diff --git a/.gitignore b/.gitignore index e4150d65e..c0b577bfc 100644 --- a/.gitignore +++ b/.gitignore @@ -1,11 +1,9 @@ -SOURCES/kernel-abi-stablelists-5.14.0-687.26.1.el9_8.tar.bz2 -SOURCES/kernel-kabi-dw-5.14.0-687.26.1.el9_8.tar.bz2 -SOURCES/linux-5.14.0-687.26.1.el9_8.tar.xz +SOURCES/kernel-abi-stablelists-5.14.0-687.29.1.el9_8.tar.bz2 +SOURCES/kernel-kabi-dw-5.14.0-687.29.1.el9_8.tar.bz2 +SOURCES/linux-5.14.0-687.29.1.el9_8.tar.xz SOURCES/nvidiabfdpu.x509 SOURCES/nvidiagpuoot001.x509 SOURCES/nvidiajetsonsoc.x509 -SOURCES/olima1.x509 -SOURCES/olimaca1.x509 SOURCES/redhatsecureboot504.cer SOURCES/rheldup3.x509 SOURCES/rhelima.x509 diff --git a/.kernel.metadata b/.kernel.metadata index bb41445a2..3927839a3 100644 --- a/.kernel.metadata +++ b/.kernel.metadata @@ -1,11 +1,9 @@ -ecb10db2ca8e447b44d19a331eb70c40ce03c009 SOURCES/kernel-abi-stablelists-5.14.0-687.26.1.el9_8.tar.bz2 -542db2884f8984e402a66e2ff46d56186af9079f SOURCES/kernel-kabi-dw-5.14.0-687.26.1.el9_8.tar.bz2 -6c56f44f19b7f6d3700b4d35896a4a7075aded4a SOURCES/linux-5.14.0-687.26.1.el9_8.tar.xz +cd32df0727c6c8efeafb2e17b8edab4378891a02 SOURCES/kernel-abi-stablelists-5.14.0-687.29.1.el9_8.tar.bz2 +3219167f81d484c7099eb75b5067e6b2d2707a14 SOURCES/kernel-kabi-dw-5.14.0-687.29.1.el9_8.tar.bz2 +da61672c23167ede24be0cd8207685b1a1185d81 SOURCES/linux-5.14.0-687.29.1.el9_8.tar.xz 3dc4997e0273ca116d52a52238a57403aba5dafb SOURCES/nvidiabfdpu.x509 4fff8080e88afffc06d8ef5004db8d53bb21237f SOURCES/nvidiagpuoot001.x509 18378ab150ef13ef65609224e10a2e8501d82915 SOURCES/nvidiajetsonsoc.x509 -706ae01dd14efa38f0f565a3706acac19c78df02 SOURCES/olima1.x509 -6e3f0d61414c0b50f48dc2d4c3b3cd024e1c3a43 SOURCES/olimaca1.x509 1d51d3a037ad287095b0a13c4deeb1252d8ff0cc SOURCES/redhatsecureboot504.cer 95b9b811c7b0a6c98b2eafc4e7d6d24f2cb63289 SOURCES/rheldup3.x509 99e571f9de4188f3b5fdf1f84ff73f6cc4bb6a0e SOURCES/rhelima.x509 diff --git a/SOURCES/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch b/SOURCES/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch deleted file mode 100644 index faae384bb..000000000 --- a/SOURCES/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439 Mon Sep 17 00:00:00 2001 -From: Guannan Wang -Date: Thu, 21 May 2026 16:03:32 +0800 -Subject: [PATCH] NFSD: Fix SECINFO_NO_NAME decode error cleanup - -commit 9e18e83b8846a5c3fe13fc8a464b4865d33996c6 upstream. - -nfsd4_decode_secinfo_no_name() currently initializes sin_exp after -decoding sin_style. If the XDR stream is truncated, the decoder returns -nfserr_bad_xdr before sin_exp is initialized. - -Since commit 3fdc54646234 ("NFSD: Reduce amount of struct -nfsd4_compoundargs that needs clearing"), the inline iops array is not -cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore -leave sin_exp holding stale union contents from a previous operation. - -The error response path still invokes nfsd4_secinfo_no_name_release(), -which calls exp_put() on a non-NULL sin_exp. - -Initialize sin_exp before the first failable decode step, matching -nfsd4_decode_secinfo(). - -Fixes: 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing") -Cc: stable@vger.kernel.org -Signed-off-by: Guannan Wang -Signed-off-by: Chuck Lever -Signed-off-by: Greg Kroah-Hartman - -[ CVE-2026-53398: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439; applies cleanly, zero-fuzz. ] - -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index e02c5650e2ac..4f1df2f6880c 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -1821,10 +1821,11 @@ static __be32 nfsd4_decode_secinfo_no_name(struct nfsd4_compoundargs *argp, - union nfsd4_op_u *u) - { - struct nfsd4_secinfo_no_name *sin = &u->secinfo_no_name; -+ -+ sin->sin_exp = NULL; - if (xdr_stream_decode_u32(argp->xdr, &sin->sin_style) < 0) - return nfserr_bad_xdr; - -- sin->sin_exp = NULL; - return nfs_ok; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1101-nfsd-release-layout-stid-on-setlease-failure.patch b/SOURCES/1101-nfsd-release-layout-stid-on-setlease-failure.patch deleted file mode 100644 index 52f48ed95..000000000 --- a/SOURCES/1101-nfsd-release-layout-stid-on-setlease-failure.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 Mon Sep 17 00:00:00 2001 -From: Chris Mason -Date: Mon, 18 May 2026 13:16:36 -0700 -Subject: [PATCH] nfsd: release layout stid on setlease failure - -CVE-2026-53399 - -Upstream commit: 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 - -nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via -idr_alloc_cyclic() under cl_lock before returning to -nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then -fails, the error path frees the layout stateid directly with -kmem_cache_free() without ever calling idr_remove(), leaving the -IDR slot pointing at freed slab memory. Any subsequent IDR walker -(states_show, client teardown) dereferences the dangling pointer. - -The correct teardown for an IDR-published stid is nfs4_put_stid(), -which removes the IDR slot under cl_lock, dispatches sc_free -(nfsd4_free_layout_stateid) to release ls->ls_file via -nfsd4_close_layout(), and drops the nfs4_file reference in its -tail. - -Replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free -cleanup with a single nfs4_put_stid(stp). - -Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") -Cc: stable@vger.kernel.org -Assisted-by: kres (claude-opus-4-7) -Signed-off-by: Chris Mason -Reviewed-by: Jeff Layton -Signed-off-by: Chuck Lever -[ Backported to AlmaLinux 9 (5.14.0-687.26.1.el9_8). This kernel - predates the ls_fence_work delayed_work in struct - nfs4_layout_stateid, so nfsd4_free_layout_stateid() never inspects - an uninitialized delayed_work on the failure path. The - ls_fenced/ls_fence_delay/INIT_DELAYED_WORK hoisting hunk of the - mainline commit is therefore not applicable and is dropped, leaving - only the nfs4_put_stid() cleanup replacement (matches the 6.12.y - stable backport d369e5edfaaf). ] ---- -diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c -index 1cfd61d..32c957e 100644 ---- a/fs/nfsd/nfs4layouts.c -+++ b/fs/nfsd/nfs4layouts.c -@@ -258,9 +258,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate, - BUG_ON(!ls->ls_file); - - if (nfsd4_layout_setlease(ls)) { -- nfsd_file_put(ls->ls_file); -- put_nfs4_file(fp); -- kmem_cache_free(nfs4_layout_stateid_cache, ls); -+ nfs4_put_stid(stp); - return NULL; - } - --- -2.43.0 diff --git a/SOURCES/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch b/SOURCES/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch deleted file mode 100644 index f12158b0b..000000000 --- a/SOURCES/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch +++ /dev/null @@ -1,96 +0,0 @@ -From 64f2449841ffc7d203183aa4c748c9c77951ecc5 Mon Sep 17 00:00:00 2001 -From: Ashutosh Desai -Date: Fri, 1 May 2026 13:35:32 -0700 -Subject: [PATCH] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT - path - -commit 78ee2d50185a037b3d2452a97f3dad69c3f7f389 upstream. - -In sev_dbg_crypt(), the per-iteration transfer length is bounded by -the source page offset (PAGE_SIZE - s_off) but not by the destination -page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt -path (__sev_dbg_encrypt_user) performs a read-modify-write using a -single-page intermediate buffer (dst_tpage): - - 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16) - before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, - the PSP writes beyond the end of the 4096-byte dst_tpage allocation. - - 2. The subsequent memcpy()/copy_from_user() into - page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows - by up to 15 bytes under the same condition. - -Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE - -the PSP is instructed to write round_up(4097, 16) = 4112 bytes to -a 4096-byte buffer. - -Fix by also bounding len by (PAGE_SIZE - d_off), the same check that -sev_send_update_data() already performs for its single-page guest -region. - - ================================================================== - BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd] - Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214 - - CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY - Tainted: [U]=USER, [W]=WARN - Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025 - Call Trace: - - dump_stack_lvl+0x54/0x70 - print_report+0xbc/0x260 - kasan_report+0xa2/0xd0 - kasan_check_range+0x25f/0x2c0 - __asan_memcpy+0x40/0x70 - sev_dbg_crypt+0x993/0xd10 [kvm_amd] - sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd] - kvm_vm_ioctl+0x65d/0x6d0 [kvm] - __se_sys_ioctl+0xb2/0x100 - do_syscall_64+0xe8/0x870 - entry_SYSCALL_64_after_hwframe+0x4b/0x53 - - - The buggy address belongs to the physical page: - page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb - memcg:ff11000112827d82 - flags: 0x1400000000000000(node=1|zone=1) - raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000 - raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82 - page dumped because: kasan: bad access detected - - Memory state around the buggy address: - ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc - ^ - ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc - ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc - ================================================================== - Disabling lock debugging due to kernel taint - -Fixes: 24f41fb23a39 ("KVM: SVM: Add support for SEV DEBUG_DECRYPT command") -Fixes: 7d1594f5d94b ("KVM: SVM: Add support for SEV DEBUG_ENCRYPT command") -Cc: stable@vger.kernel.org -Signed-off-by: Ashutosh Desai -[sean: add sample KASAN splat, Fixes, and stable@] -Link: https://patch.msgid.link/20260501203537.2120074-2-seanjc@google.com -Signed-off-by: Sean Christopherson -Signed-off-by: Greg Kroah-Hartman - -[ CVE-2026-63794: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 64f2449841ffc7d203183aa4c748c9c77951ecc5; applies cleanly, zero-fuzz. ] - -diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c -index c40a65056aa8..aa6a54fed588 100644 ---- a/arch/x86/kvm/svm/sev.c -+++ b/arch/x86/kvm/svm/sev.c -@@ -954,6 +954,7 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec) - s_off = vaddr & ~PAGE_MASK; - d_off = dst_vaddr & ~PAGE_MASK; - len = min_t(size_t, (PAGE_SIZE - s_off), size); -+ len = min_t(size_t, len, PAGE_SIZE - d_off); - - if (dec) - ret = __sev_dbg_decrypt_user(kvm, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch b/SOURCES/1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch deleted file mode 100644 index 8c5826860..000000000 --- a/SOURCES/1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch +++ /dev/null @@ -1,83 +0,0 @@ -From b1e247338bc71826a2d2def3e0874c34749df69a Mon Sep 17 00:00:00 2001 -From: Jarkko Sakkinen -Date: Mon, 1 Jun 2026 23:11:54 +0300 -Subject: [PATCH] KEYS: fix overflow in keyctl_pkey_params_get_2() - -CVE-2026-63824 - -Upstream commit: cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b -Backport of stable 5.15.y commit: b1e247338bc71826a2d2def3e0874c34749df69a - -The length for the internal output buffer is calculated incorrectly, which -can result overflow when a too small buffer is provided. - -Fix the bug by allocating internal output with the size of the maximum -length of the cryptographic primitive instead of caller provided size. - -Link: https://lore.kernel.org/keyrings/20260531024914.3712130-1-jarkko@kernel.org/ -Cc: stable@vger.kernel.org # v4.20+ -Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]") -Reported-by: Alessandro Groppo -Tested-by: Alessandro Groppo -Signed-off-by: Jarkko Sakkinen -Signed-off-by: Greg Kroah-Hartman -[ Backported to AlmaLinux 9 (5.14.0-687.26.1.el9_8). This kernel does - not carry commit c51abd96837f ("KEYS: fix length validation in - keyctl_pkey_params_get_2()"), so keyctl_pkey_params_get_2() still has - the original combined ENCRYPT/DECRYPT and SIGN/VERIFY switch cases - that the upstream fix's context assumes are already split. Adapt by - splitting the four cases (preserving this kernel's existing length - validation expressions unchanged) so the per-operation - params->out_len assignment introduced by the fix can be