Opt-in Linux 6.17 Kernel for Proxmox VE 9 available on test & no-subscription

[ppyy]

i upgrade three nodes pve to 6.17.2-1-pve, reboot and failed.

all nodes are Dell R630，all are failed to boot new kernel.

i should boot 6.14.11-4-pve to recover.



$ lscpu
Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Address sizes: 46 bits physical, 48 bits virtual
Byte Order: Little Endian
CPU(s): 72
On-line CPU(s) list: 0-71
Vendor ID: GenuineIntel
Model name: Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz
CPU family: 6
Model: 79
Thread(s) per core: 2
Core(s) per socket: 18
Socket(s): 2
Stepping: 1
CPU(s) scaling MHz: 91%
CPU max MHz: 3000.0000
CPU min MHz: 1200.0000
BogoMIPS: 4600.04
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall n
x pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64
monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xs
ave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l3 cdp_l3 pti ssbd ibrs ibpb stibp tpr_shadow flexpriority ept
vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdt_a rdseed adx smap intel_pt xsaveopt cqm_llc cqm_
occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts vnmi md_clear flush_l1d
Virtualization features:
Virtualization: VT-x
Caches (sum of all):
L1d: 1.1 MiB (36 instances)
L1i: 1.1 MiB (36 instances)
L2: 9 MiB (36 instances)
L3: 90 MiB (2 instances)
NUMA:
NUMA node(s): 2
NUMA node0 CPU(s): 0,2,4,6,8,10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40,42,44,46,48,50,52,54,56,58,60,62,64,66,68,70
NUMA node1 CPU(s): 1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,31,33,35,37,39,41,43,45,47,49,51,53,55,57,59,61,63,65,67,69,71
Vulnerabilities:
Gather data sampling: Not affected
Ghostwrite: Not affected
Indirect target selection: Not affected
Itlb multihit: KVM: Mitigation: Split huge pages
L1tf: Mitigation; PTE Inversion; VMX conditional cache flushes, SMT vulnerable
Mds: Mitigation; Clear CPU buffers; SMT vulnerable
Meltdown: Mitigation; PTI
Mmio stale data: Mitigation; Clear CPU buffers; SMT vulnerable
Reg file data sampling: Not affected
Retbleed: Not affected
Spec rstack overflow: Not affected
Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl
Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Spectre v2: Mitigation; Retpolines; IBPB conditional; IBRS_FW; STIBP conditional; RSB filling; PBRSB-eIBRS Not affected; BHI Not affected
Srbds: Not affected
Tsa: Not affected
Tsx async abort: Mitigation; Clear CPU buffers; SMT vulnerable
Vmscape: Mitigation; IBPB before exit to userspace


92 | 11/18/2025 | 06:01:15 PM CST | Unknown Additional Info | | Asserted
93 | 11/18/2025 | 06:01:15 PM CST | Processor CPU Machine Chk | Transition to Non-recoverable | Asserted
94 | 11/18/2025 | 06:01:15 PM CST | Unknown MSR Info Log | | Asserted

 

[gfngfn256]

i upgrade three nodes pve to 6.17.2-1-pve

You did this with the regular update, dist-upgrade on the no-subscription repo?
I also see that the proxmox-kernel-6.17 as in 6.17.2-1 is available for update. I guess 6.17 is now becoming the default kernel? something I noticed, that unlike the usual kernel updates, no edk, security version etc. is offered. Weird? I'm not sure.

 

[t.lamprecht]

I also see that the proxmox-kernel-6.17 as in 6.17.2-1 is available for update. I guess 6.17 is now becoming the default kernel? something I noticed, that unlike the usual kernel updates, no edk, security version etc. is offered. Weird? I'm not sure.

Yes, it's getting rolled out:

EDIT: 6.17 is getting rolled out as new default kernel since mid-November.

unlike the usual kernel updates, no edk, security version etc. is offered

What do you mean here? The EFI signed kernel variants like proxmox-kernel-6.17.2-1-pve-signed are available and the default.
We never released newer edk2 package for a kernel upgrade, as the edk2 package ships the EFI/OVMF firmware for virtual machines, not the host.

 

[t.lamprecht]

92 | 11/18/2025 | 06:01:15 PM CST | Unknown Additional Info | | Asserted
93 | 11/18/2025 | 06:01:15 PM CST | Processor CPU Machine Chk | Transition to Non-recoverable | Asserted
94 | 11/18/2025 | 06:01:15 PM CST | Unknown MSR Info Log | | Asserted

The error in the screenshot comes from EFI/firmware. Are you sure that the "signed" variant of the 6.17 kernel is installed?

