Fix 8 Important CVEs ahead of RHEL; bump to 687.26.2
Backport upstream stable fixes for RHEL-Affected Important CVEs, closest-to-5.14 stable base, verified zero-fuzz on 687.26.1: - CVE-2026-53398 nfsd SECINFO_NO_NAME decode error cleanup (1100) - CVE-2026-53399 nfsd release layout stid on setlease failure (1101) - CVE-2026-63794 KVM SVM page overflow in sev_dbg_crypt() (1102) - CVE-2026-63824 KEYS overflow in keyctl_pkey_params_get_2() (1103) - CVE-2026-63829 net ip_gre require CAP_NET_ADMIN in device netns (1104) - CVE-2026-64037 wifi iwlwifi mld TSO segmentation explosion (1105) - CVE-2026-64113 ixgbevf UAF in VEPA multicast source pruning (1106) - CVE-2026-64191 i2c stub reject block transfers with invalid length (1107)
This commit is contained in:
parent
f17e2f695d
commit
17ac9ff7c7
@ -0,0 +1,50 @@
|
||||
From 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439 Mon Sep 17 00:00:00 2001
|
||||
From: Guannan Wang <wgnbuaa@gmail.com>
|
||||
Date: Thu, 21 May 2026 16:03:32 +0800
|
||||
Subject: [PATCH] NFSD: Fix SECINFO_NO_NAME decode error cleanup
|
||||
|
||||
commit 9e18e83b8846a5c3fe13fc8a464b4865d33996c6 upstream.
|
||||
|
||||
nfsd4_decode_secinfo_no_name() currently initializes sin_exp after
|
||||
decoding sin_style. If the XDR stream is truncated, the decoder returns
|
||||
nfserr_bad_xdr before sin_exp is initialized.
|
||||
|
||||
Since commit 3fdc54646234 ("NFSD: Reduce amount of struct
|
||||
nfsd4_compoundargs that needs clearing"), the inline iops array is not
|
||||
cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore
|
||||
leave sin_exp holding stale union contents from a previous operation.
|
||||
|
||||
The error response path still invokes nfsd4_secinfo_no_name_release(),
|
||||
which calls exp_put() on a non-NULL sin_exp.
|
||||
|
||||
Initialize sin_exp before the first failable decode step, matching
|
||||
nfsd4_decode_secinfo().
|
||||
|
||||
Fixes: 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing")
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Guannan Wang <wgnbuaa@gmail.com>
|
||||
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
[ CVE-2026-53398: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439; applies cleanly, zero-fuzz. ]
|
||||
|
||||
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
|
||||
index e02c5650e2ac..4f1df2f6880c 100644
|
||||
--- a/fs/nfsd/nfs4xdr.c
|
||||
+++ b/fs/nfsd/nfs4xdr.c
|
||||
@@ -1821,10 +1821,11 @@ static __be32 nfsd4_decode_secinfo_no_name(struct nfsd4_compoundargs *argp,
|
||||
union nfsd4_op_u *u)
|
||||
{
|
||||
struct nfsd4_secinfo_no_name *sin = &u->secinfo_no_name;
|
||||
+
|
||||
+ sin->sin_exp = NULL;
|
||||
if (xdr_stream_decode_u32(argp->xdr, &sin->sin_style) < 0)
|
||||
return nfserr_bad_xdr;
|
||||
|
||||
- sin->sin_exp = NULL;
|
||||
return nfs_ok;
|
||||
}
|
||||
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
|
||||
@ -0,0 +1,58 @@
|
||||
From 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 Mon Sep 17 00:00:00 2001
|
||||
From: Chris Mason <clm@meta.com>
|
||||
Date: Mon, 18 May 2026 13:16:36 -0700
|
||||
Subject: [PATCH] nfsd: release layout stid on setlease failure
|
||||
|
||||
CVE-2026-53399
|
||||
|
||||
Upstream commit: 30d55c8aabb261bc3f427d6b9aae7ef6206063f9
|
||||
|
||||
nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via
|
||||
idr_alloc_cyclic() under cl_lock before returning to
|
||||
nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then
|
||||
fails, the error path frees the layout stateid directly with
|
||||
kmem_cache_free() without ever calling idr_remove(), leaving the
|
||||
IDR slot pointing at freed slab memory. Any subsequent IDR walker
|
||||
(states_show, client teardown) dereferences the dangling pointer.
