Tuxcare Errata System 0.0.1 5.10 2026-08-28T12:00:38 Debian 11 * TuxCare ELS build of the Debian 11 (bullseye) 5.10.262 kernel (x86_64/aarch64/armel). * Reconstructed on the newer bullseye-security 5.10.262-1 base (rolls up upstream stable 5.10.260 / .261 / .262), replacing the prior 5.10.259-1 base. Debian patch set re-imported as git commits (ip6_vti patch dropped — now upstream; firmware log-message patch refreshed). * Single-source: embed the linux-latest + linux-signed meta packages into the source tree (debian/meta/) so one dpkg-buildpackage run produces the versioned kernel AND the meta/signed packages. * ABI: this ELS changelog entry increments the gencontrol-computed abiname 5.10.0-46 -> 5.10.0-47, so the ELS kernel ships as linux-image-5.10.0-47-*, a distinct, co-installable package vs Debian stock 5.10.0-46. * Disable the rt and cloud featuresets/flavours (not shipped by ELS). * Fix the duplicate pinned image/headers meta on signed arches under disable-signed: gate the pinned-meta emission on raw signed-code so only the embed's fallback meta (linux-image-5.10.0-47-amd64 | ...-unsigned) ships. * Backport security fixes for potentially-exploited (KCARE 0/1-day) CVEs: CVE-2026-46113 (KVM x86 shadow-paging UAF, unexpected GFN/role), CVE-2026-64561 (KVM x86: check obsolete root after making MMU pages available), CVE-2026-64564 (SCTP ASCONF DEL-IP transport use-after-free), CVE-2026-64600 (XFS: resample data-fork mapping after cycling ILOCK). * Drop the prior CVE-2026-43499 (rtmutex remove_waiter UAF) and CVE-2026-46331 (net/sched pedit partial-COW) backports — both are included upstream in the 5.10.260 / .261 / .262 stable roll-up. Important TuxCare License Agreement CVE-2026-64561 CVE-2026-64600 CVE-2026-64564 CVE-2026-46113 /etc/els-release Debian 11 LTS \(ELS by TuxCare\) 1 bpftool hyperv-daemons libcpupower-dev libcpupower1 linux-compiler-gcc-10-x86 linux-config-5.10 linux-cpupower linux-doc linux-doc-5.10 linux-headers-5.10.0-47-amd64 linux-headers-5.10.0-47-common linux-headers-amd64 linux-image-5.10.0-47-amd64-unsigned linux-image-amd64 linux-image-amd64-signed-template linux-kbuild-5.10 linux-libc-dev linux-perf linux-perf-5.10 linux-source linux-source-5.10 linux-support-5.10.0-47 (^5\.10\.0\-(?:\d{3,}|[5-9]\d|4[7-9])(?:\-tuxcare\.els\d+)?\-\w*$) amd64 0:5.10.262-1+tuxcare.els1 0:5.10.262-1+tuxcare.els1