 

[gfngfn256]

proxmox-kernel-6.17.2-1-pve-signed are available and the default

My point exactly. My updates are not showing that as available (as they usually do on a kernel update). I suspect that this is linked to:

The error in the screenshot comes from EFI/firmware. Are you sure that the "signed" variant of the 6.17 kernel is installed?

We never released newer edk2 package for a kernel upgrade, as the edk2 package ships the EFI/OVMF firmware for virtual machines, not the host.

Accepted.

 

[gfngfn256]

My updates are not showing that as available (as they usually do on a kernel update). I suspect that this is linked to:

However I tried the following which does show it:

~# apt-get dist-upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following package was automatically installed and is no longer required:
  proxmox-rrd-migration-tool
Use 'apt autoremove' to remove it.
The following NEW packages will be installed:
  aardvark-dns containernetworking-plugins golang-github-containers-common
  golang-github-containers-image netavark proxmox-kernel-6.17
  proxmox-kernel-6.17.2-1-pve-signed skopeo
The following packages will be upgraded:
  libpve-network-api-perl libpve-network-perl libpve-storage-perl
  proxmox-default-kernel proxmox-firewall proxmox-widget-toolkit pve-container
  pve-docs pve-ha-manager pve-i18n pve-manager pve-qemu-kvm
  pve-yew-mobile-i18n qemu-server
14 upgraded, 8 newly installed, 0 to remove and 0 not upgraded.
Need to get 197 MB of archives.
After this operation, 1,095 MB of additional disk space will be used.
Do you want to continue? [Y/n]

So I guess, something just changed on this update that does not show it in the regular GUI etc.

Safe to upgrade?

 

[ppyy]

Yes, it's getting rolled out:





What do you mean here? The EFI signed kernel variants like proxmox-kernel-6.17.2-1-pve-signed are available and the default.
We never released newer edk2 package for a kernel upgrade, as the edk2 package ships the EFI/OVMF firmware for virtual machines, not the host.

$ dpkg -l|grep proxmox-kernel-6.17
ii proxmox-kernel-6.17 6.17.2-1 all Latest Proxmox Kernel Image
ii proxmox-kernel-6.17.2-1-pve-signed 6.17.2-1 amd64 Proxmox Kernel Image (signed)

 

[ppyy]

we have several PVE cluster. the dell R630 cluster failed to boot with CPU error, and dell R640 cluster works with proxmox-kernel-6.17.2-1-pve-signed

 

[Weltherrscher]

dkms fails to build modules for nvidia vGPU 16.12 drivers (535.274.03, for old M60 GPU):

nvidia-vgpu-vfio/nvidia-vgpu-vfio.c: In function ‘vgpu_msix_set_vector_signal’:
nvidia-vgpu-vfio/nvidia-vgpu-vfio.c:3259:50: error: ‘struct irq_bypass_producer’ has no member named ‘token’
 3259 |         vgpu_dev->intr_info.msix[vector].producer.token = NULL;
      |                                                  ^
nvidia-vgpu-vfio/nvidia-vgpu-vfio.c:3283:46: error: ‘struct irq_bypass_producer’ has no member named ‘token’
 3283 |     vgpu_dev->intr_info.msix[vector].producer.token = trigger;
      |                                              ^
nvidia-vgpu-vfio/nvidia-vgpu-vfio.c:3289:15: error: too few arguments to function ‘irq_bypass_register_producer’
 3289 |         ret = irq_bypass_register_producer(&vgpu_dev->intr_info.msix[vector].producer);
      |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /usr/src/linux-headers-6.17.2-1-pve/include/linux/kvm_host.h:27,
                 from nvidia-vgpu-vfio/nvidia-vgpu-vfio.c:26:
/usr/src/linux-headers-6.17.2-1-pve/include/linux/irqbypass.h:86:5: note: declared here
   86 | int irq_bypass_register_producer(struct irq_bypass_producer *producer,
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
nvidia-vgpu-vfio/nvidia-vgpu-vfio.c:3294:54: error: ‘struct irq_bypass_producer’ has no member named ‘token’
 3294 |             vgpu_dev->intr_info.msix[vector].producer.token = NULL;
      |                                                      ^
nvidia-vgpu-vfio/nvidia-vgpu-vfio.c: In function ‘vgpu_msix_disable’:
nvidia-vgpu-vfio/nvidia-vgpu-vfio.c:3323:53: error: ‘struct irq_bypass_producer’ has no member named ‘token’
 3323 |                 vgpu_dev->intr_info.msix[i].producer.token = NULL;
      |                                                     ^

 

[t.lamprecht]

dkms fails to build modules for nvidia vGPU 16.12 drivers (535.274.03, for old M60 GPU):

Yeah, NIVIDIA did not yet manage to release a driver that's compatible with newer kernel yet.