|
||||
|
||||
The correct teardown for an IDR-published stid is nfs4_put_stid(),
|
||||
which removes the IDR slot under cl_lock, dispatches sc_free
|
||||
(nfsd4_free_layout_stateid) to release ls->ls_file via
|
||||
nfsd4_close_layout(), and drops the nfs4_file reference in its
|
||||
tail.
|
||||
|
||||
Replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free
|
||||
cleanup with a single nfs4_put_stid(stp).
|
||||
|
||||
Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls")
|
||||
Cc: stable@vger.kernel.org
|
||||
Assisted-by: kres (claude-opus-4-7)
|
||||
Signed-off-by: Chris Mason <clm@meta.com>
|
||||
Reviewed-by: Jeff Layton <jlayton@kernel.org>
|
||||
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
|
||||
[ Backported to AlmaLinux 9 (5.14.0-687.26.1.el9_8). This kernel
|
||||
predates the ls_fence_work delayed_work in struct
|
||||
nfs4_layout_stateid, so nfsd4_free_layout_stateid() never inspects
|
||||
an uninitialized delayed_work on the failure path. The
|
||||
ls_fenced/ls_fence_delay/INIT_DELAYED_WORK hoisting hunk of the
|
||||
mainline commit is therefore not applicable and is dropped, leaving
|
||||
only the nfs4_put_stid() cleanup replacement (matches the 6.12.y
|
||||
stable backport d369e5edfaaf). ]
|
||||
---
|
||||
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
|
||||
index 1cfd61d..32c957e 100644
|
||||
--- a/fs/nfsd/nfs4layouts.c
|
||||
+++ b/fs/nfsd/nfs4layouts.c
|
||||
@@ -258,9 +258,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
|
||||
BUG_ON(!ls->ls_file);
|
||||
|
||||
if (nfsd4_layout_setlease(ls)) {
|
||||
- nfsd_file_put(ls->ls_file);
|
||||
- put_nfs4_file(fp);
|
||||
- kmem_cache_free(nfs4_layout_stateid_cache, ls);
|
||||
+ nfs4_put_stid(stp);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
--
|
||||
2.43.0
|
||||
@ -0,0 +1,96 @@
|
||||
From 64f2449841ffc7d203183aa4c748c9c77951ecc5 Mon Sep 17 00:00:00 2001
|
||||
From: Ashutosh Desai <ashutoshdesai993@gmail.com>
|
||||
Date: Fri, 1 May 2026 13:35:32 -0700
|
||||
Subject: [PATCH] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT
|
||||
path
|
||||
|
||||
commit 78ee2d50185a037b3d2452a97f3dad69c3f7f389 upstream.
|
||||
|
||||
In sev_dbg_crypt(), the per-iteration transfer length is bounded by
|
||||
the source page offset (PAGE_SIZE - s_off) but not by the destination
|
||||
page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt
|
||||
path (__sev_dbg_encrypt_user) performs a read-modify-write using a
|
||||
single-page intermediate buffer (dst_tpage):
|
||||
|
||||
1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16)
|
||||
before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE,
|
||||
the PSP writes beyond the end of the 4096-byte dst_tpage allocation.
|
||||
|
||||
2. The subsequent memcpy()/copy_from_user() into
|
||||
page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows
|
||||
by up to 15 bytes under the same condition.
|
||||
|
||||
Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE -
|
||||
the PSP is instructed to write round_up(4097, 16) = 4112 bytes to
|
||||
a 4096-byte buffer.
|
||||
|
||||
Fix by also bounding len by (PAGE_SIZE - d_off), the same check that
|
||||
sev_send_update_data() already performs for its single-page guest
|
||||
region.