applied, and - drop the trailing "params->out_len = uparams.out_len;". The internal - output buffer is now sized to the cryptographic primitive maximum - (max_enc_size / max_dec_size / max_sig_size) rather than the - caller-supplied length, which is the same semantic change as - upstream. ] ---- -diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c -index 5de0d59..d862c38 100644 ---- a/security/keys/keyctl_pkey.c -+++ b/security/keys/keyctl_pkey.c -@@ -135,23 +135,38 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par - - switch (op) { - case KEYCTL_PKEY_ENCRYPT: -+ if (uparams.in_len > info.max_enc_size || -+ uparams.out_len > info.max_dec_size) -+ return -EINVAL; -+ -+ params->out_len = info.max_enc_size; -+ break; - case KEYCTL_PKEY_DECRYPT: - if (uparams.in_len > info.max_enc_size || - uparams.out_len > info.max_dec_size) - return -EINVAL; -+ -+ params->out_len = info.max_dec_size; - break; - case KEYCTL_PKEY_SIGN: -+ if (uparams.in_len > info.max_sig_size || -+ uparams.out_len > info.max_data_size) -+ return -EINVAL; -+ -+ params->out_len = info.max_sig_size; -+ break; - case KEYCTL_PKEY_VERIFY: - if (uparams.in_len > info.max_sig_size || - uparams.out_len > info.max_data_size) - return -EINVAL; -+ -+ params->out_len = info.max_sig_size; - break; - default: - BUG(); - } - - params->in_len = uparams.in_len; -- params->out_len = uparams.out_len; - return 0; - } - --- -2.43.0 diff --git a/SOURCES/1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch b/SOURCES/1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch deleted file mode 100644 index 03f669582..000000000 --- a/SOURCES/1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch +++ /dev/null @@ -1,111 +0,0 @@ -From 9831bc9ecb402957810c2045c663fbfe9b09e296 Mon Sep 17 00:00:00 2001 -From: Maoyi Xie -Date: Fri, 12 Jun 2026 16:59:35 +0800 -Subject: [PATCH] net: ip_gre: require CAP_NET_ADMIN in the device netns for - changelink - -commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 upstream. - -A tunnel changelink() operates on at most two netns, dev_net(dev) and -the tunnel link netns t->net. They differ once the device is created in -or moved to a netns other than the one the request runs in. The rtnl -changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a -caller privileged there but not in t->net can rewrite a tunnel that -lives in t->net. - -Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in -net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is -skipped when the link netns is dev_net(dev), where the rtnl path already -checked it. The other patches in this series use the same helper. - -Gate ipgre_changelink() and erspan_changelink() with it, at the top of -the op before any attribute is parsed, because the parsers update live -tunnel fields first. ipgre_netlink_parms() sets t->collect_md before -ip_tunnel_changelink() runs. - -Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in -vti6_siocdevprivate().") added the same check on the ioctl path. This -adds it on RTM_NEWLINK. - -Reported-by: Xiao Liang -Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ -Fixes: b57708add314 ("gre: add x-netns support") -Cc: stable@vger.kernel.org -Signed-off-by: Maoyi Xie -Reviewed-by: Kuniyuki Iwashima -Link: https://patch.msgid.link/20260612085941.3158249-2-maoyixie.tju@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman - -CVE-2026-63829 - -Backported from linux-6.12.y commit 9831bc9ecb402957810c2045c663fbfe9b09e296 -(mainline commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7). Context in -net/ipv4/ip_gre.c adjusted to the 5.14 el9_8 tree (function offsets only); -the added rtnl_dev_link_net_capable() helper and its call sites are -identical to upstream. All referenced helpers (net_eq, dev_net, ns_capable, -CAP_NET_ADMIN, struct ip_tunnel::net) already exist in this tree. ---- - include/net/rtnetlink.h | 2 ++ - net/core/rtnetlink.c | 8 ++++++++ - net/ipv4/ip_gre.c | 6 ++++++ - 3 files changed, 16 insertions(+) - -diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h -index 67baf74..34f2de4 100644 ---- a/include/net/rtnetlink.h -+++ b/include/net/rtnetlink.h -@@ -223,6 +223,8 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm, - int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer, - struct netlink_ext_ack *exterr); - struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid); -+bool rtnl_dev_link_net_capable(const struct net_device *dev, -+ const struct net *link_net); - - #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind) - -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index cf61b88..499bea7 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -2220,6 +2220,14 @@ struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid) - } - EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable); - -+bool rtnl_dev_link_net_capable(const struct net_device *dev, -+ const struct net *link_net) -+{ -+ return net_eq(link_net, dev_net(dev)) || -+ ns_capable(link_net->user_ns, CAP_NET_ADMIN); -+} -+EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable); -+ - static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh, - bool strict_check, struct nlattr **tb, - struct netlink_ext_ack *extack) -diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c -index 729c855..4483cfd 100644 ---- a/net/ipv4/ip_gre.c -+++ b/net/ipv4/ip_gre.c -@@ -1431,6 +1431,9 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[], - __u32 fwmark = t->fwmark; - int err; - -+ if (!rtnl_dev_link_net_capable(dev, t->net)) -+ return -EPERM; -+ - err = ipgre_newlink_encap_setup(dev, data); - if (err) - return err; -@@ -1460,6 +1463,9 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[], - __u32 fwmark = t->fwmark; - int err; - -+ if (!rtnl_dev_link_net_capable(dev, t->net)) -+ return -EPERM; -+ - err = ipgre_newlink_encap_setup(dev, data); - if (err) - return err; --- -2.50.1 (Apple Git-155) diff --git a/SOURCES/1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch b/SOURCES/1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch deleted file mode 100644 index 585028567..000000000 --- a/SOURCES/1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 92cee08dc4f00e77fd1317e4343c5d458b0abab7 Mon Sep 17 00:00:00 2001 -From: Cole Leavitt -Date: Sat, 4 Apr 2026 22:41:44 -0700 -Subject: [PATCH] wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU - is disabled - -commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7 upstream. - -When the TLC notification disables AMSDU for a TID, the MLD driver sets -max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in -iwl_mld_tx_tso_segment() checks for zero but not for this sentinel, -allowing it to reach the num_subframes calculation: - - num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) - = (1 + 2) / (1534 + 2) = 0 - -This zero propagates to iwl_tx_tso_segment() which sets: - - gso_size = num_subframes * mss = 0 - -Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny -segments from a single GSO skb. This floods the TX ring with ~1024 -micro-frames (the rest are purged), creating a massive burst of TX -completion events that can lead to memory corruption and a subsequent -use-after-free in TCP's retransmit queue (refcount underflow in -tcp_shifted_skb, NULL deref in tcp_rack_detect_loss). - -The MVM driver is immune because it checks mvmsta->amsdu_enabled before -reaching the num_subframes calculation. The MLD driver has no equivalent -bitmap check and relies solely on max_tid_amsdu_len, which does not -catch the sentinel value. - -Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the -existing check and falling back to non-AMSDU TSO segmentation. Also add -a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth -to catch any future code paths that produce zero through a different -mechanism. - -Suggested-by: Miriam Rachel Korenblit -Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") -Signed-off-by: Cole Leavitt -Link: https://patch.msgid.link/20260405054145.1064152-3-cole@unwrap.rs -Signed-off-by: Miri Korenblit - -CVE-2026-64037 - -Backported from mainline commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7. -The iwlmld sub-driver (drivers/net/wireless/intel/iwlwifi/mld/) is present -in the 5.14 el9_8 tree and iwl_mld_tx_tso_segment() carries the vulnerable -pre-image verbatim, so the change applies with a line offset only. ---- - drivers/net/wireless/intel/iwlwifi/mld/tx.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c -index 3b4b575..fef3db7 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c -+++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c -@@ -823,7 +823,7 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, - return -EINVAL; - - max_tid_amsdu_len = sta->cur->max_tid_amsdu_len[tid]; -- if (!max_tid_amsdu_len) -+ if (!max_tid_amsdu_len || max_tid_amsdu_len == 1) - return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs); - - /* Sub frame header + SNAP + IP header + TCP header + MSS */ -@@ -835,6 +835,9 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, - */ - num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad); - -+ if (WARN_ON_ONCE(!num_subframes)) -+ return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs); -+ - if (sta->max_amsdu_subframes && - num_subframes > sta->max_amsdu_subframes) - num_subframes = sta->max_amsdu_subframes; --- -2.50.1 (Apple Git-155) diff --git a/SOURCES/1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch b/SOURCES/1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch deleted file mode 100644 index 5c9da74b1..000000000 --- a/SOURCES/1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 6ef30384a50a50e4a484cddf341bc27de31aa3de Mon Sep 17 00:00:00 2001 -From: Michael Bommarito -Date: Fri, 15 May 2026 11:24:14 -0700 -Subject: [PATCH] ixgbevf: fix use-after-free in VEPA multicast source pruning - -commit 5d49b568c188dc77199d8d2b959c91da8cc27cf1 upstream. - -ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's -own address (VEPA multicast workaround) by freeing the skb and -continuing to the next descriptor: - - dev_kfree_skb_irq(skb); - continue; - -The skb pointer is declared outside the while loop and persists across -iterations. Because the continue skips the "skb = NULL" reset at the -bottom of the loop, the next iteration enters the "else if (skb)" path -and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing -skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. - -The sibling driver iavf already handles this correctly by nulling the -pointer before continuing. Apply the same pattern here. - -I do not have ixgbevf hardware; the bug was found by static analysis -(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool -corroboration with the highest score in the scan). The UAF was confirmed -under KASAN by loading a test module that reproduces the exact code -pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): - - BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 - Read of size 8 at addr 000000006163ae78 by task insmod/30 - freed 208-byte region [000000006163adc0, 000000006163ae90) - -QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF -driver does not include the VEPA source pruning path, so a full -end-to-end reproduction with emulated hardware was not possible. - -Fixes: bad17234ba70 ("ixgbevf: Change receive model to use double buffered page based receives") -Cc: stable@vger.kernel.org -Signed-off-by: Michael Bommarito -Reviewed-by: Simon Horman -Tested-by: Rafal Romanowski -Signed-off-by: Tony Nguyen -Link: https://patch.msgid.link/20260515182419.1597859-8-anthony.l.nguyen@intel.