Bug#1114773: linux-image-6.1.0-39-amd64: Kernel panic when booting with kernel commandline parameter fips=1

Path	csiph.com!pasdenom.info!weretis.net!feeder8.news.weretis.net!srl.newsdeef.eu!news.corradoroberto.it!gothmog.csi.it!bofh.it!news.nic.it!robomod
From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#1114773: linux-image-6.1.0-39-amd64: Kernel panic when booting with kernel commandline parameter fips=1
Date	Tue, 09 Sep 2025 22:10:01 +0200
Message-ID	<LtcP7-e6X2-3@gated-at.bofh.it> (permalink)
References	<LtcP7-e6X2-5@gated-at.bofh.it> <LtcP7-e6X2-5@gated-at.bofh.it>
X-Mailbox-Line	From debian-bugs-dist-request@lists.debian.org Tue Sep 9 20:05:08 2025
Old-Return-Path	<debbugs@buxtehude.debian.org>
X-Spam-Flag	NO
X-Spam-Score	-1.899
Reply-To	Ben Hutchings <ben@decadent.org.uk>, 1114773@bugs.debian.org
Resent-To	debian-bugs-dist@lists.debian.org
Resent-Cc	debian-kernel@lists.debian.org
X-Debian-Pr-Message	followup 1114773
X-Debian-Pr-Package	src:linux
X-Debian-Pr-Source	linux
Content-Type	multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-arVKHN5XR0W2tS0N91m8"
User-Agent	Evolution 3.56.2-2+b1
MIME-Version	1.0
X-Sa-Exim-Connect-IP	2a02:578:851f:1502:391e:c5f5:10e2:b9a3
X-Sa-Exim-Mail-From	ben@decadent.org.uk
X-Sa-Exim-Scanned	No (on maynard); SAEximRunCond expanded to false
X-Debian-Message	from BTS
X-Mailing-List	<debian-bugs-dist@lists.debian.org> archive/latest/1924108
List-ID	<debian-bugs-dist.lists.debian.org>
List-URL	<https://lists.debian.org/debian-bugs-dist/>
Approved	robomod@news.nic.it
Lines	69
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Tue, 09 Sep 2025 22:02:31 +0200
X-Original-Message-ID	<b00c0b4d89b81a79df36e2317133cb52d405833e.camel@decadent.org.uk>
X-Original-References	<b38f8c56-aa04-4c2b-9004-952c68118584@yahoo.com> <b38f8c56-aa04-4c2b-9004-952c68118584@yahoo.com>
Xref	csiph.com linux.debian.bugs.dist:1260752 linux.debian.kernel:89150

Cross-posted to 2 groups.

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

Control: tag -1 confirmed

On Tue, 2025-09-09 at 19:46 +0200, Bavarian Developer wrote:
>  
> 
> Package: src:linux
>  Version: 6.1.148-1
>  Severity: important
>  
> 
>  Dear Maintainer,
>  
> 
>  when booting the a complete vanilla installation of Debian 12.12 (installed from the released CD image) in Virtualbox, there is an immediate kernel panic.
>  
> 
>  The error message is as follows:
>  
> 
>  Kernel panic - not syncing: Module crc32_intel signature verification failed in FIPS mode
>  
> 
>  The commit history shows changes of kernel module signing.
[...]

This may have been triggered by the switch from RSA to ECDSA signatures
for modules.  We could easily revert that if necessary.

I've checked and found that this doesn't happen with the 6.12 kernel
where we also use ECDSA signatures.  There have been changes to the
crypto core that added self-tests and allow-listing of ECDSA in FIPS
mode.  But I think it would be safer to switch back to RSA here.

Ben.

-- 
Ben Hutchings
Every program is either trivial or else contains at least one bug

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1114773: linux-image-6.1.0-39-amd64: Kernel panic when booting with kernel commandline parameter fips=1 Ben Hutchings <ben@decadent.org.uk> - 2025-09-09 22:10 +0200
  Processed: Re: Bug#1114773: linux-image-6.1.0-39-amd64: Kernel  panic when booting with kernel commandline parameter fips=1 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-09-09 22:10 +0200

csiph-web