|
||||
|
||||
==================================================================
|
||||
BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd]
|
||||
Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214
|
||||
|
||||
CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY
|
||||
Tainted: [U]=USER, [W]=WARN
|
||||
Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025
|
||||
Call Trace:
|
||||
<TASK>
|
||||
dump_stack_lvl+0x54/0x70
|
||||
print_report+0xbc/0x260
|
||||
kasan_report+0xa2/0xd0
|
||||
kasan_check_range+0x25f/0x2c0
|
||||
__asan_memcpy+0x40/0x70
|
||||
sev_dbg_crypt+0x993/0xd10 [kvm_amd]
|
||||
sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd]
|
||||
kvm_vm_ioctl+0x65d/0x6d0 [kvm]
|
||||
__se_sys_ioctl+0xb2/0x100
|
||||
do_syscall_64+0xe8/0x870
|
||||
entry_SYSCALL_64_after_hwframe+0x4b/0x53
|
||||
</TASK>
|
||||
|
||||
The buggy address belongs to the physical page:
|
||||
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb
|
||||
memcg:ff11000112827d82
|
||||
flags: 0x1400000000000000(node=1|zone=1)
|
||||
raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000
|
||||
raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82
|
||||
page dumped because: kasan: bad access detected
|
||||
|
||||
Memory state around the buggy address:
|
||||
ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
>ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
|
||||
^
|
||||
ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
|
||||
ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
|
||||
==================================================================
|
||||
Disabling lock debugging due to kernel taint
|
||||
|
||||
Fixes: 24f41fb23a39 ("KVM: SVM: Add support for SEV DEBUG_DECRYPT command")
|
||||
Fixes: 7d1594f5d94b ("KVM: SVM: Add support for SEV DEBUG_ENCRYPT command")
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
|
||||
[sean: add sample KASAN splat, Fixes, and stable@]
|
||||
Link: https://patch.msgid.link/20260501203537.2120074-2-seanjc@google.com
|
||||
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
[ CVE-2026-63794: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 64f2449841ffc7d203183aa4c748c9c77951ecc5; applies cleanly, zero-fuzz. ]
|
||||
|
||||
diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
|
||||
index c40a65056aa8..aa6a54fed588 100644
|
||||
--- a/arch/x86/kvm/svm/sev.c
|
||||
+++ b/arch/x86/kvm/svm/sev.c
|
||||
@@ -954,6 +954,7 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
|
||||
s_off = vaddr & ~PAGE_MASK;
|
||||
d_off = dst_vaddr & ~PAGE_MASK;
|
||||
len = min_t(size_t, (PAGE_SIZE - s_off), size);
|
||||
+ len = min_t(size_t, len, PAGE_SIZE - d_off);
|
||||
|
||||
if (dec)
|
||||
ret = __sev_dbg_decrypt_user(kvm,
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
|
||||
@ -0,0 +1,83 @@
|
||||
From b1e247338bc71826a2d2def3e0874c34749df69a Mon Sep 17 00:00:00 2001
|
||||
From: Jarkko Sakkinen <jarkko@kernel.org>
|
||||
Date: Mon, 1 Jun 2026 23:11:54 +0300
|
||||
Subject: [PATCH] KEYS: fix overflow in keyctl_pkey_params_get_2()
|
||||
|
||||
CVE-2026-63824
|
||||
|
||||
Upstream commit: cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b
|
||||
Backport of stable 5.15.y commit: b1e247338bc71826a2d2def3e0874c34749df69a
|
||||
|
||||
The length for the internal output buffer is calculated incorrectly, which
|
||||
can result overflow when a too small buffer is provided.
|
||||
|
||||
Fix the bug by allocating internal output with the size of the maximum
|
||||
length of the cryptographic primitive instead of caller provided size.
