[sjmiller609]

Summary

Enable built-in IPv6 in both x86 and ARM64 guest kernel configurations, retaining the IPv4 TPROXY and policy-routing support from kernel 3.1. This provides IPv6 sockets and sysctls; it does not implement IPv6 proxying or enable IPv6 TPROXY/policy routing.

Validation

• Reviewed the two-line configuration change; diff whitespace checks pass.
• CI passed: https://github.com/kernel/linux/actions/runs/41084984130
• Verified both packaged .config files: CONFIG_IPV6=y, with IPv4 TPROXY, policy routing, namespaces and veth still enabled. Both header archive checksums match release asset digests.
• Published normal release: https://github.com/kernel/linux/releases/tag/ch-6.12.8-kernel-3.2-202610301
• No kernel clone or local kernel build. Kernel 3.2 booted in an isolated x86_64 Firecracker guest; native IPv6 TCP/UDP loopback and sysctls passed, as did IPv4 TPROXY interception/replies, Chromium STUN/HTTP/CDP/DNS and standby/restore. The loaded artifact SHA-256 matched the release.
• The experimental browser image retains a separate cold-restart namespace cleanup bug. ARM64, Cloud Hypervisor, real provider matching and external IPv6 connectivity have not been runtime-tested.
• No deployment or default-kernel change; RISC-V configuration remains unchanged.

---

Note

Medium Risk
Enables the full IPv6 networking stack in shipped guest kernels, expanding attack surface and behavior vs IPv4-only builds, though proxy/routing paths remain IPv4-focused.

Overview
Turns on built-in IPv6 (CONFIG_IPV6=y) in the x86 and ARM64 ch_defconfig guest kernels, replacing the previous # CONFIG_IPV6 is not set in both files.

This is a config-only change: IPv4 TPROXY, policy routing, netfilter/nftables, and network namespaces are left as they were—there is no new IPv6 TPROXY or IPv6-specific netfilter enablement in the diff. RISC-V and other defconfigs are untouched.

^{Reviewed by Cursor Bugbot for commit 1d55090. Bugbot is set up for automated code reviews on this repo. Configure here.}