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman - -[ CVE-2026-64113: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 6ef30384a50a50e4a484cddf341bc27de31aa3de; applies cleanly, zero-fuzz. ] - -diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -index 3a05e458ded2..f0c864195c97 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -@@ -1220,6 +1220,7 @@ static int ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector, - ether_addr_equal(rx_ring->netdev->dev_addr, - eth_hdr(skb)->h_source)) { - dev_kfree_skb_irq(skb); -+ skb = NULL; - continue; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch b/SOURCES/1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch deleted file mode 100644 index 9b4866f9d..000000000 --- a/SOURCES/1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 21e87f336ac6303fed54a69b1d0d79a23b25c8d0 Mon Sep 17 00:00:00 2001 -From: Weiming Shi -Date: Wed, 15 Apr 2026 01:23:39 +0800 -Subject: [PATCH] i2c: stub: Reject I2C block transfers with invalid length - -commit 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e upstream. - -The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] -as the transfer length. The existing check only clamps it to avoid -overrunning the chip->words[256] register array, but does not validate -it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union -i2c_smbus_data.block buffer (34 bytes total). The driver is a -development/test tool (CONFIG_I2C_STUB=m, not built by default) -that must be loaded with a chip_addr= parameter. - -A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl -with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing -stub_xfer() to read or write past the end of the union -i2c_smbus_data.block buffer: - - BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223) - Read of size 1 at addr ffff88800abcfd92 by task exploit/81 - Call Trace: - - stub_xfer (drivers/i2c/i2c-stub.c:223) - __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593) - i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536) - i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391) - i2cdev_ioctl (drivers/i2c/i2c-dev.c:478) - __x64_sys_ioctl (fs/ioctl.c:583) - do_syscall_64 (arch/x86/entry/syscall_64.c:94) - entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) - - -The bug exists because i2c-stub implements .smbus_xfer directly, -bypassing the I2C_SMBUS_BLOCK_MAX validation in -i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same -function correctly validates against I2C_SMBUS_BLOCK_MAX, but the -I2C_SMBUS_I2C_BLOCK_DATA case does not. - -Fix by rejecting transfers with data->block[0] == 0 or -data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with -both the I2C_SMBUS_BLOCK_DATA case in the same function and the -I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated(). - -Fixes: 4710317891e4 ("i2c-stub: Implement I2C block support") -Reported-by: Xiang Mei -Signed-off-by: Weiming Shi -Reviewed-by: Jean Delvare -Signed-off-by: Wolfram Sang -Signed-off-by: Greg Kroah-Hartman - -[ CVE-2026-64191: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from linux-5.15.y commit 21e87f336ac6303fed54a69b1d0d79a23b25c8d0; applies cleanly, zero-fuzz. ] - -diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c -index d642cad219d9..3a2f472dd6b0 100644 ---- a/drivers/i2c/i2c-stub.c -+++ b/drivers/i2c/i2c-stub.c -@@ -214,6 +214,11 @@ static s32 stub_xfer(struct i2c_adapter *adap, u16 addr, unsigned short flags, - * We ignore banks here, because banked chips don't use I2C - * block transfers - */ -+ if (data->block[0] == 0 || -+ data->block[0] > I2C_SMBUS_BLOCK_MAX) { -+ ret = -EINVAL; -+ break; -+ } - if (data->block[0] > 256 - command) /* Avoid overrun */ - data->block[0] = 256 - command; - len = data->block[0]; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1108-scsi-target-iscsi-validate-chap-r-length-before-base.patch b/SOURCES/1108-scsi-target-iscsi-validate-chap-r-length-before-base.patch deleted file mode 100644 index 5e6a42745..000000000 --- a/SOURCES/1108-scsi-target-iscsi-validate-chap-r-length-before-base.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6 Mon Sep 17 00:00:00 2001 -From: Alexandru Hossu -Date: Thu, 21 May 2026 17:11:21 +0200 -Subject: [PATCH] scsi: target: iscsi: Validate CHAP_R length before base64 - decode - -commit 85db7391310b1304d2dc8ae3b0b12105a9567147 upstream. - -chap_server_compute_hash() allocates client_digest as -kzalloc(chap->digest_size) and then, for BASE64-encoded responses, -passes chap_r directly to chap_base64_decode() without checking whether -the input length could produce more than digest_size bytes of output. - -chap_base64_decode() writes to the destination unconditionally as long -as there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and -the "0b" prefix stripped by extract_param(), up to 127 base64 characters -can reach the decoder. 127 characters decode to 95 bytes. For SHA-256 -(digest_size=32) this overflows client_digest by 63 bytes; for MD5 -(digest_size=16) the overflow is 79 bytes. - -The length check at line 344 fires after the write has already happened. - -The HEX branch in the same switch statement already validates the length -up front. Apply the same approach to the BASE64 branch: strip trailing -base64 padding characters, then reject any input whose data length -exceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder. - -Stripping trailing '=' before the comparison handles both padded and -unpadded encodings. chap_base64_decode() already returns early on '=', -so the full original string is still passed to the decoder unchanged. - -The mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is -kzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at -CHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1 -base64 characters reach the decoder. The maximum decoded size, -DIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than -CHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is -added at the call site to document this. - -Fixes: 1e5733883421 ("scsi: target: iscsi: Support base64 in CHAP") -Cc: stable@vger.kernel.org -Signed-off-by: Alexandru Hossu -Reviewed-by: David Disseldorp -Link: https://patch.msgid.link/20260521151121.808477-1-hossu.alexandru@gmail.com -Signed-off-by: Martin K. Petersen -Signed-off-by: Greg Kroah-Hartman -CVE: CVE-2026-63886 -[ Backported to AlmaLinux 9 from linux-6.1.y commit 82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6 (backport of mainline - 85db7391310b). Not present in linux-5.15.y; 6.1.y is the lowest stable branch - carrying it. Applied to 5.14.0-687.26.1.el9_8 with hunk offsets adjusted; the - change is otherwise identical. ] -Signed-off-by: Andrew Lukoshko - -diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c -index c8a248b..02a4c9a 100644 ---- a/drivers/target/iscsi/iscsi_target_auth.c -+++ b/drivers/target/iscsi/iscsi_target_auth.c -@@ -339,13 +339,22 @@ static int chap_server_compute_hash( - goto out; - } - break; -- case BASE64: -+ case BASE64: { -+ size_t r_len = strlen(chap_r); -+ -+ while (r_len > 0 && chap_r[r_len - 1] == '=') -+ r_len--; -+ if (r_len > DIV_ROUND_UP(chap->digest_size * 4, 3)) { -+ pr_err("Malformed CHAP_R: base64 payload too long\n"); -+ goto out; -+ } - if (chap_base64_decode(client_digest, chap_r, strlen(chap_r)) != - chap->digest_size) { - pr_err("Malformed CHAP_R: invalid BASE64\n"); - goto out; - } - break; -+ } - default: - pr_err("Could not find CHAP_R\n"); - goto out; -@@ -472,6 +481,14 @@ static int chap_server_compute_hash( - } - break; - case BASE64: -+ /* -+ * No overflow check needed: initiatorchg_binhex is -+ * CHAP_CHALLENGE_STR_LEN bytes and extract_param() caps -+ * initiatorchg at CHAP_CHALLENGE_STR_LEN characters, so -+ * the decoded output is at most DIV_ROUND_UP( -+ * (CHAP_CHALLENGE_STR_LEN - 1) * 3, 4) bytes, which is -+ * less than CHAP_CHALLENGE_STR_LEN. -+ */ - initiatorchg_len = chap_base64_decode(initiatorchg_binhex, - initiatorchg, - strlen(initiatorchg)); --- -2.50.1 diff --git a/SOURCES/1109-scsi-target-iscsi-bound-iscsi-encode-text-output-app.patch b/SOURCES/1109-scsi-target-iscsi-bound-iscsi-encode-text-output-app.patch deleted file mode 100644 index 8beef89b7..000000000 --- a/SOURCES/1109-scsi-target-iscsi-bound-iscsi-encode-text-output-app.patch +++ /dev/null @@ -1,207 +0,0 @@ -From b19382dfc6e7dee6d3859ba44b6ca29e97a51627 Mon Sep 17 00:00:00 2001 -From: Michael Bommarito -Date: Fri, 5 Jun 2026 16:34:05 -0400 -Subject: [PATCH] scsi: target: iscsi: Bound iscsi_encode_text_output() appends - to rsp_buf - -[ Upstream commit bf33e01f88388c43e285492a63e539df6ffed64c ] - -iscsi_encode_text_output() concatenates "key=value\0" records into -login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer -allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call -sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check -the remaining buffer capacity: - - *length += sprintf(output_buf, "%s=%s", er->key, er->value); - *length += 1; - output_buf = textbuf + *length; - -The 8192-byte ceiling at iscsi_target_check_login_request() bounds the -*input* Login PDU payload, but a single PDU can carry up to 2048 minimal -four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte -"a=NotUnderstood\0" output record via iscsi_add_notunderstood_response(). -2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB -heap overrun in the kmalloc-8k slab. - -The fix introduces a static iscsi_encode_text_record() helper that uses -snprintf() with a per-call bounds check against the remaining buffer, -and threads a u32 textbuf_size parameter through -iscsi_encode_text_output(). Both call sites in -iscsi_target_handle_csg_zero() (PHASE_SECURITY) and -iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass -MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls -iscsi_release_extra_responses() to drop queued records, and returns -1; -both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR / -ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning, -so the initiator sees an explicit failed-login response rather than a -silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL -caller did that; the PHASE_SECURITY caller is converted to the same -shape.) - -Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") -Cc: stable@vger.kernel.org -Assisted-by: Claude:claude-opus-4-7 -Signed-off-by: Michael Bommarito -Tested-by: John Garry -Reviewed-by: John Garry -Signed-off-by: Martin K. Petersen -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman -CVE: CVE-2026-63887 -[ Backported to AlmaLinux 9 from linux-5.15.y commit b19382dfc6e7dee6d3859ba44b6ca29e97a51627 (backport of mainline - bf33e01f8838). Applied to 5.14.0-687.26.1.el9_8 with hunk offsets adjusted for - the el9 tree; the change is otherwise identical. ] -Signed-off-by: Andrew Lukoshko - -diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c -index 108e253..a1fb869 100644 ---- a/drivers/target/iscsi/iscsi_target_nego.c -+++ b/drivers/target/iscsi/iscsi_target_nego.c -@@ -899,10 +899,14 @@ static int iscsi_target_handle_csg_zero( - SENDER_TARGET, - login->rsp_buf, - &login->rsp_length, -+ MAX_KEY_VALUE_PAIRS, - conn->param_list, - conn->tpg->tpg_attrib.login_keys_workaround); -- if (ret < 0) -+ if (ret < 0) { -+ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_INITIATOR_ERR, -+ ISCSI_LOGIN_STATUS_INIT_ERR); - return -1; -+ } - - if (!iscsi_check_negotiated_keys(conn->param_list)) { - bool auth_required = iscsi_conn_auth_required(conn); -@@ -986,6 +990,7 @@ static int iscsi_target_handle_csg_one(struct iscsit_conn *conn, struct iscsi_lo - SENDER_TARGET, - login->rsp_buf, - &login->rsp_length, -+ MAX_KEY_VALUE_PAIRS, - conn->param_list, - conn->tpg->tpg_attrib.login_keys_workaround); - if (ret < 0) { -diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c -index 5b90c22..5e15c2e 100644 ---- a/drivers/target/iscsi/iscsi_target_parameters.c -+++ b/drivers/target/iscsi/iscsi_target_parameters.c -@@ -1419,19 +1419,42 @@ free_buffer: - return -1; - } - -+/* -+ * Append "key=value" plus a trailing NUL into @textbuf at *@length. -+ * Returns 0 on success and advances *@length, or -EMSGSIZE if the -+ * record (including the NUL) would not fit in the remaining buffer. -+ */ -+static int iscsi_encode_text_record(char *textbuf, u32 *length, -+ u32 textbuf_size, -+ const char *key, const char *value) -+{ -+ int n; -+ u32 avail; -+ -+ if (*length >= textbuf_size) -+ return -EMSGSIZE; -+ -+ avail = textbuf_size - *length; -+ n = snprintf(textbuf + *length, avail, "%s=%s", key, value); -+ if (n < 0 || (u32)n + 1 > avail) -+ return -EMSGSIZE; -+ -+ *length += n + 1; -+ return 0; -+} -+ - int iscsi_encode_text_output( - u8 phase, - u8 sender, - char *textbuf, - u32 *length, -+ u32 textbuf_size, - struct iscsi_param_list *param_list, - bool keys_workaround) - { -- char *output_buf = NULL; - struct iscsi_extra_response *er; - struct iscsi_param *param; -- -- output_buf = textbuf + *length; -+ int ret; - - if (iscsi_enforce_integrity_rules(phase, param_list) < 0) - return -1; -@@ -1443,10 +1466,12 @@ int iscsi_encode_text_output( - !IS_PSTATE_RESPONSE_SENT(param) && - !IS_PSTATE_REPLY_OPTIONAL(param) && - (param->phase & phase)) { -- *length += sprintf(output_buf, "%s=%s", -- param->name, param->value); -- *length += 1; -- output_buf = textbuf + *length; -+ ret = iscsi_encode_text_record(textbuf, length, -+ textbuf_size, -+ param->name, -+ param->value); -+ if (ret < 0) -+ goto err_overflow; - SET_PSTATE_RESPONSE_SENT(param); - pr_debug("Sending key: %s=%s\n", - param->name, param->value); -@@ -1456,10 +1481,12 @@ int iscsi_encode_text_output( - !IS_PSTATE_ACCEPTOR(param) && - !IS_PSTATE_PROPOSER(param) && - (param->phase & phase)) { -- *length += sprintf(output_buf, "%s=%s", -- param->name, param->value); -- *length += 1; -- output_buf = textbuf + *length; -+ ret = iscsi_encode_text_record(textbuf, length, -+ textbuf_size, -+ param->name, -+ param->value); -+ if (ret < 0) -+ goto err_overflow; - SET_PSTATE_PROPOSER(param); - iscsi_check_proposer_for_optional_reply(param, - keys_workaround); -@@ -1469,14 +1496,21 @@ int iscsi_encode_text_output( - } - - list_for_each_entry(er, ¶m_list->extra_response_list, er_list) { -- *length += sprintf(output_buf, "%s=%s", er->key, er->value); -- *length += 1; -- output_buf = textbuf + *length; -+ ret = iscsi_encode_text_record(textbuf, length, textbuf_size, -+ er->key, er->value); -+ if (ret < 0) -+ goto err_overflow; - pr_debug("Sending key: %s=%s\n", er->key, er->value); - } - iscsi_release_extra_responses(param_list); - - return 0; -+ -+err_overflow: -+ pr_err("iSCSI login response buffer (%u bytes) exhausted, dropping login.\n", -+ textbuf_size); -+ iscsi_release_extra_responses(param_list); -+ return -1; - } - - int iscsi_check_negotiated_keys(struct iscsi_param_list *param_list) -diff --git a/drivers/target/iscsi/iscsi_target_parameters.h b/drivers/target/iscsi/iscsi_target_parameters.h -index 00fbbeb..d6cbe5d 100644 ---- a/drivers/target/iscsi/iscsi_target_parameters.h -+++ b/drivers/target/iscsi/iscsi_target_parameters.h -@@ -46,7 +46,7 @@ extern struct iscsi_param *iscsi_find_param_from_key(char *, struct iscsi_param_ - extern int iscsi_extract_key_value(char *, char **, char **); - extern int iscsi_update_param_value(struct iscsi_param *, char *); - extern int iscsi_decode_text_input(u8, u8, char *, u32, struct iscsit_conn *); --extern int iscsi_encode_text_output(u8, u8, char *, u32 *, -+extern int iscsi_encode_text_output(u8, u8, char *, u32 *, u32, - struct iscsi_param_list *, bool); - extern int iscsi_check_negotiated_keys(struct iscsi_param_list *); - extern void iscsi_set_connection_parameters(struct iscsi_conn_ops *, --- -2.50.1 diff --git a/SOURCES/1110-scsi-target-iscsi-fix-crc-overread-and-double-free-i.patch b/SOURCES/1110-scsi-target-iscsi-fix-crc-overread-and-double-free-i.patch deleted file mode 100644 index 7948ffb20..000000000 --- a/SOURCES/1110-scsi-target-iscsi-fix-crc-overread-and-double-free-i.patch +++ /dev/null @@ -1,126 +0,0 @@ -From badf178b76b0690851df00f4ca9cf2eb8eb0f963 Mon Sep 17 00:00:00 2001 -From: Michael Bommarito -Date: Sat, 6 Jun 2026 08:49:28 -0400 -Subject: [PATCH] scsi: target: iscsi: Fix CRC overread and double-free in - iscsit_handle_text_cmd() - -[ Upstream commit 778c2ab142c625a8a8afa570e0f9b7873f445d99 ] - -Two latent bugs in the Text-phase handler, both present since the -original LIO integration in commit e48354ce078c ("iscsi-target: Add -iSCSI fabric support for target v4.1"): - -1) DataDigest CRC buffer overread (4 bytes past text_in). - - text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then - incremented by ISCSI_CRC_LEN to make room for the received DataDigest - in the iovec, but the same (now-bumped) rx_size is passed as the - buffer length to iscsit_crc_buf(): - - if (conn->conn_ops->DataDigest) { - ... - rx_size += ISCSI_CRC_LEN; - } - ... - if (conn->conn_ops->DataDigest) { - data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL); - - iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so - when DataDigest is negotiated it reads 4 bytes past the end of the - text_in allocation. KASAN reproduces this directly on the unpatched - mainline tree as slab-out-of-bounds in crc32c() called from the Text - PDU path. The OOB bytes feed crc32c() and are then compared against - the initiator-supplied checksum, so the value does not flow back to - the attacker, but the kernel does read past the buffer on every Text - PDU with DataDigest=CRC32C. - - Fix by passing the actual padded payload length - (ALIGN(payload_length, 4)) that was used for the kzalloc(). - -2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest - drop. - - On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler - silently drops the PDU and lets the initiator plug the CmdSN gap: - - kfree(text_in); - return 0; - - cmd->text_in_ptr still points at the freed buffer. The next Text - Request on the same ITT re-enters iscsit_setup_text_cmd(), which - unconditionally does - - kfree(cmd->text_in_ptr); - cmd->text_in_ptr = NULL; - - freeing the same pointer a second time. Session teardown via - iscsit_release_cmd() has the same shape and hits the same double-free - if the connection is dropped before a second Text Request arrives. - - On an unmodified mainline tree the bug-1 CRC overread fires first on - the initial valid Text Request and perturbs the subsequent state, so - #4 was isolated by building a kernel with only the bug-1 hunk of this - patch applied plus temporary printk() observability around the three - relevant kfree() sites. The observability prints are not part of - this patch. On that build, a three-PDU Text Request sequence after - login produces two back-to-back splats: - - BUG: KASAN: double-free in iscsit_setup_text_cmd+0x?? - BUG: KASAN: double-free in iscsit_release_cmd+0x?? - - showing the same pointer freed in the ERL>0 drop path and again in - iscsit_setup_text_cmd() (next Text Request on the same ITT) and once - more in iscsit_release_cmd() (session teardown). On distro kernels - with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free - becomes a remote kernel BUG(); on non-hardened kernels it corrupts - the slab freelist. - - Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop - path. With both hunks applied #4 is directly observable on the stock - tree without observability printks; fixing bug-1 alone would mask #4 - less, not more, so the hunks are submitted together. - -Both fixes are one-liners. The Text PDU state machine is unchanged and -the wire protocol is unaffected. - -Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") -Cc: stable@vger.kernel.org -Assisted-by: Claude:claude-opus-4-7 -Signed-off-by: Michael Bommarito -Tested-by: John Garry -Reviewed-by: John Garry -Signed-off-by: Martin K. Petersen -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman -CVE: CVE-2026-63888 -[ Backported to AlmaLinux 9 from linux-5.15.y commit badf178b76b0690851df00f4ca9cf2eb8eb0f963 (backport of mainline - 778c2ab142c6). Applied to 5.14.0-687.26.1.el9_8 with hunk offsets adjusted; the - change is otherwise identical. ] -Signed-off-by: Andrew Lukoshko - -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 8afe335..796aeda 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -2329,8 +2329,9 @@ iscsit_handle_text_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd, - - if (conn->conn_ops->DataDigest) { - iscsit_do_crypto_hash_buf(conn->conn_rx_hash, -- text_in, rx_size, 0, NULL, -- &data_crc); -+ text_in, -+ ALIGN(payload_length, 4), -+ 0, NULL, &data_crc); - - if (checksum != data_crc) { - pr_err("Text data CRC32C DataDigest" -@@ -2350,6 +2351,7 @@ iscsit_handle_text_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd, - " Command CmdSN: 0x%08x due to" - " DataCRC error.\n", hdr->cmdsn); - kfree(text_in); -+ cmd->text_in_ptr = NULL; - return 0; - } - } else { --- -2.50.1 diff --git a/SOURCES/1111-usb-serial-mxuport-fix-memory-corruption-with-small.patch b/SOURCES/1111-usb-serial-mxuport-fix-memory-corruption-with-small.patch deleted file mode 100644 index 1f575f92f..000000000 --- a/SOURCES/1111-usb-serial-mxuport-fix-memory-corruption-with-small.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 2f3661eb2446e1ef593da45e01a3b21a906768ec Mon Sep 17 00:00:00 2001 -From: Johan Hovold -Date: Fri, 22 May 2026 16:19:50 +0200 -Subject: [PATCH] USB: serial: mxuport: fix memory corruption with small - endpoint - -commit 4085f0dbb1ce2251c9a5938d693de6593f0ab2bd upstream. - -Make sure that the bulk-out endpoint max packet size is at least eight -bytes to avoid user-controlled slab corruption should a malicious device -report a smaller size. - -Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver") -Cc: stable@vger.kernel.org # 3.14 -Cc: Andrew Lunn -Reviewed-by: Greg Kroah-Hartman -Signed-off-by: Johan Hovold -Signed-off-by: Greg Kroah-Hartman - -CVE-2026-63899 - -Backported from linux-5.15.y commit 2f3661eb2446e1ef593da45e01a3b21a906768ec. -drivers/usb/serial/mxuport.c mxuport_calc_num_ports() carries the vulnerable -pre-image verbatim; applies cleanly, zero-fuzz. - -diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c -index eb45a9b0005c..b4270beb6fe0 100644 ---- a/drivers/usb/serial/mxuport.c -+++ b/drivers/usb/serial/mxuport.c -@@ -962,6 +962,14 @@ static int mxuport_calc_num_ports(struct usb_serial *serial, - */ - BUILD_BUG_ON(ARRAY_SIZE(epds->bulk_out) < 16); - -+ /* -+ * The bulk-out buffers must be large enough for the four-byte header -+ * (and following data), but assume anything smaller than eight bytes -+ * is broken. -+ */ -+ if (usb_endpoint_maxp(epds->bulk_out[0]) < 8) -+ return -EINVAL; -+ - for (i = 1; i < num_ports; ++i) - epds->bulk_out[i] = epds->bulk_out[0]; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1112-ip6-vti-use-ip6-tnl-net-in-vti6-changelink.patch b/SOURCES/1112-ip6-vti-use-ip6-tnl-net-in-vti6-changelink.patch deleted file mode 100644 index 01d6bb59b..000000000 --- a/SOURCES/1112-ip6-vti-use-ip6-tnl-net-in-vti6-changelink.patch +++ /dev/null @@ -1,80 +0,0 @@ -From f5c68875e25f331e497ddfbe81e2d8163a87f136 Mon Sep 17 00:00:00 2001 -From: Kuniyuki Iwashima -Date: Thu, 21 May 2026 21:05:54 +0800 -Subject: [PATCH] ip6: vti: Use ip6_tnl.net in vti6_changelink(). - -commit 11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe upstream. - -ip netns add ns1 -ip netns add ns2 -ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 -ip -n ns1 link set vti6_test netns ns2 -ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 -ip netns del ns2 -ip netns del ns1 -[ 132.495484] ------------[ cut here ]------------ -[ 132.497609] kernel BUG at net/core/dev.c:12376! - -Commit 61220ab34948 ("vti6: Enable namespace changing") dropped -NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then -move through IFLA_NET_NS_FD. After the move dev_net(dev) points -at the new netns while t->net stays at the creation netns. - -vti6_changelink() and vti6_update() still use dev_net(dev) and -dev_net(t->dev). They unlink from one per netns hash and relink -into another. The creation netns is left with a stale entry. -cleanup_net() of that netns later walks freed memory. - -Reachable from an unprivileged user namespace (unshare --user ---map-root-user --net). Cross tenant scope on container hosts. - -Fixes: 61220ab34948 ("vti6: Enable namespace changing") -Reported-by: Maoyi Xie -Reviewed-by: Eric Dumazet -Cc: stable@vger.kernel.org # v5.15+ -Signed-off-by: Kuniyuki Iwashima -Link: https://patch.msgid.link/20260521130555.3421684-2-maoyixie.tju@gmail.com -Signed-off-by: Paolo Abeni -Signed-off-by: Greg Kroah-Hartman -CVE: CVE-2026-63917 -[ Backported to AlmaLinux 9 from linux-5.15.y commit f5c68875e25f331e497ddfbe81e2d8163a87f136 (backport of mainline - 11b326fb0a37). Applied to 5.14.0-687.26.1.el9_8 with hunk offsets adjusted; the - change is otherwise identical. ] -Signed-off-by: Andrew Lukoshko - -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index f829c29..6ee727d 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -729,10 +729,11 @@ vti6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p, - static int vti6_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p, - bool keep_mtu) - { -- struct net *net = dev_net(t->dev); -- struct vti6_net *ip6n = net_generic(net, vti6_net_id); -+ struct net *net = t->net; -+ struct vti6_net *ip6n; - int err; - -+ ip6n = net_generic(net, vti6_net_id); - vti6_tnl_unlink(ip6n, t); - synchronize_net(); - err = vti6_tnl_change(t, p, keep_mtu); -@@ -1039,11 +1040,12 @@ static int vti6_changelink(struct net_device *dev, struct nlattr *tb[], - struct nlattr *data[], - struct netlink_ext_ack *extack) - { -- struct ip6_tnl *t; -+ struct ip6_tnl *t = netdev_priv(dev); -+ struct net *net = t->net; - struct __ip6_tnl_parm p; -- struct net *net = dev_net(dev); -- struct vti6_net *ip6n = net_generic(net, vti6_net_id); -+ struct vti6_net *ip6n; - -+ ip6n = net_generic(net, vti6_net_id); - if (dev == ip6n->fb_tnl_dev) - return -EINVAL; - --- -2.50.1 diff --git a/SOURCES/1113-ipv6-exthdrs-refresh-nh-pointer-after-ipv6-hop-jumbo.patch b/SOURCES/1113-ipv6-exthdrs-refresh-nh-pointer-after-ipv6-hop-jumbo.patch deleted file mode 100644 index 843a56f3d..000000000 --- a/SOURCES/1113-ipv6-exthdrs-refresh-nh-pointer-after-ipv6-hop-jumbo.