|
||||
|
||||
Link: https://lore.kernel.org/keyrings/20260531024914.3712130-1-jarkko@kernel.org/
|
||||
Cc: stable@vger.kernel.org # v4.20+
|
||||
Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]")
|
||||
Reported-by: Alessandro Groppo <ale.grpp@gmail.com>
|
||||
Tested-by: Alessandro Groppo <ale.grpp@gmail.com>
|
||||
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
[ Backported to AlmaLinux 9 (5.14.0-687.26.1.el9_8). This kernel does
|
||||
not carry commit c51abd96837f ("KEYS: fix length validation in
|
||||
keyctl_pkey_params_get_2()"), so keyctl_pkey_params_get_2() still has
|
||||
the original combined ENCRYPT/DECRYPT and SIGN/VERIFY switch cases
|
||||
that the upstream fix's context assumes are already split. Adapt by
|
||||
splitting the four cases (preserving this kernel's existing length
|
||||
validation expressions unchanged) so the per-operation
|
||||
params->out_len assignment introduced by the fix can be applied, and
|
||||
drop the trailing "params->out_len = uparams.out_len;". The internal
|
||||
output buffer is now sized to the cryptographic primitive maximum
|
||||
(max_enc_size / max_dec_size / max_sig_size) rather than the
|
||||
caller-supplied length, which is the same semantic change as
|
||||
upstream. ]
|
||||
---
|
||||
diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c
|
||||
index 5de0d59..d862c38 100644
|
||||
--- a/security/keys/keyctl_pkey.c
|
||||
+++ b/security/keys/keyctl_pkey.c
|
||||
@@ -135,23 +135,38 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par
|
||||
|
||||
switch (op) {
|
||||
case KEYCTL_PKEY_ENCRYPT:
|
||||
+ if (uparams.in_len > info.max_enc_size ||
|
||||
+ uparams.out_len > info.max_dec_size)
|
||||
+ return -EINVAL;
|
||||
+
|
||||
+ params->out_len = info.max_enc_size;
|
||||
+ break;
|
||||
case KEYCTL_PKEY_DECRYPT:
|
||||
if (uparams.in_len > info.max_enc_size ||
|
||||
uparams.out_len > info.max_dec_size)
|
||||
return -EINVAL;
|
||||
+
|
||||
+ params->out_len = info.max_dec_size;
|
||||
break;
|
||||
case KEYCTL_PKEY_SIGN:
|
||||
+ if (uparams.in_len > info.max_sig_size ||
|
||||
+ uparams.out_len > info.max_data_size)
|
||||
+ return -EINVAL;
|
||||
+
|
||||
+ params->out_len = info.max_sig_size;
|
||||
+ break;
|
||||
case KEYCTL_PKEY_VERIFY:
|
||||
if (uparams.in_len > info.max_sig_size ||
|
||||
uparams.out_len > info.max_data_size)
|
||||
return -EINVAL;
|
||||
+
|
||||
+ params->out_len = info.max_sig_size;
|
||||
break;
|
||||
default:
|
||||
BUG();
|
||||
}
|
||||
|
||||
params->in_len = uparams.in_len;
|
||||
- params->out_len = uparams.out_len;
|
||||
return 0;
|
||||
}
|
||||
|
||||
--
|
||||
2.43.0
|
||||
@ -0,0 +1,111 @@
|
||||
From 9831bc9ecb402957810c2045c663fbfe9b09e296 Mon Sep 17 00:00:00 2001
|
||||
From: Maoyi Xie <maoyixie.tju@gmail.com>
|
||||
Date: Fri, 12 Jun 2026 16:59:35 +0800
|
||||
Subject: [PATCH] net: ip_gre: require CAP_NET_ADMIN in the device netns for
|
||||
changelink
|
||||
|
||||
commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 upstream.
|
||||
|
||||
A tunnel changelink() operates on at most two netns, dev_net(dev) and
|
||||
the tunnel link netns t->net. They differ once the device is created in
|
||||
or moved to a netns other than the one the request runs in. The rtnl
|
||||
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
|
||||
caller privileged there but not in t->net can rewrite a tunnel that
|
||||
lives in t->net.
|
||||
|
||||
Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in
|
||||
net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is
|
||||
skipped when the link netns is dev_net(dev), where the rtnl path already
|
||||
checked it. The other patches in this series use the same helper.
|
||||
|
||||
Gate ipgre_changelink() and erspan_changelink() with it, at the top of
|
||||
the op before any attribute is parsed, because the parsers update live
|
||||
tunnel fields first. ipgre_netlink_parms() sets t->collect_md before
|
||||
ip_tunnel_changelink() runs.
|
||||
|
||||
Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in
|
||||
vti6_siocdevprivate().") added the same check on the ioctl path. This
|
||||
adds it on RTM_NEWLINK.
