From 17ac9ff7c7b5aad33ca1e1a7bf12a6fd5a6ba824 Mon Sep 17 00:00:00 2001 From: Andrew Lukoshko Date: Tue, 21 Jul 2026 18:56:46 +0000 Subject: [PATCH] Fix 8 Important CVEs ahead of RHEL; bump to 687.26.2 Backport upstream stable fixes for RHEL-Affected Important CVEs, closest-to-5.14 stable base, verified zero-fuzz on 687.26.1: - CVE-2026-53398 nfsd SECINFO_NO_NAME decode error cleanup (1100) - CVE-2026-53399 nfsd release layout stid on setlease failure (1101) - CVE-2026-63794 KVM SVM page overflow in sev_dbg_crypt() (1102) - CVE-2026-63824 KEYS overflow in keyctl_pkey_params_get_2() (1103) - CVE-2026-63829 net ip_gre require CAP_NET_ADMIN in device netns (1104) - CVE-2026-64037 wifi iwlwifi mld TSO segmentation explosion (1105) - CVE-2026-64113 ixgbevf UAF in VEPA multicast source pruning (1106) - CVE-2026-64191 i2c stub reject block transfers with invalid length (1107) --- ...secinfo-no-name-decode-error-cleanup.patch | 50 ++++++++ ...ease-layout-stid-on-setlease-failure.patch | 58 +++++++++ ...m-fix-page-overflow-in-sev-dbg-crypt.patch | 96 +++++++++++++++ ...overflow-in-keyctl-pkey-params-get-2.patch | 83 +++++++++++++ ...admin-in-device-netns-for-changelink.patch | 111 ++++++++++++++++++ ...i-mld-fix-tso-segmentation-explosion.patch | 79 +++++++++++++ ...uaf-in-vepa-multicast-source-pruning.patch | 64 ++++++++++ ...-block-transfers-with-invalid-length.patch | 73 ++++++++++++ SPECS/kernel.spec | 30 ++++- 9 files changed, 642 insertions(+), 2 deletions(-) create mode 100644 SOURCES/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch create mode 100644 SOURCES/1101-nfsd-release-layout-stid-on-setlease-failure.patch create mode 100644 SOURCES/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch create mode 100644 SOURCES/1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch create mode 100644 SOURCES/1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch create mode 100644 SOURCES/1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch create mode 100644 SOURCES/1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch create mode 100644 SOURCES/1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch diff --git a/SOURCES/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch b/SOURCES/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch new file mode 100644 index 000000000..faae384bb --- /dev/null +++ b/SOURCES/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch @@ -0,0 +1,50 @@ +From 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439 Mon Sep 17 00:00:00 2001 +From: Guannan Wang +Date: Thu, 21 May 2026 16:03:32 +0800 +Subject: [PATCH] NFSD: Fix SECINFO_NO_NAME decode error cleanup + +commit 9e18e83b8846a5c3fe13fc8a464b4865d33996c6 upstream. + +nfsd4_decode_secinfo_no_name() currently initializes sin_exp after +decoding sin_style. If the XDR stream is truncated, the decoder returns +nfserr_bad_xdr before sin_exp is initialized. + +Since commit 3fdc54646234 ("NFSD: Reduce amount of struct +nfsd4_compoundargs that needs clearing"), the inline iops array is not +cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore +leave sin_exp holding stale union contents from a previous operation. + +The error response path still invokes nfsd4_secinfo_no_name_release(), +which calls exp_put() on a non-NULL sin_exp. + +Initialize sin_exp before the first failable decode step, matching +nfsd4_decode_secinfo(). + +Fixes: 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing") +Cc: stable@vger.kernel.org +Signed-off-by: Guannan Wang +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman + +[ CVE-2026-53398: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439; applies cleanly, zero-fuzz. ] + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index e02c5650e2ac..4f1df2f6880c 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1821,10 +1821,11 @@ static __be32 nfsd4_decode_secinfo_no_name(struct nfsd4_compoundargs *argp, + union nfsd4_op_u *u) + { + struct nfsd4_secinfo_no_name *sin = &u->secinfo_no_name; ++ ++ sin->sin_exp = NULL; + if (xdr_stream_decode_u32(argp->xdr, &sin->sin_style) < 0) + return nfserr_bad_xdr; + +- sin->sin_exp = NULL; + return nfs_ok; + } + +-- +2.50.1 (Apple Git-155) + diff --git a/SOURCES/1101-nfsd-release-layout-stid-on-setlease-failure.patch b/SOURCES/1101-nfsd-release-layout-stid-on-setlease-failure.patch new file mode 100644 index 