Path: csiph.com!pasdenom.info!weretis.net!feeder8.news.weretis.net!srl.newsdeef.eu!news.corradoroberto.it!gothmog.csi.it!bofh.it!news.nic.it!robomod From: Ben Hutchings Newsgroups: linux.debian.bugs.dist,linux.debian.kernel Subject: Bug#1114773: linux-image-6.1.0-39-amd64: Kernel panic when booting with kernel commandline parameter fips=1 Date: Tue, 09 Sep 2025 22:10:01 +0200 Message-ID: References: X-Mailbox-Line: From debian-bugs-dist-request@lists.debian.org Tue Sep 9 20:05:08 2025 Old-Return-Path: X-Spam-Flag: NO X-Spam-Score: -1.899 Reply-To: Ben Hutchings , 1114773@bugs.debian.org Resent-To: debian-bugs-dist@lists.debian.org Resent-Cc: debian-kernel@lists.debian.org X-Debian-Pr-Message: followup 1114773 X-Debian-Pr-Package: src:linux X-Debian-Pr-Source: linux Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-arVKHN5XR0W2tS0N91m8" User-Agent: Evolution 3.56.2-2+b1 MIME-Version: 1.0 X-Sa-Exim-Connect-IP: 2a02:578:851f:1502:391e:c5f5:10e2:b9a3 X-Sa-Exim-Mail-From: ben@decadent.org.uk X-Sa-Exim-Scanned: No (on maynard); SAEximRunCond expanded to false X-Debian-Message: from BTS X-Mailing-List: archive/latest/1924108 List-ID: List-URL: Approved: robomod@news.nic.it Lines: 69 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Tue, 09 Sep 2025 22:02:31 +0200 X-Original-Message-ID: X-Original-References: Xref: csiph.com linux.debian.bugs.dist:1260752 linux.debian.kernel:89150 --=-arVKHN5XR0W2tS0N91m8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Control: tag -1 confirmed On Tue, 2025-09-09 at 19:46 +0200, Bavarian Developer wrote: > =C2=A0 >=20 > Package: src:linux > =C2=A0Version: 6.1.148-1 > =C2=A0Severity: important > =C2=A0 >=20 > =C2=A0Dear Maintainer, > =C2=A0 >=20 > =C2=A0when booting the a complete vanilla installation of Debian 12.12 (i= nstalled from the released CD image) in Virtualbox, there is an immediate k= ernel panic. > =C2=A0 >=20 > =C2=A0The error message is as follows: > =C2=A0 >=20 > =C2=A0Kernel panic - not syncing: Module crc32_intel signature verificati= on failed in FIPS mode > =C2=A0 >=20 > =C2=A0The commit history shows changes of kernel module signing. [...] This may have been triggered by the switch from RSA to ECDSA signatures for modules. We could easily revert that if necessary. I've checked and found that this doesn't happen with the 6.12 kernel where we also use ECDSA signatures. There have been changes to the crypto core that added self-tests and allow-listing of ECDSA in FIPS mode. But I think it would be safer to switch back to RSA here. Ben. --=20 Ben Hutchings Every program is either trivial or else contains at least one bug --=-arVKHN5XR0W2tS0N91m8 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmjAh9cACgkQ57/I7JWG EQlqRg//ffaHZdXEk4+JoplSxVOcuU4rC2KhQHJ2KNTDdK0gRRF3GD95Vr5X7oRM +xUo1ATf8q5PGIw5+X5voKsrpo0/Noi7CbimJioqYNLwGRJc1sBX/ALYs+2KywwR ktbuCeuXofFqRMIvMeuLz7OIHwOzPvNIdiDsY/16gtIz1S4soUt4yWS0FxperNY1 MZ18Yxs2kWuSCi8Py31hIaiGGDGpyxSHsJJ1hwXnO5SQI66vfYpEuXJDapVuhVn5 Q17vNR3uvZao2Y9//R6DsBcs1XfK2zOiBz9t9BfaRoKRfUnnx2Pkoc7ehFTelFFh Fz2YVhBY1Z8a2MuGY/LZ3q2zBEugsm64Ii5f/vvhZirXl2NZNePx3+K5FvtErr/T Vggsqhj8r3LO9+njRn3SPSmBZQF/+Ey66r0OSQlVV8icSjxwewQY2jrU/AyoGsnt HEXsFQ0X1QEtVSOzDWZmocxrQ7dDLDkGrzQ4M/nZnCnyesD+yKo5YfyoUD42dF/Q DC23JrChFCY8UEpXPIh1/1DfJUAlxTQGvw4Y5X7FVf/gDCOkW+UuvVqQ1d6RSBj0 3bPT81iTW68N0lnS3MS2u9Sllo3uVZW/GLTpMfxrkY79bI3SaVJ0p7n0a4zDMT39 C8bqj6m+2eSZBvKyvgUpFjU8gJXmdNxrY8zDLyaiVLe7t0SDhZI= =Okxn -----END PGP SIGNATURE----- --=-arVKHN5XR0W2tS0N91m8--