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 645b99b1a185c91a79bdac4c5de0f91b212d64f0 Mon Sep 17 00:00:00 2001 -From: Justin Iurman -Date: Fri, 22 May 2026 13:20:13 +0200 -Subject: [PATCH] ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - -commit d47548a36639095939f4747d4c43f2271366f565 upstream. - -ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. -Let's recompute nh pointer to make sure any change won't mess things up. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Cc: stable@vger.kernel.org -Signed-off-by: Justin Iurman -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/20260522112013.12342-1-justin.iurman@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman - -[ CVE-2026-63924: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) - from linux-5.15.y commit 645b99b1a185c91a79bdac4c5de0f91b212d64f0. - Adapted: a9 predates commit 51b8f812e5b3 ("ipv6: exthdrs: get rid of - indirect calls in ip6_parse_tlv()", v5.15) and still dispatches all TLV - handlers through a single indirect curr->func(skb, off) call rather than - a per-option switch. The nh refresh is therefore guarded on - curr->type == IPV6_TLV_JUMBO so it fires only after ipv6_hop_jumbo(), - matching upstream which refreshes nh only after that handler. - Applies before the CVE-2026-63922 (HAO) refresh. ] - -diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c ---- a/net/ipv6/exthdrs.c -+++ b/net/ipv6/exthdrs.c -@@ -181,6 +181,8 @@ - func(). */ - if (curr->func(skb, off) == false) - return false; -+ if (curr->type == IPV6_TLV_JUMBO) -+ nh = skb_network_header(skb); - break; - } - } --- -2.50.1 (Apple Git-155) diff --git a/SOURCES/1114-ipv6-exthdrs-refresh-nh-after-handling-hao-option.patch b/SOURCES/1114-ipv6-exthdrs-refresh-nh-after-handling-hao-option.patch deleted file mode 100644 index 115dddf15..000000000 --- a/SOURCES/1114-ipv6-exthdrs-refresh-nh-after-handling-hao-option.patch +++ /dev/null @@ -1,56 +0,0 @@ -From f8aabed3ff3e986920cf02a2a2785e08e586b234 Mon Sep 17 00:00:00 2001 -From: Zhengchuan Liang -Date: Fri, 22 May 2026 17:42:26 +0800 -Subject: [PATCH] ipv6: exthdrs: refresh nh after handling HAO option - -commit f7b52afe3592eae66e160586b45a3f2242972c63 upstream. - -ip6_parse_tlv() caches skb_network_header(skb) in nh while walking -IPv6 TLVs. - -ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can -move the skb head and invalidate the cached network header pointer. -Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs -are parsed from the current skb head. - -This matches the existing pattern used in ip6_parse_tlv() after helpers -that can modify skb header storage. - -Fixes: a831f5bbc89a ("[IPV6] MIP6: Add inbound interface of home address option.") -Cc: stable@kernel.org -Reported-by: Yuan Tan -Reported-by: Xin Liu -Co-developed-by: Luxing Yin -Signed-off-by: Luxing Yin -Signed-off-by: Zhengchuan Liang -Signed-off-by: Ren Wei -Reviewed-by: Justin Iurman -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/7aba1debc2196189172499e5769802b026f8caf8.1779247873.git.zcliangcn@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman - -[ CVE-2026-63922: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) - from linux-5.15.y commit f8aabed3ff3e986920cf02a2a2785e08e586b234. - Adapted: a9 predates commit 51b8f812e5b3 ("ipv6: exthdrs: get rid of - indirect calls in ip6_parse_tlv()", v5.15) and still dispatches all TLV - handlers through a single indirect curr->func(skb, off) call rather than - a per-option switch. The nh refresh is therefore guarded on - curr->type == IPV6_TLV_HAO so it fires only after ipv6_dest_hao(), - matching upstream which refreshes nh only after that handler. - Applies after the CVE-2026-63924 (JUMBO) refresh. ] - -diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c ---- a/net/ipv6/exthdrs.c -+++ b/net/ipv6/exthdrs.c -@@ -182,6 +182,8 @@ - if (curr->func(skb, off) == false) - return false; - if (curr->type == IPV6_TLV_JUMBO) -+ nh = skb_network_header(skb); -+ if (curr->type == IPV6_TLV_HAO) - nh = skb_network_header(skb); - break; - } --- -2.50.1 (Apple Git-155) diff --git a/SOURCES/1115-kvm-sev-compute-the-correct-max-length-of-the-in-ghc.patch b/SOURCES/1115-kvm-sev-compute-the-correct-max-length-of-the-in-ghc.patch deleted file mode 100644 index b5a072c14..000000000 --- a/SOURCES/1115-kvm-sev-compute-the-correct-max-length-of-the-in-ghc.patch +++ /dev/null @@ -1,105 +0,0 @@ -From 5867d7e202e09f037cefe77f7af4413c7c0fa088 Mon Sep 17 00:00:00 2001 -From: Sean Christopherson -Date: Fri, 1 May 2026 13:22:31 -0700 -Subject: [PATCH] KVM: SEV: Compute the correct max length of the in-GHCB - scratch area - -commit 5867d7e202e09f037cefe77f7af4413c7c0fa088 upstream. - -When setting the length of the GHCB scratch area, and the area is in the -GHCB shared buffer, set the effective length of the scratch area to the max -possible size given the start of the guest-provided pointer, and the end of -the shared buffer. - -The code was "fine" when first introduced, as KVM doesn't consult the -length of the buffer when emulating MMIO, because the passed in @len always -specifies the *max* size required. But for PSC requests, the incoming @len -is just the minimum length (to process the header), and KVM needs to know -the full size of the scratch area to avoid buffer overflows (spoiler alert). - -Opportunistically rename @len => @min_len to better reflect its role. - -Fixes: 9b54e248d264 ("KVM: SEV: Add support to handle Page State Change VMGEXIT") -Cc: stable@vger.kernel.org -Reviewed-by: Tom Lendacky -Reviewed-by: Michael Roth -Signed-off-by: Sean Christopherson -Message-ID: <20260501202250.2115252-7-seanjc@google.com> -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - -[ CVE-2026-63939: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) - from linux-6.12.y commit 6ca9400d36005ffdca25f80186bea781c7e1dc4c. - Adapted the in-GHCB hunk: a9 predates the "GHCB v2 requires the scratch - area to be within the GHCB" ghcb_version>=2 guard, so the new - ghcb_sa_len assignment was rebased onto a9's surrounding context. - Applies zero-fuzz after the CVE-2026-63794 sev_dbg_crypt fix. ] - -diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c ---- a/arch/x86/kvm/svm/sev.c -+++ b/arch/x86/kvm/svm/sev.c -@@ -3448,7 +3448,7 @@ - } - - #define GHCB_SCRATCH_AREA_LIMIT (16ULL * PAGE_SIZE) --static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 len) -+static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 min_len) - { - struct vmcb_control_area *control = &svm->vmcb->control; - u64 ghcb_scratch_beg, ghcb_scratch_end; -@@ -3461,10 +3461,10 @@ - goto e_scratch; - } - -- scratch_gpa_end = scratch_gpa_beg + len; -+ scratch_gpa_end = scratch_gpa_beg + min_len; - if (scratch_gpa_end < scratch_gpa_beg) { - pr_err("vmgexit: scratch length (%#llx) not valid for scratch address (%#llx)\n", -- len, scratch_gpa_beg); -+ min_len, scratch_gpa_beg); - goto e_scratch; - } - -@@ -3488,21 +3488,23 @@ - - scratch_va = (void *)svm->sev_es.ghcb; - scratch_va += (scratch_gpa_beg - control->ghcb_gpa); -+ -+ svm->sev_es.ghcb_sa_len = ghcb_scratch_end - scratch_gpa_beg; - } else { - /* - * The guest memory must be read into a kernel buffer, so - * limit the size - */ -- if (len > GHCB_SCRATCH_AREA_LIMIT) { -+ if (min_len > GHCB_SCRATCH_AREA_LIMIT) { - pr_err("vmgexit: scratch area exceeds KVM limits (%#llx requested, %#llx limit)\n", -- len, GHCB_SCRATCH_AREA_LIMIT); -+ min_len, GHCB_SCRATCH_AREA_LIMIT); - goto e_scratch; - } -- scratch_va = kvzalloc(len, GFP_KERNEL_ACCOUNT); -+ scratch_va = kvzalloc(min_len, GFP_KERNEL_ACCOUNT); - if (!scratch_va) - return -ENOMEM; - -- if (kvm_read_guest(svm->vcpu.kvm, scratch_gpa_beg, scratch_va, len)) { -+ if (kvm_read_guest(svm->vcpu.kvm, scratch_gpa_beg, scratch_va, min_len)) { - /* Unable to copy scratch area from guest */ - pr_err("vmgexit: kvm_read_guest for scratch area failed\n"); - -@@ -3518,11 +3520,10 @@ - */ - svm->sev_es.ghcb_sa_sync = sync; - svm->sev_es.ghcb_sa_free = true; -+ svm->sev_es.ghcb_sa_len = min_len; - } - - svm->sev_es.ghcb_sa = scratch_va; -- svm->sev_es.ghcb_sa_len = len; -- - return 0; - - e_scratch: --- -2.50.1 (Apple Git-155) diff --git a/SOURCES/1116-usb-serial-cypress-m8-fix-memory-corruption-with-sma.patch b/SOURCES/1116-usb-serial-cypress-m8-fix-memory-corruption-with-sma.patch deleted file mode 100644 index 37a27ef79..000000000 --- a/SOURCES/1116-usb-serial-cypress-m8-fix-memory-corruption-with-sma.patch +++ /dev/null @@ -1,48 +0,0 @@ -From ad3d1628a46134276546d7a12fedf04be9979158 Mon Sep 17 00:00:00 2001 -From: Johan Hovold -Date: Thu, 4 Jun 2026 10:36:36 +0200 -Subject: [PATCH] USB: serial: cypress_m8: fix memory corruption with small - endpoint - -commit e1a9d791fd66ab2431b9e6f6f835823809869047 upstream. - -Make sure that the interrupt-out endpoint max packet size is at least -eight bytes to avoid user-controlled slab corruption or NULL-pointer -dereference should a malicious device report a smaller size. - -Fixes: 3416eaa1f8f8 ("USB: cypress_m8: Packet format is separate from characteristic size") -Cc: stable@vger.kernel.org # 2.6.26 -Reviewed-by: Greg Kroah-Hartman -Signed-off-by: Johan Hovold -[ johan: adjust context for 6.18 ] -Signed-off-by: Johan Hovold -Signed-off-by: Sasha Levin - -CVE-2026-63956 - -Backported from linux-5.15.y commit ad3d1628a46134276546d7a12fedf04be9979158. -drivers/usb/serial/cypress_m8.c cypress_generic_port_probe() carries the -vulnerable pre-image verbatim; applies cleanly, zero-fuzz. - -diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c -index 115e2df92132..2ca7e7af714f 100644 ---- a/drivers/usb/serial/cypress_m8.c -+++ b/drivers/usb/serial/cypress_m8.c -@@ -447,6 +447,14 @@ static int cypress_generic_port_probe(struct usb_serial_port *port) - return -ENODEV; - } - -+ /* -+ * The buffer must be large enough for the one or two-byte header (and -+ * following data), but assume anything smaller than eight bytes is -+ * broken. -+ */ -+ if (port->interrupt_out_size < 8) -+ return -EINVAL; -+ - priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL); - if (!priv) - return -ENOMEM; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1117-tunnels-load-network-headers-after-skb-cow-in.patch b/SOURCES/1117-tunnels-load-network-headers-after-skb-cow-in.patch deleted file mode 100644 index f5737eb4d..000000000 --- a/SOURCES/1117-tunnels-load-network-headers-after-skb-cow-in.