|
||||
|
||||
Reported-by: Xiao Liang <shaw.leon@gmail.com>
|
||||
Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
|
||||
Fixes: b57708add314 ("gre: add x-netns support")
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
|
||||
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
|
||||
Link: https://patch.msgid.link/20260612085941.3158249-2-maoyixie.tju@gmail.com
|
||||
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
CVE-2026-63829
|
||||
|
||||
Backported from linux-6.12.y commit 9831bc9ecb402957810c2045c663fbfe9b09e296
|
||||
(mainline commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7). Context in
|
||||
net/ipv4/ip_gre.c adjusted to the 5.14 el9_8 tree (function offsets only);
|
||||
the added rtnl_dev_link_net_capable() helper and its call sites are
|
||||
identical to upstream. All referenced helpers (net_eq, dev_net, ns_capable,
|
||||
CAP_NET_ADMIN, struct ip_tunnel::net) already exist in this tree.
|
||||
---
|
||||
include/net/rtnetlink.h | 2 ++
|
||||
net/core/rtnetlink.c | 8 ++++++++
|
||||
net/ipv4/ip_gre.c | 6 ++++++
|
||||
3 files changed, 16 insertions(+)
|
||||
|
||||
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
|
||||
index 67baf74..34f2de4 100644
|
||||
--- a/include/net/rtnetlink.h
|
||||
+++ b/include/net/rtnetlink.h
|
||||
@@ -223,6 +223,8 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm,
|
||||
int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer,
|
||||
struct netlink_ext_ack *exterr);
|
||||
struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid);
|
||||
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
|
||||
+ const struct net *link_net);
|
||||
|
||||
#define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
|
||||
|
||||
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
|
||||
index cf61b88..499bea7 100644
|
||||
--- a/net/core/rtnetlink.c
|
||||
+++ b/net/core/rtnetlink.c
|
||||
@@ -2220,6 +2220,14 @@ struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid)
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable);
|
||||
|
||||
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
|
||||
+ const struct net *link_net)
|
||||
+{
|
||||
+ return net_eq(link_net, dev_net(dev)) ||
|
||||
+ ns_capable(link_net->user_ns, CAP_NET_ADMIN);
|
||||
+}
|
||||
+EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable);
|
||||
+
|
||||
static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh,
|
||||
bool strict_check, struct nlattr **tb,
|
||||
struct netlink_ext_ack *extack)
|
||||
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
|
||||
index 729c855..4483cfd 100644
|
||||
--- a/net/ipv4/ip_gre.c
|
||||
+++ b/net/ipv4/ip_gre.c
|
||||
@@ -1431,6 +1431,9 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
|
||||
__u32 fwmark = t->fwmark;
|
||||
int err;
|
||||
|
||||
+ if (!rtnl_dev_link_net_capable(dev, t->net))
|
||||
+ return -EPERM;
|
||||
+
|
||||
err = ipgre_newlink_encap_setup(dev, data);
|
||||
if (err)
|
||||
return err;
|
||||
@@ -1460,6 +1463,9 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[],
|
||||
__u32 fwmark = t->fwmark;
|
||||
int err;
|
||||
|
||||
+ if (!rtnl_dev_link_net_capable(dev, t->net))
|
||||
+ return -EPERM;
|
||||
+
|
||||
err = ipgre_newlink_encap_setup(dev, data);
|
||||
if (err)
|
||||
return err;
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
@ -0,0 +1,79 @@
|
||||
From 92cee08dc4f00e77fd1317e4343c5d458b0abab7 Mon Sep 17 00:00:00 2001
|
||||
From: Cole Leavitt <cole@unwrap.rs>
|
||||
Date: Sat, 4 Apr 2026 22:41:44 -0700
|
||||
Subject: [PATCH] wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
|
||||
is disabled
|
||||
|
||||
commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7 upstream.
|
||||
|
||||
When the TLC notification disables AMSDU for a TID, the MLD driver sets
|
||||
max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in
|
||||
iwl_mld_tx_tso_segment() checks for zero but not for this sentinel,
|
||||
allowing it to reach the num_subframes calculation:
|
||||
|
||||
num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)
|
||||
= (1 + 2) / (1534 + 2) = 0
|
||||
|
||||
This zero propagates to iwl_tx_tso_segment() which sets:
|
||||
|
||||
gso_size = num_subframes * mss = 0
|
||||
|
||||
Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny
|
||||
segments from a single GSO skb. This floods the TX ring with ~1024
|
||||
micro-frames (the rest are purged), creating a massive burst of TX
|
||||
completion events that can lead to memory corruption and a subsequent
|
||||
use-after-free in TCP's retransmit queue (refcount underflow in
|
||||
tcp_shifted_skb, NULL deref in tcp_rack_detect_loss).
