upstream tarball hash is updated accordingly. The source remains an HTTPS URL on the project’s Codeberg repository, with no new build-time commands, scripts, or additional sources introduced. I do not see any supply-chain red flags in this diff alone.

@@ -26,10 +26,10 @@ pkgbase = linux-pf
 	makedepends = zstd
 	options = !debug
 	options = !strip
-	source = https://codeberg.org/pf-kernel/linux/archive/58cd6df377ace364afcfb06ad2d221ac926987ed.tar.gz
+	source = https://codeberg.org/pf-kernel/linux/archive/5210f1119480203a93eedaebf006d5f51cae9216.tar.gz
 	source = config
 	b2sums = SKIP
-	b2sums = b1ee917dfb3a8844bc084826218bbe5077ac8d0e19e10ac525d449fb5dc239849573af98ae65809dcdf5db3aeac8e36e37c7f8fb83e83d0b3cf0734ee9e82c29
+	b2sums = fc354277e8c6d4b7ce8400c3302e9dd822b11aa4f23d5ad08eb0bfc438b08f8dc4fe930f724301b7f841eec3a18ce6298b9bf6f9dbd6c7db16663d16e3fb2532
 
 pkgname = linux-pf
 	pkgdesc = The pf-kernel and modules

Comment

The change is a routine upstream version bump for a kernel package: it updates the pinned commit, pkgver, and matching B2 checksum for the upstream tarball. The source remains an HTTPS Codeberg archive, there are no new build-time downloads, scripts, privilege changes, or packaging behavior changes in the diff. No security red flags are introduced by this hunk.

@@ -3,8 +3,8 @@
 pkgbase="linux-pf"
 _suffix=""
 pkgname=(${pkgbase}${_suffix} ${pkgbase}-headers${_suffix})
-_rev=58cd6df377ace364afcfb06ad2d221ac926987ed
-pkgver=7.3.pf3
+_rev=5210f1119480203a93eedaebf006d5f51cae9216
+pkgver=7.3.pf4
 pkgrel=1
 pkgdesc="pf-kernel"
 arch=(x86_64)

Comment

The change only updates the pinned upstream revision and its corresponding b2 checksum for the kernel source tarball. The source remains an HTTPS Codeberg archive, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in this diff. Based on the provided hunk, this is a routine version bump with integrity metadata updated accordingly.

@@ -15,7 +15,7 @@ options=(!debug !strip)
 source=(https://codeberg.org/pf-kernel/linux/archive/${_rev}.tar.gz
 		config)
 b2sums=(SKIP
-		'b1ee917dfb3a8844bc084826218bbe5077ac8d0e19e10ac525d449fb5dc239849573af98ae65809dcdf5db3aeac8e36e37c7f8fb83e83d0b3cf0734ee9e82c29')
+		'fc354277e8c6d4b7ce8400c3302e9dd822b11aa4f23d5ad08eb0bfc438b08f8dc4fe930f724301b7f841eec3a18ce6298b9bf6f9dbd6c7db16663d16e3fb2532')
 
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=${pkgbase}

Comment

The change is a one-line version bump in the generated kernel config banner from pf3 to pf4. No build logic, source URLs, scripts, permissions, or packaging behavior changed, and there are no security-relevant modifications visible in this hunk. Based on the provided diff alone, this is low risk.

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 7.3.0-pf3 Kernel Configuration
+# Linux/x86 7.3.0-pf4 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.2.1 20260810"
 CONFIG_CC_IS_GCC=y

Comment

The change only bumps the recorded Rust toolchain/LLVM version constants in the kernel config metadata (rustc 1.109.801 -> 1.109.900 and LLVM 22 -> 23). This is a build-compatibility update, not an execution-path change, and it does not introduce new sources, scripts, network fetches, privilege changes, or packaging behavior. No security red flags are present in this hunk.

@@ -11,10 +11,10 @@ CONFIG_AS_VERSION=24700
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=24700
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=109801
+CONFIG_RUSTC_VERSION=109900
 CONFIG_RUST_IS_AVAILABLE=y
-CONFIG_RUSTC_LLVM_VERSION=220108
-CONFIG_RUSTC_LLVM_MAJOR_VERSION=22
+CONFIG_RUSTC_LLVM_VERSION=230101
+CONFIG_RUSTC_LLVM_MAJOR_VERSION=23
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
 CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y

Comment

The change only adds a kernel build configuration flag setting CONFIG_CC_OPT_INLINE_MEMSET to "-finline-stringops=memset". This is a compile-time optimization option, not a packaging or runtime behavior change, and it does not introduce network access, privilege escalation, persistence, or external code execution. No suspicious sources or scripts are involved in this hunk. Low risk.

@@ -25,6 +25,7 @@ CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_CC_HAS_COUNTED_BY=y
 CONFIG_CC_HAS_COUNTED_BY_PTR=y
 CONFIG_CC_HAS_MULTIDIMENSIONAL_NONSTRING=y
+CONFIG_CC_OPT_INLINE_MEMSET="-finline-stringops=memset"
 CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY=y
 CONFIG_RUSTC_HAS_SPAN_FILE=y
 CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES=y

Comment

The change is limited to kernel config metadata and a few feature toggles. I do not see any supply-chain red flags, code execution, privilege escalation, or packaging-time network activity. The notable functional change is enabling CONFIG_SWIOTLB_DYNAMIC, which affects kernel memory/DMA behavior but is a legitimate kernel configuration choice rather than an obvious security issue in this context. The Rust version text and related version numbers are informational/config consistency updates only.

@@ -347,7 +348,7 @@ CONFIG_PERF_EVENTS=y
 CONFIG_SYSTEM_DATA_VERIFICATION=y
 CONFIG_PROFILING=y
 CONFIG_RUST=y
-CONFIG_RUSTC_VERSION_TEXT="rustc 1.98.1 (48a229cea 2026-09-01) (Arch Linux rust 1:1.98.1-1)"
+CONFIG_RUSTC_VERSION_TEXT="rustc 1.99.0 (b940084d7 2026-09-28) (Arch Linux rust 1:1.99.0-1)"
 CONFIG_BINDGEN_VERSION_TEXT="bindgen 0.73.2"
 CONFIG_TRACEPOINTS=y
 

Comment

The change only enables CONFIG_SWIOTLB_DYNAMIC in the kernel config. This is a kernel build-time feature toggle, not a packaging script or install-time action, and it does not introduce network access, privilege escalation, persistence, or embedded binaries. I did not find any security-relevant red flags in this isolated diff hunk.

@@ -12303,7 +12304,7 @@ CONFIG_ARCH_DMA_ADDR_T_64BIT=y
 CONFIG_ARCH_HAS_FORCE_DMA_UNENCRYPTED=y
 CONFIG_SWIOTLB=y
 CONFIG_SWIOTLB_DEFAULT_SIZE_MB=64
-# CONFIG_SWIOTLB_DYNAMIC is not set
+CONFIG_SWIOTLB_DYNAMIC=y
 CONFIG_DMA_NEED_SYNC=y
 CONFIG_DMA_COHERENT_POOL=y
 CONFIG_DMA_CMA=y