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 7254aef4d1a7e18e887af9010e2f2dc34806789b Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Mon, 25 May 2026 20:13:35 +0000 -Subject: [PATCH] tunnels: load network headers after skb_cow() in - iptunnel_pmtud_build_icmp[v6]() - -[ Upstream commit b4bc94353050b1fa7b702bd4c6600710dd926cff ] - -Sashiko found that iptunnel_pmtud_build_icmp() and -iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() -before an skb_cow() call which can reallocate skb->head. - -Fix this possible UAF by initializing the local variables -after the skb_cow() call. - -Remove skb_reset_network_header() calls which were not needed. - -Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") -Signed-off-by: Eric Dumazet -Reviewed-by: Stefano Brivio -Link: https://patch.msgid.link/20260525201335.2361845-1-edumazet@google.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -CVE-2026-63994 - -Backported from linux-5.15.y commit 7254aef4d1a7e18e887af9010e2f2dc34806789b. -net/ipv4/ip_tunnel_core.c iptunnel_pmtud_build_icmp[v6]() carry the vulnerable -pre-image verbatim; applies cleanly, zero-fuzz. - -diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c -index 3737188ba4e1..4d80bbcd15d5 100644 ---- a/net/ipv4/ip_tunnel_core.c -+++ b/net/ipv4/ip_tunnel_core.c -@@ -194,7 +194,7 @@ EXPORT_SYMBOL_GPL(iptunnel_handle_offloads); - */ - static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu) - { -- const struct iphdr *iph = ip_hdr(skb); -+ const struct iphdr *iph; - struct icmphdr *icmph; - struct iphdr *niph; - struct ethhdr eh; -@@ -208,7 +208,6 @@ static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu) - - skb_copy_bits(skb, skb_mac_offset(skb), &eh, ETH_HLEN); - pskb_pull(skb, ETH_HLEN); -- skb_reset_network_header(skb); - - err = pskb_trim(skb, 576 - sizeof(*niph) - sizeof(*icmph)); - if (err) -@@ -218,7 +217,7 @@ static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu) - err = skb_cow(skb, sizeof(*niph) + sizeof(*icmph) + ETH_HLEN); - if (err) - return err; -- -+ iph = ip_hdr(skb); - icmph = skb_push(skb, sizeof(*icmph)); - *icmph = (struct icmphdr) { - .type = ICMP_DEST_UNREACH, -@@ -290,7 +289,7 @@ static int iptunnel_pmtud_check_icmp(struct sk_buff *skb, int mtu) - */ - static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu) - { -- const struct ipv6hdr *ip6h = ipv6_hdr(skb); -+ const struct ipv6hdr *ip6h; - struct icmp6hdr *icmp6h; - struct ipv6hdr *nip6h; - struct ethhdr eh; -@@ -305,7 +304,6 @@ static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu) - - skb_copy_bits(skb, skb_mac_offset(skb), &eh, ETH_HLEN); - pskb_pull(skb, ETH_HLEN); -- skb_reset_network_header(skb); - - err = pskb_trim(skb, IPV6_MIN_MTU - sizeof(*nip6h) - sizeof(*icmp6h)); - if (err) -@@ -316,6 +314,7 @@ static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu) - if (err) - return err; - -+ ip6h = ipv6_hdr(skb); - icmp6h = skb_push(skb, sizeof(*icmp6h)); - *icmp6h = (struct icmp6hdr) { - .icmp6_type = ICMPV6_PKT_TOOBIG, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1118-blk-mq-pop-cached-request-if-it-is-usable.patch b/SOURCES/1118-blk-mq-pop-cached-request-if-it-is-usable.patch deleted file mode 100644 index 41eecf46b..000000000 --- a/SOURCES/1118-blk-mq-pop-cached-request-if-it-is-usable.patch +++ /dev/null @@ -1,117 +0,0 @@ -From dc278e9bf2b9513a763353e6b9cc21e0f532954e Mon Sep 17 00:00:00 2001 -From: Keith Busch -Date: Thu, 21 May 2026 12:02:53 -0700 -Subject: [PATCH] blk-mq: pop cached request if it is usable - -When submitting a bio to blk-mq, if the task should sleep after peeking -a cached request, but before it pops it, the plug flushes and calls -blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a -use-after-free bug. Fix this by popping the cached request before any -possible blocking calls if it is suitable for use. - -Popping this request first holds a queue reference, so avoid any -serialization races with queue freezes and can safely proceed with -dispatching that request to the driver. This potentially increases a -timing window from when a driver wants to freeze its queue to when -requests stop being dispatched. That scenario is off the fast path -though, and drivers need to appropriately handle requests during a -freeze request anyway. - -The downside is the popped element needs to be individually freed when -we performed a bio plug merge. The cached request would have had to be -freed later anyway, but this patch does it inline with building the plug -list instead of after flushing it. - -Fixes: b0077e269f6c1 ("blk-mq: make sure active queue usage is held for bio_integrity_prep()") -Fixes: 7b4f36cd22a65 ("block: ensure we hold a queue reference when using queue limits") -Signed-off-by: Keith Busch -Link: https://patch.msgid.link/20260521190253.242065-1-kbusch@meta.com -Signed-off-by: Jens Axboe - -CVE-2026-64017 - -Backported from mainline commit dc278e9bf2b9513a763353e6b9cc21e0f532954e. -block/blk-mq.c blk_mq_peek_cached_request()/blk_mq_use_cached_rq() carry the -vulnerable pre-image verbatim; applies cleanly, zero-fuzz. - -diff --git a/block/blk-mq.c b/block/blk-mq.c -index d0c37daf568f..28c2d931e75e 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -3077,7 +3077,7 @@ static struct request *blk_mq_get_new_requests(struct request_queue *q, - /* - * Check if there is a suitable cached request and return it. - */ --static struct request *blk_mq_peek_cached_request(struct blk_plug *plug, -+static struct request *blk_mq_get_cached_request(struct blk_plug *plug, - struct request_queue *q, blk_opf_t opf) - { - enum hctx_type type = blk_mq_get_hctx_type(opf); -@@ -3093,27 +3093,10 @@ static struct request *blk_mq_peek_cached_request(struct blk_plug *plug, - return NULL; - if (op_is_flush(rq->cmd_flags) != op_is_flush(opf)) - return NULL; -+ rq_list_pop(&plug->cached_rqs); - return rq; - } - --static void blk_mq_use_cached_rq(struct request *rq, struct blk_plug *plug, -- struct bio *bio) --{ -- if (rq_list_pop(&plug->cached_rqs) != rq) -- WARN_ON_ONCE(1); -- -- /* -- * If any qos ->throttle() end up blocking, we will have flushed the -- * plug and hence killed the cached_rq list as well. Pop this entry -- * before we throttle. -- */ -- rq_qos_throttle(rq->q, bio); -- -- blk_mq_rq_time_init(rq, blk_time_get_ns()); -- rq->cmd_flags = bio->bi_opf; -- INIT_LIST_HEAD(&rq->queuelist); --} -- - static bool bio_unaligned(const struct bio *bio, struct request_queue *q) - { - unsigned int bs_mask = queue_logical_block_size(q) - 1; -@@ -3152,7 +3135,7 @@ void blk_mq_submit_bio(struct bio *bio) - /* - * If the plug has a cached request for this queue, try to use it. - */ -- rq = blk_mq_peek_cached_request(plug, q, bio->bi_opf); -+ rq = blk_mq_get_cached_request(plug, q, bio->bi_opf); - - /* - * A BIO that was released from a zone write plug has already been -@@ -3211,7 +3194,10 @@ void blk_mq_submit_bio(struct bio *bio) - - new_request: - if (rq) { -- blk_mq_use_cached_rq(rq, plug, bio); -+ rq_qos_throttle(rq->q, bio); -+ blk_mq_rq_time_init(rq, blk_time_get_ns()); -+ rq->cmd_flags = bio->bi_opf; -+ INIT_LIST_HEAD(&rq->queuelist); - } else { - rq = blk_mq_get_new_requests(q, plug, bio); - if (unlikely(!rq)) { -@@ -3257,12 +3243,10 @@ void blk_mq_submit_bio(struct bio *bio) - return; - - queue_exit: -- /* -- * Don't drop the queue reference if we were trying to use a cached -- * request and thus didn't acquire one. -- */ - if (!rq) - blk_queue_exit(q); -+ else -+ blk_mq_free_request(rq); - } - - #ifdef CONFIG_BLK_MQ_STACKING --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1119-rxrpc-fix-data-decrypt-vs-splice-by-copying-data-to.patch b/SOURCES/1119-rxrpc-fix-data-decrypt-vs-splice-by-copying-data-to.patch deleted file mode 100644 index b047882bd..000000000 --- a/SOURCES/1119-rxrpc-fix-data-decrypt-vs-splice-by-copying-data-to.patch +++ /dev/null @@ -1,409 +0,0 @@ -From a05bf6d9e621fa71e89ccebe3047ba45218d7b38 Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Fri, 29 May 2026 19:20:55 -0400 -Subject: [PATCH] rxrpc: Fix DATA decrypt vs splice() by copying data to buffer - in recvmsg - -commit d2bc90cf6c75cb96d2ce549be6c35efa3099d25b upstream. - -This improves the fix for CVE-2026-43500. - -Fix the pagecache corruption from in-place decryption of a DATA packet -transmitted locally by splice() by getting rid of the packet sharing in the -I/O thread and unconditionally extracting the packet content into a bounce -buffer in which the buffer is decrypted. recvmsg() (or the kernel -equivalent) then copies the data from the bounce buffer to the destination -buffer. The sk_buff then remains unmodified. - -This has an additional advantage in that the packet is then arranged in the -buffer with the correct alignment required for the crypto algorithms to -process directly. The performance of the crypto does seem to be a little -faster and, surprisingly, the unencrypted performance doesn't seem to -change much - possibly due to removing complexity from the I/O thread. - -Yet another advantage is that the I/O thread doesn't have to copy packets -which would slow down packet distribution, ACK generation, etc.. - -The buffer belongs to the call and is allocated initially at 2K, -sufficiently large to hold a whole jumbo subpacket, but the buffer will be -increased in size if needed. However, to take this work, MSG_PEEK may -cause a later packet to be decrypted into the buffer, in which case the -earlier one will need re-decrypting for a subsequent recvmsg(). - -Note that rx_pkt_offset may legitimately see 0 as a valid offset now, so -switch to using USHRT_MAX to indicate an invalid offset. - -Note also that I would generally prefer to replace the buffers of the -current sk_buff with a new kmalloc'd buffer of the right size, ditching the -old data and frags as this makes the handling of MSG_PEEK easier and -removes the re-decryption issue, but this looks like quite a complicated -thing to achieve. skb_morph() looks half way to what I want, but I don't -want to have to allocate a new sk_buff. - -Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()") -Reported-by: Hyunwoo Kim -Closes: https://lore.kernel.org/r/afKV2zGR6rrelPC7@v4bel/ -Signed-off-by: David Howells -cc: Simon Horman -cc: Jiayuan Chen -cc: linux-afs@lists.infradead.org -Reviewed-by: Jeffrey Altman -Tested-by: Marc Dionne -Link: https://patch.msgid.link/20260515230516.2718212-3-dhowells@redhat.com -Signed-off-by: Jakub Kicinski -Stable-dep-of: 8bfab4b6ffc2 ("rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer") -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman - -[ CVE-2026-64026: backported to AlmaLinux 9 (kernel-5.14.0-687.26.1.el9_8) from - linux-6.6.y commit a05bf6d9e621fa71e89ccebe3047ba45218d7b38. Adaptations: - the net/rxrpc/call_event.c hunk (removal of the skb_copy()/unshare block in - rxrpc_input_call_event) is already present in a9 via the ktime timer rework, - so it is dropped. In net/rxrpc/rxkad.c, a9's rxkad_verify_packet_1/_2 had - already dropped the round_down(len, 8) alignment step, the - crypto_skcipher_decrypt() return-value checks and the - rxkad_abort_2_crypto_unaligned abort (which is not defined in a9); those - pre-existing divergences are preserved (the decrypt is simply redirected - into the new per-call bounce buffer) and the now-unused ret/nsg locals are - removed. Remaining hunks apply with line-offset only. ] - -diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h -index 077e5df..9559093 100644 ---- a/net/rxrpc/ar-internal.h -+++ b/net/rxrpc/ar-internal.h -@@ -203,8 +203,6 @@ struct rxrpc_skb_priv { - struct { - u16 offset; /* Offset of data */ - u16 len; /* Length of data */ -- u8 flags; --#define RXRPC_RX_VERIFIED 0x01 - }; - struct { - rxrpc_seq_t first_ack; /* First packet in acks table */ -@@ -689,6 +687,11 @@ struct rxrpc_call { - /* Received data tracking */ - struct sk_buff_head recvmsg_queue; /* Queue of packets ready for recvmsg() */ - struct sk_buff_head rx_oos_queue; /* Queue of out of sequence packets */ -+ void *rx_dec_buffer; /* Decryption