|
||||
|
||||
The MVM driver is immune because it checks mvmsta->amsdu_enabled before
|
||||
reaching the num_subframes calculation. The MLD driver has no equivalent
|
||||
bitmap check and relies solely on max_tid_amsdu_len, which does not
|
||||
catch the sentinel value.
|
||||
|
||||
Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the
|
||||
existing check and falling back to non-AMSDU TSO segmentation. Also add
|
||||
a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth
|
||||
to catch any future code paths that produce zero through a different
|
||||
mechanism.
|
||||
|
||||
Suggested-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
|
||||
Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
|
||||
Signed-off-by: Cole Leavitt <cole@unwrap.rs>
|
||||
Link: https://patch.msgid.link/20260405054145.1064152-3-cole@unwrap.rs
|
||||
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
|
||||
|
||||
CVE-2026-64037
|
||||
|
||||
Backported from mainline commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7.
|
||||
The iwlmld sub-driver (drivers/net/wireless/intel/iwlwifi/mld/) is present
|
||||
in the 5.14 el9_8 tree and iwl_mld_tx_tso_segment() carries the vulnerable
|
||||
pre-image verbatim, so the change applies with a line offset only.
|
||||
---
|
||||
drivers/net/wireless/intel/iwlwifi/mld/tx.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
|
||||
index 3b4b575..fef3db7 100644
|
||||
--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c
|
||||
+++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
|
||||
@@ -823,7 +823,7 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb,
|
||||
return -EINVAL;
|
||||
|
||||
max_tid_amsdu_len = sta->cur->max_tid_amsdu_len[tid];
|
||||
- if (!max_tid_amsdu_len)
|
||||
+ if (!max_tid_amsdu_len || max_tid_amsdu_len == 1)
|
||||
return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs);
|
||||
|
||||
/* Sub frame header + SNAP + IP header + TCP header + MSS */
|
||||
@@ -835,6 +835,9 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb,
|
||||
*/
|
||||
num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad);
|
||||
|
||||
+ if (WARN_ON_ONCE(!num_subframes))
|
||||
+ return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs);
|
||||
+
|
||||
if (sta->max_amsdu_subframes &&
|
||||
num_subframes > sta->max_amsdu_subframes)
|
||||
num_subframes = sta->max_amsdu_subframes;
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
@ -0,0 +1,64 @@
|
||||
From 6ef30384a50a50e4a484cddf341bc27de31aa3de Mon Sep 17 00:00:00 2001
|
||||
From: Michael Bommarito <michael.bommarito@gmail.com>
|
||||
Date: Fri, 15 May 2026 11:24:14 -0700
|
||||
Subject: [PATCH] ixgbevf: fix use-after-free in VEPA multicast source pruning
|
||||
|
||||
commit 5d49b568c188dc77199d8d2b959c91da8cc27cf1 upstream.
|
||||
|
||||
ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's
|
||||
own address (VEPA multicast workaround) by freeing the skb and
|
||||
continuing to the next descriptor:
|
||||
|
||||
dev_kfree_skb_irq(skb);
|
||||
continue;
|
||||
|
||||
The skb pointer is declared outside the while loop and persists across
|
||||
iterations. Because the continue skips the "skb = NULL" reset at the
|
||||
bottom of the loop, the next iteration enters the "else if (skb)" path
|
||||
and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing
|
||||
skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.
|
||||
|
||||
The sibling driver iavf already handles this correctly by nulling the
|
||||
pointer before continuing. Apply the same pattern here.
