Stable Branch fix cmsec dist_tag_compatible cross-minor false indeterminate in 132.…

fix cmsec dist_tag_compatible cross-minor false indeterminate in 132.00stable

On hosts running a newer EL minor update stream than the hardcoded baseline
(e.g. el9_8 vs el9_7 baseline, el10_2 vs el10_1 baseline), dist_tag_compatible()
rejected the comparison as "refused-cross-vendor", and the RPM changelog fallback
also failed because newer-stream packages have their own changelogs. All 4 CVEs
reported "status indeterminate" even though ver_ge() would have correctly found
the running kernel above the baseline.

Changes:
- Add same-EL-major cross-minor fallback at the end of dist_tag_compatible() in
all 5 check scripts: extract the EL major prefix (.el9, .el10, etc.) from both
normalised tags; if they match and share the same CloudLinux (.lve) prefix,
declare compatible and let ver_ge() decide the direction via sort -V
- Include (h)? in the major-extraction regex to preserve the CL7h suffix,
keeping .lve.el7h incompatible with .lve.el7 (adversarial review P1 fix)
- Verified on AlmaLinux 9.8 (el9_8 kernel), Rocky Linux 9.8 (el9_8 kernel),
and AlmaLinux 10.2 (el10_2 kernel): all 4 affected CVEs now show PATCHED;
CVE-2026-43500 remains NOT AFFECTED on default installs

Continue reading...

---

132.00stable branch

• Branch: https://github.com/centminmod/centminmod/tree/132.00stable
• Commit History: https://github.com/centminmod/centminmod/commits/132.00stable