000000000..52f48ed95 --- /dev/null +++ b/SOURCES/1101-nfsd-release-layout-stid-on-setlease-failure.patch @@ -0,0 +1,58 @@ +From 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 Mon Sep 17 00:00:00 2001 +From: Chris Mason +Date: Mon, 18 May 2026 13:16:36 -0700 +Subject: [PATCH] nfsd: release layout stid on setlease failure + +CVE-2026-53399 + +Upstream commit: 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 + +nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via +idr_alloc_cyclic() under cl_lock before returning to +nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then +fails, the error path frees the layout stateid directly with +kmem_cache_free() without ever calling idr_remove(), leaving the +IDR slot pointing at freed slab memory. Any subsequent IDR walker +(states_show, client teardown) dereferences the dangling pointer. + +The correct teardown for an IDR-published stid is nfs4_put_stid(), +which removes the IDR slot under cl_lock, dispatches sc_free +(nfsd4_free_layout_stateid) to release ls->ls_file via +nfsd4_close_layout(), and drops the nfs4_file reference in its +tail. + +Replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free +cleanup with a single nfs4_put_stid(stp). + +Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") +Cc: stable@vger.kernel.org +Assisted-by: kres (claude-opus-4-7) +Signed-off-by: Chris Mason +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +[ Backported to AlmaLinux 9 (5.14.0-687.26.1.el9_8). This kernel + predates the ls_fence_work delayed_work in struct + nfs4_layout_stateid, so nfsd4_free_layout_stateid() never inspects + an uninitialized delayed_work on the failure path. The + ls_fenced/ls_fence_delay/INIT_DELAYED_WORK hoisting hunk of the + mainline commit is therefore not applicable and is dropped, leaving + only the nfs4_put_stid() cleanup replacement (matches the 6.12.y + stable backport d369e5edfaaf). ] +--- +diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c +index 1cfd61d..32c957e 100644 +--- a/fs/nfsd/nfs4layouts.c ++++ b/fs/nfsd/nfs4layouts.c +@@ -258,9 +258,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate, + BUG_ON(!ls->ls_file); + + if (nfsd4_layout_setlease(ls)) { +- nfsd_file_put(ls->ls_file); +- put_nfs4_file(fp); +- kmem_cache_free(nfs4_layout_stateid_cache, ls); ++ nfs4_put_stid(stp); + return NULL; + } + +-- +2.43.0 diff --git a/SOURCES/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch b/SOURCES/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch new file mode 100644 index 000000000..f12158b0b --- /dev/null +++ b/SOURCES/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch @@ -0,0 +1,96 @@ +From 64f2449841ffc7d203183aa4c748c9c77951ecc5 Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Fri, 1 May 2026 13:35:32 -0700 +Subject: [PATCH] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT + path + +commit 78ee2d50185a037b3d2452a97f3dad69c3f7f389 upstream. + +In sev_dbg_crypt(), the per-iteration transfer length is bounded by +the source page offset (PAGE_SIZE - s_off) but not by the destination +page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt +path (__sev_dbg_encrypt_user) performs a read-modify-write using a +single-page intermediate buffer (dst_tpage): + + 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16) + before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, + the PSP writes beyond the end of the 4096-byte dst_tpage allocation. + + 2. The subsequent memcpy()/copy_from_user() into + page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows + by up to 15 bytes under the same condition. + +Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE - +the PSP is instructed to write round_up(4097, 16) = 4112 bytes to +a 4096-byte buffer. + +Fix by also bounding len by (PAGE_SIZE - d_off), the same check that +sev_send_update_data() already performs for its single-page guest +region. + + ================================================================== + BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd] + Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214 + + CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY + Tainted: [U]=USER, [W]=WARN + Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025 + Call Trace: + + dump_stack_lvl+0x54/0x70 + print_report+0xbc/0x260 + kasan_report+0xa2/0xd0 + kasan_check_range+0x25f/0x2c0 + __asan_memcpy+0x40/0x70 + sev_dbg_crypt+0x993/0xd10 [kvm_amd] + sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd] + kvm_vm_ioctl+0x65d/0x6d0 [kvm] + __se_sys_ioctl+0xb2/0x100 + do_syscall_64+0xe8/0x870 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + + + The buggy address belongs to the physical page: + page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb + memcg:ff11000112827d82 + flags: 0x1400000000000000(node=1|zone=1) + raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000 + raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82 + page dumped because: kasan: bad access detected + + Memory state around the buggy address: + ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc + ^ + ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc + ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc + ================================================================== + Disabling lock debugging due to kernel taint + +Fixes: 24f41fb23a39 ("KVM: SVM: Add support for SEV DEBUG_DECRYPT command") +Fixes: 7d1594f5d94b ("KVM: SVM: Add support for SEV DEBUG_ENCRYPT command") +Cc: stable@vger.kernel.org +Signed-off-by: Ashutosh Desai +[sean: add sample KASAN splat, Fixes, and stable@] +Link: https://patch.msgid.link/20260501203537.2120074-2-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman + +[ CVE-2026-63794: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 64f2449841ffc7d203183aa4c748c9c77951ecc5; applies cleanly, zero-fuzz. ] + +diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c +index c40a65056aa8..aa6a54fed588 100644 +--- a/arch/x86/kvm/svm/sev.c ++++ b/arch/x86/kvm/svm/sev.c +@@ -954,6 +954,7 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec) + s_off = vaddr & ~PAGE_MASK; + d_off = dst_vaddr & ~PAGE_MASK; + len = min_t(size_t, (PAGE_SIZE - s_off), size); ++ len = min_t(size_t, len, PAGE_SIZE - d_off); + + if (dec) + ret = __sev_dbg_decrypt_user(kvm, +-- +2.50.1 (Apple Git-155) + diff --git a/SOURCES/1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch b/SOURCES/1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch new file mode 100644 index 000000000..8c5826860 --- /dev/null +++ b/SOURCES/1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch @@ -0,0 +1,83 @@ +From b1e247338bc71826a2d2def3e0874c34749df69a Mon Sep 17 00:00:00 2001 +From: Jarkko Sakkinen +Date: Mon, 1 Jun 2026 23:11:54 +0300 +Subject: [PATCH] KEYS: fix overflow in keyctl_pkey_params_get_2() + +CVE-2026-63824 + +Upstream commit: cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b +Backport of stable 5.15.y commit: b1e247338bc71826a2d2def3e0874c34749df69a + +The length for the internal output buffer is calculated incorrectly, which +can result overflow when a too small buffer is provided. + +Fix the bug by allocating internal output with the size of the maximum +length of the cryptographic primitive instead of caller provided size. + +Link: https://lore.kernel.org/keyrings/20260531024914.3712130-1-jarkko@kernel.org/ +Cc: stable@vger.kernel.org # v4.20+ +Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]") +Reported-by: Alessandro Groppo +Tested-by: Alessandro Groppo +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +[ Backported to AlmaLinux 9 (5.14.0-687.26.1.el9_8). This kernel does + not carry commit c51abd96837f ("KEYS: fix length validation in + keyctl_pkey_params_get_2()"), so keyctl_pkey_params_get_2() still has + the original combined ENCRYPT/DECRYPT and SIGN/VERIFY switch cases + that the upstream fix's context assumes are already split. Adapt by + splitting the four cases (preserving this kernel's existing length + validation expressions unchanged) so the per-operation + params->out_len assignment introduced by the fix can be applied, and + drop the trailing "params->out_len = uparams.out_len;". The internal + output buffer is now sized to the cryptographic primitive maximum + (max_enc_size / max_dec_size / max_sig_size) rather than the + caller-supplied length, which is the same semantic change as + upstream. ] +--- +diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c +index 5de0d59..d862c38 100644 +--- a/security/keys/keyctl_pkey.c ++++ b/security/keys/keyctl_pkey.c +@@ -135,23 +135,38 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par + + switch (op) { + case KEYCTL_PKEY_ENCRYPT: ++ if (uparams.in_len > info.max_enc_size || ++ uparams.out_len > info.max_dec_size) ++ return -EINVAL; ++ ++ params->out_len = info.max_enc_size; ++ break; + case KEYCTL_PKEY_DECRYPT: + if (uparams.in_len > info.max_enc_size || + uparams.out_len > info.max_dec_size) + return -EINVAL; ++ ++ params->out_len = info.max_dec_size; + break; + case KEYCTL_PKEY_SIGN: ++ if (uparams.in_len > info.max_sig_size || ++ uparams.out_len > info.max_data_size) ++ return -EINVAL; ++ ++ params->out_len = info.max_sig_size; ++ break; + case KEYCTL_PKEY_VERIFY: + if (uparams.in_len > info.max_sig_size || + uparams.out_len > info.max_data_size) + return -EINVAL; ++ ++ params->out_len = info.max_sig_size; + break; + default: + BUG(); + } + + params->in_len = uparams.in_len; +- params->out_len = uparams.out_len; + return 0; + } + +-- +2.43.0 diff --git a/SOURCES/1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch b/SOURCES/1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch new file mode 100644 index 000000000..03f669582 --- /dev/null +++ b/SOURCES/1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch @@ -0,0 +1,111 @@ +From 9831bc9ecb402957810c2045c663fbfe9b09e296 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:35 +0800 +Subject: [PATCH] net: ip_gre: require CAP_NET_ADMIN in the device netns for + changelink + +commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 upstream. + +A tunnel changelink() operates on at most two netns, dev_net(dev) and +the tunnel link netns t->net. They differ once the device is created in +or moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in +net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is +skipped when the link netns is dev_net(dev), where the rtnl path already +checked it. The other patches in this series use the same helper. + +Gate ipgre_changelink() and erspan_changelink() with it, at the top of +the op before any attribute is parsed, because the parsers update live +tunnel fields first. ipgre_netlink_parms() sets t->collect_md before +ip_tunnel_changelink() runs. + +Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in +vti6_siocdevprivate().") added the same check on the ioctl path. This +adds it on RTM_NEWLINK. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: b57708add314 ("gre: add x-netns support") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-2-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +CVE-2026-63829 + +Backported from linux-6.12.y commit 9831bc9ecb402957810c2045c663fbfe9b09e296 +(mainline commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7). Context in +net/ipv4/ip_gre.c adjusted to the 5.14 el9_8 tree (function offsets only); +the added rtnl_dev_link_net_capable() helper and its call sites are +identical to upstream. All referenced helpers (net_eq, dev_net, ns_capable, +CAP_NET_ADMIN, struct ip_tunnel::net) already exist in this tree. +--- + include/net/rtnetlink.h | 2 ++ + net/core/rtnetlink.c | 8 ++++++++ + net/ipv4/ip_gre.c | 6 ++++++ + 3 files changed, 16 insertions(+) + +diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h +index 67baf74..34f2de4 100644 +--- a/include/net/rtnetlink.h ++++ b/include/net/rtnetlink.h +@@ -223,6 +223,8 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm, + int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer, + struct netlink_ext_ack *exterr); + struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid); ++bool rtnl_dev_link_net_capable(const struct net_device *dev, ++ const struct net *link_net); + + #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index cf61b88..499bea7 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2220,6 +2220,14 @@ struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid) + } + EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable); + ++bool rtnl_dev_link_net_capable(const struct net_device *dev, ++ const struct net *link_net) ++{ ++ return net_eq(link_net, dev_net(dev)) || ++ ns_capable(link_net->user_ns, CAP_NET_ADMIN); ++} ++EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable); ++ + static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh, + bool strict_check, struct nlattr **tb, + struct netlink_ext_ack *extack) +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 729c855..4483cfd 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -1431,6 +1431,9 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[], + __u32 fwmark = t->fwmark; + int err; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + err = ipgre_newlink_encap_setup(dev, data); + if (err) + return err; +@@ -1460,6 +1463,9 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[], + __u32 fwmark = t->fwmark; + int err; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + err = ipgre_newlink_encap_setup(dev, data); + if (err) + return err; +-- +2.50.1 (Apple Git-155) diff --git a/SOURCES/1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch b/SOURCES/1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch new file mode 100644 index 000000000..585028567 --- /dev/null +++ b/SOURCES/1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch @@ -0,0 +1,79 @@ +From 92cee08dc4f00e77fd1317e4343c5d458b0abab7 Mon Sep 17 00:00:00 2001 +From: Cole Leavitt +Date: Sat, 4 Apr 2026 22:41:44 -0700 +Subject: [PATCH] wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU + is disabled + +commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7 upstream. + +When the TLC notification disables AMSDU for a TID, the MLD driver sets +max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in +iwl_mld_tx_tso_segment() checks for zero but not for this sentinel, +allowing it to reach the num_subframes calculation: + + num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) + = (1 + 2) / (1534 + 2) = 0 + +This zero propagates to iwl_tx_tso_segment() which sets: + + gso_size = num_subframes * mss = 0 + +Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny +segments from a single GSO skb. This floods the TX ring with ~1024 +micro-frames (the rest are purged), creating a massive burst of TX +completion events that can lead to memory corruption and a subsequent +use-after-free in TCP's retransmit queue (refcount underflow in +tcp_shifted_skb, NULL deref in tcp_rack_detect_loss). + +The MVM driver is immune because it checks mvmsta->amsdu_enabled before +reaching the num_subframes calculation. The MLD driver has no equivalent +bitmap check and relies solely on max_tid_amsdu_len, which does not +catch the sentinel value. + +Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the +existing check and falling back to non-AMSDU TSO segmentation. Also add +a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth +to catch any future code paths that produce zero through a different +mechanism. + +Suggested-by: Miriam Rachel Korenblit +Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") +Signed-off-by: Cole Leavitt +Link: https://patch.msgid.link/20260405054145.1064152-3-cole@unwrap.rs +Signed-off-by: Miri Korenblit + +CVE-2026-64037 + +Backported from mainline commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7. +The iwlmld sub-driver (drivers/net/wireless/intel/iwlwifi/mld/) is present +in the 5.14 el9_8 tree and iwl_mld_tx_tso_segment() carries the vulnerable +pre-image verbatim, so the change applies with a line offset only. +--- + drivers/net/wireless/intel/iwlwifi/mld/tx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c +index 3b4b575..fef3db7 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c +@@ -823,7 +823,7 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, + return -EINVAL; + + max_tid_amsdu_len = sta->cur->max_tid_amsdu_len[tid]; +- if (!max_tid_amsdu_len) ++ if (!max_tid_amsdu_len || max_tid_amsdu_len == 1) + return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs); + + /* Sub frame header + SNAP + IP header + TCP header + MSS */ +@@ -835,6 +835,9 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, + */ + num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad); + ++ if (WARN_ON_ONCE(!num_subframes)) ++ return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs); ++ + if (sta->max_amsdu_subframes && + num_subframes > sta->max_amsdu_subframes) + num_subframes = sta->max_amsdu_subframes; +-- +2.50.1 (Apple Git-155) diff --git a/SOURCES/1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch b/SOURCES/1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch new file mode 100644 index 000000000..5c9da74b1 --- /dev/null +++ b/SOURCES/1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch @@ -0,0 +1,64 @@ +From 6ef30384a50a50e4a484cddf341bc27de31aa3de Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Fri, 15 May 2026 11:24:14 -0700 +Subject: [PATCH] ixgbevf: fix use-after-free in VEPA multicast source pruning + +commit 5d49b568c188dc77199d8d2b959c91da8cc27cf1 upstream. + +ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's +own address (VEPA multicast workaround) by freeing the skb and +continuing to the next descriptor: + + dev_kfree_skb_irq(skb); + continue; + +The skb pointer is declared outside the while loop and persists across +iterations. Because the continue skips the "skb = NULL" reset at the +bottom of the loop, the next iteration enters the "else if (skb)" path +and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing +skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. + +The sibling driver iavf already handles this correctly by nulling the +pointer before continuing. Apply the same pattern here. + +I do not have ixgbevf hardware; the bug was found by static analysis +(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool +corroboration with the highest score in the scan). The UAF was confirmed +under KASAN by loading a test module that reproduces the exact code +pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): + + BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 + Read of size 8 at addr 000000006163ae78 by task insmod/30 + freed 208-byte region [000000006163adc0, 000000006163ae90) + +QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF +driver does not include the VEPA source pruning path, so a full +end-to-end reproduction with emulated hardware was not possible. + +Fixes: bad17234ba70 ("ixgbevf: Change receive model to use double buffered page based receives") +Cc: stable@vger.kernel.org +Signed-off-by: Michael Bommarito +Reviewed-by: Simon Horman +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Link: https://patch.msgid.link/20260515182419.1597859-8-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +[ CVE-2026-64113: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 6ef30384a50a50e4a484cddf341bc27de31aa3de; applies cleanly, zero-fuzz. ] + +diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +index 3a05e458ded2..f0c864195c97 100644 +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -1220,6 +1220,7 @@ static int ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector, + ether_addr_equal(rx_ring->netdev->dev_addr, + eth_hdr(skb)->h_source)) { + dev_kfree_skb_irq(skb); ++ skb = NULL; + continue; + } + +-- +2.50.1 (Apple Git-155) + diff --git a/SOURCES/1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch b/SOURCES/1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch new file mode 100644 index 000000000..9b4866f9d --- /dev/null +++ b/SOURCES/1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch @@ -0,0 +1,73 @@ +From 21e87f336ac6303fed54a69b1d0d79a23b25c8d0 Mon Sep 17 00:00:00 2001 +From: Weiming Shi +Date: Wed, 15 Apr 2026 01:23:39 +0800 +Subject: [PATCH] i2c: stub: Reject I2C block transfers with invalid length + +commit 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e upstream. + +The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] +as the transfer length. The existing check only clamps it to avoid +overrunning the chip->words[256] register array, but does not validate +it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union +i2c_smbus_data.block buffer (34 bytes total). The driver is a +development/test tool (CONFIG_I2C_STUB=m, not built by default) +that must be loaded with a chip_addr= parameter. + +A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl +with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing +stub_xfer() to read or write past the end of the union +i2c_smbus_data.block buffer: + + BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223) + Read of size 1 at addr ffff88800abcfd92 by task exploit/81 + Call Trace: + + stub_xfer (drivers/i2c/i2c-stub.c:223) + __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593) + i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536) + i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391) + i2cdev_ioctl (drivers/i2c/i2c-dev.c:478) + __x64_sys_ioctl (fs/ioctl.c:583) + do_syscall_64 (arch/x86/entry/syscall_64.c:94) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) + + +The bug exists because i2c-stub implements .smbus_xfer directly, +bypassing the I2C_SMBUS_BLOCK_MAX validation in +i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same +function correctly validates against I2C_SMBUS_BLOCK_MAX, but the +I2C_SMBUS_I2C_BLOCK_DATA case does not. + +Fix by rejecting transfers with data->block[0] == 0 or +data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with +both the I2C_SMBUS_BLOCK_DATA case in the same function and the +I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated(). + +Fixes: 4710317891e4 ("i2c-stub: Implement I2C block support") +Reported-by: Xiang Mei +Signed-off-by: Weiming Shi +Reviewed-by: Jean Delvare +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +[ CVE-2026-64191: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 21e87f336ac6303fed54a69b1d0d79a23b25c8d0; applies cleanly, zero-fuzz. ] + +diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c +index d642cad219d9..3a2f472dd6b0 100644 +--- a/drivers/i2c/i2c-stub.c ++++ b/drivers/i2c/i2c-stub.c +@@ -214,6 +214,11 @@ static s32 stub_xfer(struct i2c_adapter *adap, u16 addr, unsigned short flags, + * We ignore banks here, because banked chips don't use I2C + * block transfers + */ ++ if (data->block[0] == 0 || ++ data->block[0] > I2C_SMBUS_BLOCK_MAX) { ++ ret = -EINVAL; ++ break; ++ } + if (data->block[0] > 256 - command) /* Avoid overrun */ + data->block[0] = 256 - command; + len = data->block[0]; +-- +2.50.1 (Apple Git-155) + diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 15b076512..0f493ebc5 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -176,13 +176,13 @@ Summary: The Linux kernel # define buildid .local %define specversion 5.14.0 %define patchversion 5.14 -%define pkgrelease 687.26.1 +%define pkgrelease 687.26.2 %define kversion 5 %define tarfile_release 5.14.0-687.26.1.el9_8 # This is needed to do merge window version magic %define patchlevel 14 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 687.26.1%{?buildid}%{?dist} +%define specrelease 687.26.2%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 5.14.0-687.26.1.el9_8 @@ -977,6 +977,14 @@ Patch2009: 0001-proc-fix-a-dentry-lock-race-between-release_task-and-lookup.patc Patch11111: ppc64le-kvm-support.patch +Patch1100: 1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch +Patch1101: 1101-nfsd-release-layout-stid-on-setlease-failure.patch +Patch1102: 1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch +Patch1103: 1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch +Patch1104: 1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch +Patch1105: 1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch +Patch1106: 1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch +Patch1107: 1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch # END OF PATCH DEFINITIONS %description @@ -1721,6 +1729,14 @@ ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch ApplyPatch 0001-Make-KVM-PMU-symbols-global-for-ppc64le-module-build.patch ApplyPatch 0001-proc-fix-a-dentry-lock-race-between-release_task-and-lookup.patch +ApplyPatch 1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch +ApplyPatch 1101-nfsd-release-layout-stid-on-setlease-failure.patch +ApplyPatch 1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch +ApplyPatch 1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch +ApplyPatch 1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch +ApplyPatch 1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch +ApplyPatch 1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch +ApplyPatch 1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch # END OF PATCH APPLICATIONS # Any further pre-build tree manipulations happen here. @@ -3795,6 +3811,16 @@ fi # # %changelog +* Tue Jul 21 2026 Andrew Lukoshko - 5.14.0-687.26.2 +- NFSD: Fix SECINFO_NO_NAME decode error cleanup (Guannan Wang) {CVE-2026-53398} +- nfsd: release layout stid on setlease failure (Chris Mason) {CVE-2026-53399} +- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (Ashutosh Desai) {CVE-2026-63794} +- KEYS: fix overflow in keyctl_pkey_params_get_2() (Jarkko Sakkinen) {CVE-2026-63824} +- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) {CVE-2026-63829} +- wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Cole Leavitt) {CVE-2026-64037} +- ixgbevf: fix use-after-free in VEPA multicast source pruning (Michael Bommarito) {CVE-2026-64113} +- i2c: stub: Reject I2C block transfers with invalid length (Weiming Shi) {CVE-2026-64191} + * Fri Jul 17 2026 Andrew Lukoshko - 5.14.0-687.26.1 - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024