|
||||
|
||||
I do not have ixgbevf hardware; the bug was found by static analysis
|
||||
(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool
|
||||
corroboration with the highest score in the scan). The UAF was confirmed
|
||||
under KASAN by loading a test module that reproduces the exact code
|
||||
pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):
|
||||
|
||||
BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000
|
||||
Read of size 8 at addr 000000006163ae78 by task insmod/30
|
||||
freed 208-byte region [000000006163adc0, 000000006163ae90)
|
||||
|
||||
QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF
|
||||
driver does not include the VEPA source pruning path, so a full
|
||||
end-to-end reproduction with emulated hardware was not possible.
|
||||
|
||||
Fixes: bad17234ba70 ("ixgbevf: Change receive model to use double buffered page based receives")
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
|
||||
Reviewed-by: Simon Horman <horms@kernel.org>
|
||||
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
|
||||
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
|
||||
Link: https://patch.msgid.link/20260515182419.1597859-8-anthony.l.nguyen@intel.com
|
||||
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
[ CVE-2026-64113: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 6ef30384a50a50e4a484cddf341bc27de31aa3de; applies cleanly, zero-fuzz. ]
|
||||
|
||||
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
|
||||
index 3a05e458ded2..f0c864195c97 100644
|
||||
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
|
||||
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
|
||||
@@ -1220,6 +1220,7 @@ static int ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector,
|
||||
ether_addr_equal(rx_ring->netdev->dev_addr,
|
||||
eth_hdr(skb)->h_source)) {
|
||||
dev_kfree_skb_irq(skb);
|
||||
+ skb = NULL;
|
||||
continue;
|
||||
}
|
||||
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
|
||||
@ -0,0 +1,73 @@
|
||||
From 21e87f336ac6303fed54a69b1d0d79a23b25c8d0 Mon Sep 17 00:00:00 2001
|
||||
From: Weiming Shi <bestswngs@gmail.com>
|
||||
Date: Wed, 15 Apr 2026 01:23:39 +0800
|
||||
Subject: [PATCH] i2c: stub: Reject I2C block transfers with invalid length
|
||||
|
||||
commit 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e upstream.
|
||||
|
||||
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
|
||||
as the transfer length. The existing check only clamps it to avoid
|
||||
overrunning the chip->words[256] register array, but does not validate
|
||||
it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union
|
||||
i2c_smbus_data.block buffer (34 bytes total). The driver is a
|
||||
development/test tool (CONFIG_I2C_STUB=m, not built by default)
|
||||
that must be loaded with a chip_addr= parameter.
|
||||
|
||||
A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl
|
||||
with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing
|
||||
stub_xfer() to read or write past the end of the union
|
||||
i2c_smbus_data.block buffer:
|
||||
|
||||
BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)
|
||||
Read of size 1 at addr ffff88800abcfd92 by task exploit/81
|
||||
Call Trace:
|
||||
<TASK>
|
||||
stub_xfer (drivers/i2c/i2c-stub.c:223)
|
||||
__i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)
|
||||
i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)
|
||||
i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)
|
||||
i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)
|
||||
__x64_sys_ioctl (fs/ioctl.c:583)
|
||||
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
|
||||
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
|
||||
</TASK>
|
||||
|
||||
The bug exists because i2c-stub implements .smbus_xfer directly,
|
||||
bypassing the I2C_SMBUS_BLOCK_MAX validation in
|
||||
i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same
|
||||
function correctly validates against I2C_SMBUS_BLOCK_MAX, but the
|
||||
I2C_SMBUS_I2C_BLOCK_DATA case does not.
|
||||
|
||||
Fix by rejecting transfers with data->block[0] == 0 or
|
||||
data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with
|
||||
both the I2C_SMBUS_BLOCK_DATA case in the same function and the
|
||||
I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().
