Change: Disable in Kernel Crypto Userspace API (Phase 1)

amoloney commented

2026-08-03 13:22:06 +00:00

Owner

The in kernel Crypto Userspace API (CRYPTO_USER_API) is now deprecated upstream, with some parts of it being actively removed early in the 7.2 cycle, because of the security risk it contains. It is due to be disabled and actively removed from upstream in the near future. Restrict it's use in Fedora to known active users early so we can do a controlled ending of support and can make the community aware of it's pending disappearance and gracefully deal with unknown users.

Owners, do not implement this work until the FESCo vote has explicitly ended.
When a FESCo member has marked this ticket as APPROVED, you may proceed with the implementation. See the FESCo ticket policy and the Changes policy for more information.
If no decision has been rendered after 7 days from the filing of this ticket and no indication (such as a -1 vote) that this will be taken up at a FESCo meeting, please feel free to ping for a status update.

REMINDER: This ticket is for FESCo members to vote on the proposal. Further discussion should happen in the Discourse discussion linked above. Additional discussion may happen on the Fedora Devel mailing list.

The in kernel Crypto Userspace API (CRYPTO_USER_API) is now deprecated upstream, with some parts of it being actively removed early in the 7.2 cycle, because of the security risk it contains. It is due to be disabled and actively removed from upstream in the near future. Restrict it's use in Fedora to known active users early so we can do a controlled ending of support and can make the community aware of it's pending disappearance and gracefully deal with unknown users. * [Change proposal](https://fedoraproject.org/wiki/Changes/Disable_CRYPTO_USER_API) * [devel post](https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/M3ECRVV6QCPPTGXPENPMTGCBWWW2Q3ZS/) * [Discourse discussion](https://discussion.fedoraproject.org/t/f45-change-proposal-disable-in-kernel-crypto-userspace-api-phase-1-self-contained/197422) * Owners: @pbrobinson @jforbes **Owners, do not implement this work until the FESCo vote has explicitly ended.** When a FESCo member has marked this ticket as APPROVED, you may proceed with the implementation. See the [FESCo ticket policy](https://docs.fedoraproject.org/en-US/fesco/#_ticket_policy) and the [Changes policy](https://docs.fedoraproject.org/en-US/program_management/changes_policy/) for more information. If no decision has been rendered after 7 days from the filing of this ticket and no indication (such as a -1 vote) that this will be taken up at a FESCo meeting, please feel free to ping for a status update. **REMINDER**: This ticket is for FESCo members to vote on the proposal. Further discussion should happen in the Discourse discussion linked above. Additional discussion may happen on the [Fedora Devel](https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/) mailing list.

amoloney added this to the Fedora Linux 45 milestone

2026-08-03 13:22:06 +00:00

amoloney added the

self contained change

label

2026-08-03 13:22:06 +00:00

amoloney commented

2026-08-03 13:22:21 +00:00

Author

Owner

Cc @pbrobinson @jforbes

decathorpe added the

vote-in-progress

label

2026-08-03 16:15:25 +00:00

kevin commented

2026-08-03 16:51:29 +00:00

Owner

+1

pbrobinson commented

2026-08-06 12:46:34 +00:00

Note: the changes we are putting in here will land in the 7.3 kernel, F-45 will ship GA with the 7.2 kernel, but 7.3 will likely land shortly after GA, this allows testing and advertising of the change so there is awareness. It's likely not nice for users to install F-45 to discover something breaks shortly afterwards.

ngompa commented

2026-08-06 14:23:50 +00:00

Owner

+1

ngompa commented

2026-08-06 14:24:06 +00:00

Owner

@pbrobinson wrote in #3667 (comment):

Note: the changes we are putting in here will land in the 7.3 kernel, F-45 will ship GA with the 7.2 kernel, but 7.3 will likely land shortly after GA, this allows testing and advertising of the change so there is awareness. It's likely not nice for users to install F-45 to discover something breaks shortly afterwards.

It may be worth preempting this and doing it early in 7.2.

@pbrobinson wrote in https://forge.fedoraproject.org/fesco/tickets/issues/3667#issuecomment-1261859: > Note: the changes we are putting in here will land in the 7.3 kernel, F-45 will ship GA with the 7.2 kernel, but 7.3 will likely land shortly after GA, this allows testing and advertising of the change so there is awareness. It's likely not nice for users to install F-45 to discover something breaks shortly afterwards. It may be worth preempting this and doing it early in 7.2.

decathorpe commented

2026-08-06 15:41:23 +00:00

Owner

So, to clarify, is change going to trickle down into F44 and F43 too when they get the 7.3 kernel update?

pbrobinson commented

2026-08-06 16:11:26 +00:00

@ngompa wrote in #3667 (comment):

@pbrobinson wrote in #3667 (comment):

Note: the changes we are putting in here will land in the 7.3 kernel, F-45 will ship GA with the 7.2 kernel, but 7.3 will likely land shortly after GA, this allows testing and advertising of the change so there is awareness. It's likely not nice for users to install F-45 to discover something breaks shortly afterwards.

It may be worth preempting this and doing it early in 7.2.

That is the whole point of this proposal.

@ngompa wrote in https://forge.fedoraproject.org/fesco/tickets/issues/3667#issuecomment-1261910: > @pbrobinson wrote in #3667 (comment): > > > Note: the changes we are putting in here will land in the 7.3 kernel, F-45 will ship GA with the 7.2 kernel, but 7.3 will likely land shortly after GA, this allows testing and advertising of the change so there is awareness. It's likely not nice for users to install F-45 to discover something breaks shortly afterwards. > > It may be worth preempting this and doing it early in 7.2. That is the whole point of this proposal.

gotmax23 commented

2026-08-10 03:33:18 +00:00

Owner

@decathorpe wrote in #3667 (comment):

So, to clarify, is change going to trickle down into F44 and F43 too when they get the 7.3 kernel update?

@pbrobinson @jforbes, can you please clarify here?

@decathorpe wrote in https://forge.fedoraproject.org/fesco/tickets/issues/3667#issuecomment-1261946: > So, to clarify, is change going to trickle down into F44 and F43 too when they get the 7.3 kernel update? @pbrobinson @jforbes, can you please clarify here?

gotmax23 commented

2026-08-10 03:34:12 +00:00

Owner

Re. approving this Change for f45: +1

Re. approving this Change for f45: **+1**

jforbes commented

2026-08-10 05:36:05 +00:00

@decathorpe wrote in #3667 (comment):

So, to clarify, is change going to trickle down into F44 and F43 too when they get the 7.3 kernel update?

It will not. we have a mechanism to revert the patches for specific Fedora versions.

@decathorpe wrote in https://forge.fedoraproject.org/fesco/tickets/issues/3667#issuecomment-1261946: > So, to clarify, is change going to trickle down into F44 and F43 too when they get the 7.3 kernel update? It will not. we have a mechanism to revert the patches for specific Fedora versions.

👍 1