For now, I added a known issue entry in the initial post here:

NVIDIA vGPU drivers currently do not support the 6.17 kernel. If you use NVIDIA vGPU you should keep using the 6.14 kernel until further notice.

 

[TheD0Do]

Today, I performed the update via the Proxmox web interface and then rebooted the server. After the reboot, Proxmox failed to boot. This concerns a Dell R730xd server. I had to boot into kernel 6.14.11-4-pve and pin the old kernel using the following command: proxmox-boot-tool kernel pin 6.14.11-4-pve
Is this issue already known?

The image shows the console shortly before Proxmox crashes:


Here are some more images:






---

root@pve-stm-prod-01:~# proxmox-boot-tool kernel list
Manually selected kernels:
None.

Automatically selected kernels:
6.14.11-4-pve
6.17.2-1-pve

Pinned kernel:
6.14.11-4-pve
root@pve-stm-prod-01:~# lscpu
Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Address sizes: 46 bits physical, 48 bits virtual
Byte Order: Little Endian
CPU(s): 56
On-line CPU(s) list: 0-55
Vendor ID: GenuineIntel
Model name: Intel(R) Xeon(R) CPU E5-2690 v4 @ 2.60GHz
CPU family: 6
Model: 79
Thread(s) per core: 2
Core(s) per socket: 14
Socket(s): 2
Stepping: 1
CPU(s) scaling MHz: 89%
CPU max MHz: 3500.0000
CPU min MHz: 1200.0000
BogoMIPS: 5200.08
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall n
x pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64
monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xs
ave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l3 cdp_l3 pti ssbd ibrs ibpb stibp tpr_shadow flexpriority ept
vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdt_a rdseed adx smap intel_pt xsaveopt cqm_llc cqm_
occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts vnmi md_clear flush_l1d
Virtualization features:
Virtualization: VT-x
Caches (sum of all):
L1d: 896 KiB (28 instances)
L1i: 896 KiB (28 instances)
L2: 7 MiB (28 instances)
L3: 70 MiB (2 instances)
NUMA:
NUMA node(s): 2
NUMA node0 CPU(s): 0,2,4,6,8,10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40,42,44,46,48,50,52,54
NUMA node1 CPU(s): 1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,31,33,35,37,39,41,43,45,47,49,51,53,55
Vulnerabilities:
Gather data sampling: Not affected
Ghostwrite: Not affected
Indirect target selection: Not affected
Itlb multihit: KVM: Mitigation: Split huge pages
L1tf: Mitigation; PTE Inversion; VMX conditional cache flushes, SMT vulnerable
Mds: Mitigation; Clear CPU buffers; SMT vulnerable
Meltdown: Mitigation; PTI
Mmio stale data: Mitigation; Clear CPU buffers; SMT vulnerable
Reg file data sampling: Not affected
Retbleed: Not affected
Spec rstack overflow: Not affected
Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl
Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Spectre v2: Mitigation; Retpolines; IBPB conditional; IBRS_FW; STIBP conditional; RSB filling; PBRSB-eIBRS Not affected; BHI Not affected
Srbds: Not affected
Tsa: Not affected
Tsx async abort: Mitigation; Clear CPU buffers; SMT vulnerable
Vmscape: Mitigation; IBPB before exit to userspace
root@pve-stm-prod-01:~#

 

[FooDeas]

I am also experiencing significant issues with the 6.17 kernel. I immediately noticed that the kernel module for ZFS is not loading.

# modprobe zfs
Failed to insert module ‘zfs’: Key was rejected by service

Secure boot is, of course, disabled and can be ruled out as a source of error.

During troubleshooting, the file system of the LVM system disk also crashed reproducibly and then automatically went into read-only mode. So there are other issues too, not just the ZFS module.
Just to be sure, I did a fresh installation on a new disk on the platform and updated the kernel there as well. This had the same effect.

Pinning the kernel 6.14.11-4-pve resolved the issue.

Hardware:
i7-4790 @ H97 chipset

Solution:
With the new kernel, some errors such as DMAR: [DMA Write NO_PASID] Request device [00:1f.2] fault addr 0xd9000000 [fault reason 0x0c] non-zero reserved fields in PTE appeared in the log for the first time. This indicates that there are now remapping problems that interfere with the chipset SATA controller on this platform.
After adding the kernel parameters intel_iommu=on iommu=pt everything works perfectly again.