[aliencaocao]

What is graded

• linuxOpenvswitchNestedActions: CVE-2026-64531 (Open vSwitch nested actions)
• linuxCgroupWriteback: CVE-2026-64378 (cgroup writeback)

Both are tracked for Ubuntu 22.04 (ubuntuJammy, linux 5.15) and 24.04 (ubuntuNoble, linux 6.8). Only generic / generic-64k kernels from the GA linux source package are graded; HWE, cloud, and vendor flavors are not applicable.

Changes

• Generator (cmax/minimum_refresh.py): new UBUNTU_KERNEL_CVE_PACKAGES specs, added to Noble and Jammy, with abi and allowUnfixed. verify() accepts a needed/pending tracker state for these entries (that state is the finding), rejects unknown states, and rejects a released fix that disappears.
• Grader (audit-common.sh): grade_ubuntu_kernel_cves compares the running ABI with each released fixed ABI, fails on needed/pending, applies the standard bulletin grace period, and reports unknown when the table lacks the rows. Wired into the standalone/Slurm host JSON and the k8s host-probe JSON as security.guestKernel.{ubuntuCveStatus,ubuntuVulnerableCves,ubuntuCveGracePeriods}.
• Findings: new security.guestKernel.ubuntuCveStatus VERSION rule that names only the vulnerable CVEs; criteria link and pass text added.
• Security CLI: the guest-kernel check goes CRITICAL on tracker failure, WARNING when the tracker state is unknown, and PASS under an active grace period, with Ubuntu-specific title, remediation, and references.
• Committed table: the four new entries were fetched live from the Ubuntu tracker and merged (the full refresh hit the GitHub API rate limit here, so the rest of the table is unchanged; the next daily refresh regenerates everything). Current state: Noble has both fixes released (6.8.0-138.138, 6.8.0-147.147); Jammy has the OVS fix (5.15.0-190.200) but cgroup writeback is still needed, so Jammy GA kernels will fail that CVE until Ubuntu ships a fix.

Tests

pytest -n 8 tests: 2211 passed. New coverage for generator output and verify rules, shell grading (fail, pass, grace, unknown, not-applicable flavors), findings, and the security CLI.

Created with Perplexity Computer on behalf of @aliencaocao