|
||||
|
||||
Fixes: 4710317891e4 ("i2c-stub: Implement I2C block support")
|
||||
Reported-by: Xiang Mei <xmei5@asu.edu>
|
||||
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
|
||||
Reviewed-by: Jean Delvare <jdelvare@suse.de>
|
||||
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
[ CVE-2026-64191: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 21e87f336ac6303fed54a69b1d0d79a23b25c8d0; applies cleanly, zero-fuzz. ]
|
||||
|
||||
diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c
|
||||
index d642cad219d9..3a2f472dd6b0 100644
|
||||
--- a/drivers/i2c/i2c-stub.c
|
||||
+++ b/drivers/i2c/i2c-stub.c
|
||||
@@ -214,6 +214,11 @@ static s32 stub_xfer(struct i2c_adapter *adap, u16 addr, unsigned short flags,
|
||||
* We ignore banks here, because banked chips don't use I2C
|
||||
* block transfers
|
||||
*/
|
||||
+ if (data->block[0] == 0 ||
|
||||
+ data->block[0] > I2C_SMBUS_BLOCK_MAX) {
|
||||
+ ret = -EINVAL;
|
||||
+ break;
|
||||
+ }
|
||||
if (data->block[0] > 256 - command) /* Avoid overrun */
|
||||
data->block[0] = 256 - command;
|
||||
len = data->block[0];
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
|
||||
@ -176,13 +176,13 @@ Summary: The Linux kernel
|
||||
# define buildid .local
|
||||
%define specversion 5.14.0
|
||||
%define patchversion 5.14
|
||||
%define pkgrelease 687.26.1
|
||||
%define pkgrelease 687.26.2
|
||||
%define kversion 5
|
||||
%define tarfile_release 5.14.0-687.26.1.el9_8
|
||||
# This is needed to do merge window version magic
|
||||
%define patchlevel 14
|
||||
# This allows pkg_release to have configurable %%{?dist} tag
|
||||
%define specrelease 687.26.1%{?buildid}%{?dist}
|
||||
%define specrelease 687.26.2%{?buildid}%{?dist}
|
||||
# This defines the kabi tarball version
|
||||
%define kabiversion 5.14.0-687.26.1.el9_8
|
||||
|
||||
@ -977,6 +977,14 @@ Patch2009: 0001-proc-fix-a-dentry-lock-race-between-release_task-and-lookup.patc
|
||||
|
||||
Patch11111: ppc64le-kvm-support.patch
|
||||
|
||||
Patch1100: 1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch
|
||||
Patch1101: 1101-nfsd-release-layout-stid-on-setlease-failure.patch
|
||||
Patch1102: 1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch
|
||||
Patch1103: 1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch
|
||||
Patch1104: 1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch
|
||||
Patch1105: 1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch
|
||||
Patch1106: 1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch
|
||||
Patch1107: 1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%description
|
||||
@ -1721,6 +1729,14 @@ ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch
|
||||
ApplyPatch 0001-Make-KVM-PMU-symbols-global-for-ppc64le-module-build.patch
|
||||
ApplyPatch 0001-proc-fix-a-dentry-lock-race-between-release_task-and-lookup.patch
|
||||
|
||||
ApplyPatch 1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch
|
||||
ApplyPatch 1101-nfsd-release-layout-stid-on-setlease-failure.patch
|
||||
ApplyPatch 1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch
|
||||
ApplyPatch 1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch
|
||||
ApplyPatch 1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch
|
||||
ApplyPatch 1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch
|
||||
ApplyPatch 1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch
|
||||
ApplyPatch 1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
# Any further pre-build tree manipulations happen here.
|
||||
@ -3795,6 +3811,16 @@ fi
|
||||
#
|
||||
#
|
||||
%changelog
|
||||
* Tue Jul 21 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.26.2
|
||||
- NFSD: Fix SECINFO_NO_NAME decode error cleanup (Guannan Wang) {CVE-2026-53398}
|
||||
- nfsd: release layout stid on setlease failure (Chris Mason) {CVE-2026-53399}
|
||||
- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (Ashutosh Desai) {CVE-2026-63794}
|
||||
- KEYS: fix overflow in keyctl_pkey_params_get_2() (Jarkko Sakkinen) {CVE-2026-63824}
|
||||
- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) {CVE-2026-63829}
|
||||
- wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Cole Leavitt) {CVE-2026-64037}
|
||||
- ixgbevf: fix use-after-free in VEPA multicast source pruning (Michael Bommarito) {CVE-2026-64113}
|
||||
- i2c: stub: Reject I2C block transfers with invalid length (Weiming Shi) {CVE-2026-64191}
|
||||
|
||||
* Fri Jul 17 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.26.1
|
||||
- proc: fix a dentry lock race between release_task and lookup
|
||||
- hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
|
||||
|
||||
Loading…
Reference in New Issue
Block a user