* TuxCare ELS build of the Debian 11 (bullseye) 5.10.262 kernel (x86_64/aarch64/armel). * Reconstructed on the newer bullseye-security 5.10.262-1 base (rolls up upstream stable 5.10.260 / .261 / .262), replacing the prior 5.10.259-1 base. Debian patch set re-imported as git commits (ip6_vti patch dropped — now upstream; firmware log-message patch refreshed). * Single-source: embed the linux-latest + linux-signed meta packages into the source tree (debian/meta/) so one dpkg-buildpackage run produces the versioned kernel AND the meta/signed packages. * ABI: this ELS changelog entry increments the gencontrol-computed abiname 5.10.0-46 -> 5.10.0-47, so the ELS kernel ships as linux-image-5.10.0-47-*, a distinct, co-installable package vs Debian stock 5.10.0-46. * Disable the rt and cloud featuresets/flavours (not shipped by ELS). * Fix the duplicate pinned image/headers meta on signed arches under disable-signed: gate the pinned-meta emission on raw signed-code so only the embed's fallback meta (linux-image-5.10.0-47-amd64 | ...-unsigned) ships. * Backport security fixes for potentially-exploited (KCARE 0/1-day) CVEs: CVE-2026-46113 (KVM x86 shadow-paging UAF, unexpected GFN/role), CVE-2026-64561 (KVM x86: check obsolete root after making MMU pages available), CVE-2026-64564 (SCTP ASCONF DEL-IP transport use-after-free), CVE-2026-64600 (XFS: resample data-fork mapping after cycling ILOCK). * Drop the prior CVE-2026-43499 (rtmutex remove_waiter UAF) and CVE-2026-46331 (net/sched pedit partial-COW) backports — both are included upstream in the 5.10.260 / .261 / .262 stable roll-up.