buffer */ -+ unsigned short rx_dec_bsize; /* rx_dec_buffer size */ -+ unsigned short rx_dec_offset; /* Decrypted packet data offset */ -+ unsigned short rx_dec_len; /* Decrypted packet data len */ -+ rxrpc_seq_t rx_dec_seq; /* Packet in decryption buffer */ - - rxrpc_seq_t rx_highest_seq; /* Higest sequence number received */ - rxrpc_seq_t rx_consumed; /* Highest packet consumed */ -diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c -index 3855e77..b46fa99 100644 ---- a/net/rxrpc/call_object.c -+++ b/net/rxrpc/call_object.c -@@ -155,6 +155,7 @@ struct rxrpc_call *rxrpc_alloc_call(struct rxrpc_sock *rx, gfp_t gfp, - spin_lock_init(&call->tx_lock); - refcount_set(&call->ref, 1); - call->debug_id = debug_id; -+ call->rx_pkt_offset = USHRT_MAX; - call->tx_total_len = -1; - call->next_rx_timo = 20 * HZ; - call->next_req_timo = 1 * HZ; -@@ -537,6 +538,7 @@ static void rxrpc_cleanup_ring(struct rxrpc_call *call) - { - rxrpc_purge_queue(&call->recvmsg_queue); - rxrpc_purge_queue(&call->rx_oos_queue); -+ kfree(call->rx_dec_buffer); - } - - /* -diff --git a/net/rxrpc/insecure.c b/net/rxrpc/insecure.c -index f270106..e1a9a4e 100644 ---- a/net/rxrpc/insecure.c -+++ b/net/rxrpc/insecure.c -@@ -29,9 +29,6 @@ static int none_secure_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb) - - static int none_verify_packet(struct rxrpc_call *call, struct sk_buff *skb) - { -- struct rxrpc_skb_priv *sp = rxrpc_skb(skb); -- -- sp->flags |= RXRPC_RX_VERIFIED; - return 0; - } - -diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c -index a482f88..13cd795 100644 ---- a/net/rxrpc/recvmsg.c -+++ b/net/rxrpc/recvmsg.c -@@ -143,15 +143,52 @@ static void rxrpc_rotate_rx_window(struct rxrpc_call *call) - } - - /* -- * Decrypt and verify a DATA packet. -+ * Decrypt and verify a DATA packet. The content of the packet is pulled out -+ * into a flat buffer rather than decrypting in place in the skbuff. This also -+ * has the advantage of aligning the buffer correctly for the crypto routines. -+ * -+ * We keep track of the sequence number of the packet currently decrypted into -+ * the buffer in ->rx_dec_seq. If MSG_PEEK is used and steps onto a new -+ * packet, subsequent recvmsg() calls will have to go back and re-decrypt the -+ * current packet. - */ - static int rxrpc_verify_data(struct rxrpc_call *call, struct sk_buff *skb) - { - struct rxrpc_skb_priv *sp = rxrpc_skb(skb); -+ int ret; -+ -+ if (sp->len > call->rx_dec_bsize) { -+ /* Make sure we can hold a 1412-byte jumbo subpacket and make -+ * sure that the buffer size is aligned to a crypto blocksize. -+ */ -+ size_t size = clamp(round_up(sp->len, 32), 2048, 65535); -+ void *buffer = krealloc(call->rx_dec_buffer, size, GFP_NOFS); -+ -+ if (!buffer) -+ return -ENOMEM; -+ call->rx_dec_buffer = buffer; -+ call->rx_dec_bsize = size; -+ } -+ -+ ret = -EFAULT; -+ if (skb_copy_bits(skb, sp->offset, call->rx_dec_buffer, sp->len) < 0) -+ goto err; - -- if (sp->flags & RXRPC_RX_VERIFIED) -- return 0; -- return call->security->verify_packet(call, skb); -+ call->rx_dec_offset = 0; -+ call->rx_dec_len = sp->len; -+ call->rx_dec_seq = sp->hdr.seq; -+ ret = call->security->verify_packet(call, skb); -+ if (ret < 0) -+ goto err; -+ return 0; -+ -+err: -+ kfree(call->rx_dec_buffer); -+ call->rx_dec_buffer = NULL; -+ call->rx_dec_bsize = 0; -+ call->rx_dec_offset = 0; -+ call->rx_dec_len = 0; -+ return ret; - } - - /* -@@ -202,17 +239,22 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call, - if (msg) - sock_recv_timestamp(msg, sock->sk, skb); - -- if (rx_pkt_offset == 0) { -+ if (call->rx_dec_seq != sp->hdr.seq || -+ !call->rx_dec_buffer) { - ret2 = rxrpc_verify_data(call, skb); - trace_rxrpc_recvdata(call, rxrpc_recvmsg_next, seq, -- sp->offset, sp->len, ret2); -+ call->rx_dec_offset, -+ call->rx_dec_len, ret2); - if (ret2 < 0) { - kdebug("verify = %d", ret2); - ret = ret2; - goto out; - } -- rx_pkt_offset = sp->offset; -- rx_pkt_len = sp->len; -+ } -+ -+ if (rx_pkt_offset == USHRT_MAX) { -+ rx_pkt_offset = call->rx_dec_offset; -+ rx_pkt_len = call->rx_dec_len; - } else { - trace_rxrpc_recvdata(call, rxrpc_recvmsg_cont, seq, - rx_pkt_offset, rx_pkt_len, 0); -@@ -224,10 +266,10 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call, - if (copy > remain) - copy = remain; - if (copy > 0) { -- ret2 = skb_copy_datagram_iter(skb, rx_pkt_offset, iter, -- copy); -- if (ret2 < 0) { -- ret = ret2; -+ ret2 = copy_to_iter(call->rx_dec_buffer + rx_pkt_offset, -+ copy, iter); -+ if (ret2 != copy) { -+ ret = -EFAULT; - goto out; - } - -@@ -248,7 +290,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call, - /* The whole packet has been transferred. */ - if (sp->hdr.flags & RXRPC_LAST_PACKET) - ret = 1; -- rx_pkt_offset = 0; -+ rx_pkt_offset = USHRT_MAX; - rx_pkt_len = 0; - - skb = skb_peek_next(skb, &call->recvmsg_queue); -diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c -index f1a6827..20cada2 100644 ---- a/net/rxrpc/rxkad.c -+++ b/net/rxrpc/rxkad.c -@@ -409,27 +409,24 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb, - rxrpc_seq_t seq, - struct skcipher_request *req) - { -- struct rxkad_level1_hdr sechdr; -+ struct rxkad_level1_hdr *sechdr; - struct rxrpc_skb_priv *sp = rxrpc_skb(skb); - struct rxrpc_crypt iv; -- struct scatterlist sg[16]; -- u32 data_size, buf; -+ struct scatterlist sg[1]; -+ void *data = call->rx_dec_buffer; -+ u32 len = sp->len, data_size, buf; - u16 check; -- int ret; - - _enter(""); - -- if (sp->len < 8) -+ if (len < 8) - return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON, - rxkad_abort_1_short_header); - - /* Decrypt the skbuff in-place. TODO: We really want to decrypt - * directly into the target buffer. - */ -- sg_init_table(sg, ARRAY_SIZE(sg)); -- ret = skb_to_sgvec(skb, sg, sp->offset, 8); -- if (unlikely(ret < 0)) -- return ret; -+ sg_init_one(sg, data, len); - - /* start the decryption afresh */ - memset(&iv, 0, sizeof(iv)); -@@ -441,13 +438,11 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb, - skcipher_request_zero(req); - - /* Extract the decrypted packet length */ -- if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0) -- return rxrpc_abort_eproto(call, skb, RXKADDATALEN, -- rxkad_abort_1_short_encdata); -- sp->offset += sizeof(sechdr); -- sp->len -= sizeof(sechdr); -+ sechdr = data; -+ call->rx_dec_offset = sizeof(*sechdr); -+ len -= sizeof(*sechdr); - -- buf = ntohl(sechdr.data_size); -+ buf = ntohl(sechdr->data_size); - data_size = buf & 0xffff; - - check = buf >> 16; -@@ -456,10 +451,10 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb, - if (check != 0) - return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON, - rxkad_abort_1_short_check); -- if (data_size > sp->len) -+ if (data_size > len) - return rxrpc_abort_eproto(call, skb, RXKADDATALEN, - rxkad_abort_1_short_data); -- sp->len = data_size; -+ call->rx_dec_len = data_size; - - _leave(" = 0 [dlen=%x]", data_size); - return 0; -@@ -473,40 +468,24 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb, - struct skcipher_request *req) - { - const struct rxrpc_key_token *token; -- struct rxkad_level2_hdr sechdr; -+ struct rxkad_level2_hdr *sechdr; - struct rxrpc_skb_priv *sp = rxrpc_skb(skb); - struct rxrpc_crypt iv; -- struct scatterlist _sg[4], *sg; -- u32 data_size, buf; -+ struct scatterlist sg[1]; -+ void *data = call->rx_dec_buffer; -+ u32 len = sp->len, data_size, buf; - u16 check; -- int nsg, ret; - -- _enter(",{%d}", sp->len); -+ _enter(",{%d}", len); - -- if (sp->len < 8) -+ if (len < 8) - return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON, - rxkad_abort_2_short_header); - -- /* Decrypt the skbuff in-place. TODO: We really want to decrypt -- * directly into the target buffer. -+ /* Decrypt in place in the call's decryption buffer. TODO: We really -+ * want to decrypt directly into the target buffer. - */ -- sg = _sg; -- nsg = skb_shinfo(skb)->nr_frags + 1; -- if (nsg <= 4) { -- nsg = 4; -- } else { -- sg = kmalloc_array(nsg, sizeof(*sg), GFP_NOIO); -- if (!sg) -- return -ENOMEM; -- } -- -- sg_init_table(sg, nsg); -- ret = skb_to_sgvec(skb, sg, sp->offset, sp->len); -- if (unlikely(ret < 0)) { -- if (sg != _sg) -- kfree(sg); -- return ret; -- } -+ sg_init_one(sg, data, len); - - /* decrypt from the session key */ - token = call->conn->key->payload.data[0]; -@@ -514,20 +493,16 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb, - - skcipher_request_set_sync_tfm(req, call->conn->rxkad.cipher); - skcipher_request_set_callback(req, 0, NULL, NULL); -- skcipher_request_set_crypt(req, sg, sg, sp->len, iv.x); -+ skcipher_request_set_crypt(req, sg, sg, len, iv.x); - crypto_skcipher_decrypt(req); - skcipher_request_zero(req); -- if (sg != _sg) -- kfree(sg); - - /* Extract the decrypted packet length */ -- if (skb_copy_bits(skb, sp->offset, &sechdr, sizeof(sechdr)) < 0) -- return rxrpc_abort_eproto(call, skb, RXKADDATALEN, -- rxkad_abort_2_short_len); -- sp->offset += sizeof(sechdr); -- sp->len -= sizeof(sechdr); -+ sechdr = data; -+ call->rx_dec_offset = sizeof(*sechdr); -+ len -= sizeof(*sechdr); - -- buf = ntohl(sechdr.data_size); -+ buf = ntohl(sechdr->data_size); - data_size = buf & 0xffff; - - check = buf >> 16; -@@ -537,17 +512,18 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb, - return rxrpc_abort_eproto(call, skb, RXKADSEALEDINCON, - rxkad_abort_2_short_check); - -- if (data_size > sp->len) -+ if (data_size > len) - return rxrpc_abort_eproto(call, skb, RXKADDATALEN, - rxkad_abort_2_short_data); - -- sp->len = data_size; -+ call->rx_dec_len = data_size; - _leave(" = 0 [dlen=%x]", data_size); - return 0; - } - - /* -- * Verify the security on a received packet and the subpackets therein. -+ * Verify the security on a received (sub)packet. If the packet needs -+ * modifying (e.g. decrypting), it must be copied. - */ - static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb) - { --- -2.50.1 (Apple Git-155) diff --git a/SOURCES/1120-wifi-mac80211-bounds-check-link-id-in-ieee80211-ml-e.patch b/SOURCES/1120-wifi-mac80211-bounds-check-link-id-in-ieee80211-ml-e.patch deleted file mode 100644 index 58b13323e..000000000 --- a/SOURCES/1120-wifi-mac80211-bounds-check-link-id-in-ieee80211-ml-e.patch +++ /dev/null @@ -1,53 +0,0 @@ -From f718506edd2d9c6a308ded9d13c632bf7b7d5a2c Mon Sep 17 00:00:00 2001 -From: Alexandru Hossu -Date: Fri, 15 May 2026 12:29:08 +0200 -Subject: [PATCH] wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs - -IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted -from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15. -sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14), -making index 15 out-of-bounds. - -A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response -action frame with a PER_STA_PROFILE subelement where link_id = 15. The -unsolicited-notification path (dialog_token = 0) is reachable any time -EPCS is already enabled, without any prior client request. - -sdata->link[15] reads into the first word of sdata->activate_links_work -(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD), -so the NULL check on the result does not catch the invalid access. The -garbage pointer is then passed to ieee80211_sta_wmm_params(), which -dereferences link->sdata and crashes the kernel. - -The same class of bug was fixed for ieee80211_ml_reconfiguration() by -commit 162d331d833d ("wifi: mac80211: bounds-check link_id in -ieee80211_ml_reconfiguration"). - -Fixes: de86c5f60839 ("wifi: mac80211: Add support for EPCS configuration") -Signed-off-by: Alexandru Hossu -Link: https://patch.msgid.link/20260515102908.1653088-1-hossu.alexandru@gmail.com -Signed-off-by: Johannes Berg - -CVE-2026-64030 - -Backported from mainline commit f718506edd2d9c6a308ded9d13c632bf7b7d5a2c. -net/mac80211/mlme.c ieee80211_ml_epcs() carries the vulnerable pre-image -verbatim (unchecked link_id); applies cleanly, zero-fuzz. - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 0a0f27836d57..ca1d29daf019 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -11232,6 +11232,9 @@ static void ieee80211_ml_epcs(struct ieee80211_sub_if_data *sdata, - control = get_unaligned_le16(pos); - link_id = control & IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID; - -+ if (link_id >= IEEE80211_MLD_MAX_NUM_LINKS) -+ continue; -+ - link = sdata_dereference(sdata->link[link_id], sdata); - if (!link) - continue; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/Makefile.rhelver b/SOURCES/Makefile.rhelver index e5f3ee5c5..e1b5c4270 100644 --- a/SOURCES/Makefile.rhelver +++ b/SOURCES/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 8 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 687.26.1 +RHEL_RELEASE = 687.29.1 # # ZSTREAM diff --git a/SOURCES/kernel.changelog b/SOURCES/kernel.changelog index 31a54b0b2..b32c8d692 100644 --- a/SOURCES/kernel.changelog +++ b/SOURCES/kernel.changelog @@ -1,4 +1,63 @@ -* Mon Jul 13 2026 CKI KWF Bot [5.14.0-687.26.1.el9_8] +* Tue Jul 21 2026 CKI KWF Bot [5.14.0-687.29.1.el9_8] +- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] +- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] +- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} +- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] +Resolves: RHEL-178337, RHEL-179297, RHEL-212061, RHEL-212685 + +* Mon Jul 20 2026 CKI KWF Bot [5.14.0-687.28.1.el9_8] +- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} +Resolves: RHEL-180073 + +* Thu Jul 16 2026 CKI KWF Bot [5.14.0-687.27.1.el9_8] +- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] +- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] +- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] +- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} +- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] +- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} +- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] +- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} +- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] +- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] +- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] +- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] +- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] +- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] +- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] +- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] +- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] +- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] +- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] +- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] +- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] +- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] +- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] +- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] +- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} +- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] +- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] +Resolves: RHEL-179886, RHEL-183980, RHEL-188121, RHEL-188333, RHEL-189943, RHEL-189975 + +* Tue Jul 14 2026 Jan Stancek [5.14.0-687.26.1.el9_8] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] Resolves: RHEL-193937 diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 7aab752e2..48081969f 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -176,15 +176,15 @@ Summary: The Linux kernel # define buildid .local %define specversion 5.14.0 %define patchversion 5.14 -%define pkgrelease 687.26.3 +%define pkgrelease 687.29.1 %define kversion 5 -%define tarfile_release 5.14.0-687.26.1.el9_8 +%define tarfile_release 5.14.0-687.29.1.el9_8 # This is needed to do merge window version magic %define patchlevel 14 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 687.26.3%{?buildid}%{?dist} +%define specrelease 687.29.1%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 5.14.0-687.26.1.el9_8 +%define kabiversion 5.14.0-687.29.1.el9_8 # # End of genspec.sh variables @@ -977,27 +977,6 @@ Patch2009: 0001-proc-fix-a-dentry-lock-race-between-release_task-and-lookup.patc Patch11111: ppc64le-kvm-support.patch -Patch1100: 1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch -Patch1101: 1101-nfsd-release-layout-stid-on-setlease-failure.patch -Patch1102: 1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch -Patch1103: 1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch -Patch1104: 1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch -Patch1105: 1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch -Patch1106: 1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch -Patch1107: 1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch -Patch1108: 1108-scsi-target-iscsi-validate-chap-r-length-before-base.patch -Patch1109: 1109-scsi-target-iscsi-bound-iscsi-encode-text-output-app.patch -Patch1110: 1110-scsi-target-iscsi-fix-crc-overread-and-double-free-i.patch -Patch1111: 1111-usb-serial-mxuport-fix-memory-corruption-with-small.patch -Patch1112: 1112-ip6-vti-use-ip6-tnl-net-in-vti6-changelink.patch -Patch1113: 1113-ipv6-exthdrs-refresh-nh-pointer-after-ipv6-hop-jumbo.patch -Patch1114: 1114-ipv6-exthdrs-refresh-nh-after-handling-hao-option.patch -Patch1115: 1115-kvm-sev-compute-the-correct-max-length-of-the-in-ghc.patch -Patch1116: 1116-usb-serial-cypress-m8-fix-memory-corruption-with-sma.patch -Patch1117: 1117-tunnels-load-network-headers-after-skb-cow-in.patch -Patch1118: 1118-blk-mq-pop-cached-request-if-it-is-usable.patch -Patch1119: 1119-rxrpc-fix-data-decrypt-vs-splice-by-copying-data-to.patch -Patch1120: 1120-wifi-mac80211-bounds-check-link-id-in-ieee80211-ml-e.patch # END OF PATCH DEFINITIONS %description @@ -1742,27 +1721,6 @@ ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch ApplyPatch 0001-Make-KVM-PMU-symbols-global-for-ppc64le-module-build.patch ApplyPatch 0001-proc-fix-a-dentry-lock-race-between-release_task-and-lookup.patch -ApplyPatch 1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch -ApplyPatch 1101-nfsd-release-layout-stid-on-setlease-failure.patch -ApplyPatch 1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt.patch -ApplyPatch 1103-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch -ApplyPatch 1104-net-ip-gre-require-cap-net-admin-in-device-netns-for-changelink.patch -ApplyPatch 1105-wifi-iwlwifi-mld-fix-tso-segmentation-explosion.patch -ApplyPatch 1106-ixgbevf-fix-uaf-in-vepa-multicast-source-pruning.patch -ApplyPatch 1107-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch -ApplyPatch 1108-scsi-target-iscsi-validate-chap-r-length-before-base.patch -ApplyPatch 1109-scsi-target-iscsi-bound-iscsi-encode-text-output-app.patch -ApplyPatch 1110-scsi-target-iscsi-fix-crc-overread-and-double-free-i.patch -ApplyPatch 1111-usb-serial-mxuport-fix-memory-corruption-with-small.patch -ApplyPatch 1112-ip6-vti-use-ip6-tnl-net-in-vti6-changelink.patch -ApplyPatch 1113-ipv6-exthdrs-refresh-nh-pointer-after-ipv6-hop-jumbo.patch -ApplyPatch 1114-ipv6-exthdrs-refresh-nh-after-handling-hao-option.patch -ApplyPatch 1115-kvm-sev-compute-the-correct-max-length-of-the-in-ghc.patch -ApplyPatch 1116-usb-serial-cypress-m8-fix-memory-corruption-with-sma.patch -ApplyPatch 1117-tunnels-load-network-headers-after-skb-cow-in.patch -ApplyPatch 1118-blk-mq-pop-cached-request-if-it-is-usable.patch -ApplyPatch 1119-rxrpc-fix-data-decrypt-vs-splice-by-copying-data-to.patch -ApplyPatch 1120-wifi-mac80211-bounds-check-link-id-in-ieee80211-ml-e.patch # END OF PATCH APPLICATIONS # Any further pre-build tree manipulations happen here. @@ -3837,32 +3795,7 @@ fi # # %changelog -* Wed Jul 22 2026 Andrew Lukoshko - 5.14.0-687.26.3 -- scsi: target: iscsi: Validate CHAP_R length before base64 decode (Alexandru Hossu) {CVE-2026-63886} -- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Michael Bommarito) {CVE-2026-63887} -- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Michael Bommarito) {CVE-2026-63888} -- USB: serial: mxuport: fix memory corruption with small endpoint (Johan Hovold) {CVE-2026-63899} -- ip6: vti: Use ip6_tnl.net in vti6_changelink() (Kuniyuki Iwashima) {CVE-2026-63917} -- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Justin Iurman) {CVE-2026-63924} -- ipv6: exthdrs: refresh nh after handling HAO option (Zhengchuan Liang) {CVE-2026-63922} -- KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Sean Christopherson) {CVE-2026-63939} -- USB: serial: cypress_m8: fix memory corruption with small endpoint (Johan Hovold) {CVE-2026-63956} -- tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Eric Dumazet) {CVE-2026-63994} -- blk-mq: pop cached request if it is usable (Keith Busch) {CVE-2026-64017} -- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (David Howells) {CVE-2026-64026} -- wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Alexandru Hossu) {CVE-2026-64030} - -* Tue Jul 21 2026 Andrew Lukoshko - 5.14.0-687.26.2 -- NFSD: Fix SECINFO_NO_NAME decode error cleanup (Guannan Wang) {CVE-2026-53398} -- nfsd: release layout stid on setlease failure (Chris Mason) {CVE-2026-53399} -- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (Ashutosh Desai) {CVE-2026-63794} -- KEYS: fix overflow in keyctl_pkey_params_get_2() (Jarkko Sakkinen) {CVE-2026-63824} -- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) {CVE-2026-63829} -- wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Cole Leavitt) {CVE-2026-64037} -- ixgbevf: fix use-after-free in VEPA multicast source pruning (Michael Bommarito) {CVE-2026-64113} -- i2c: stub: Reject I2C block transfers with invalid length (Weiming Shi) {CVE-2026-64191} - -* Fri Jul 17 2026 Andrew Lukoshko - 5.14.0-687.26.1 +* Thu Jul 23 2026 Andrew Lukoshko - 5.14.0-687.29.1 - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 @@ -3874,13 +3807,69 @@ fi - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained -* Fri Jul 17 2026 Eduard Abdullin - 5.14.0-687.26.1 +* Thu Jul 23 2026 Eduard Abdullin - 5.14.0-687.29.1 - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds -* Mon Jul 13 2026 CKI KWF Bot [5.14.0-687.26.1.el9_8] +* Tue Jul 21 2026 CKI KWF Bot [5.14.0-687.29.1.el9_8] +- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] +- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] +- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} +- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] + +* Mon Jul 20 2026 CKI KWF Bot [5.14.0-687.28.1.el9_8] +- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} + +* Thu Jul 16 2026 CKI KWF Bot [5.14.0-687.27.1.el9_8] +- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] +- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] +- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] +- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} +- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] +- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} +- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] +- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} +- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] +- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] +- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] +- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] +- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] +- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] +- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] +- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] +- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] +- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] +- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] +- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] +- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] +- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] +- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] +- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] +- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] +- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] +- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] +- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} +- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] +- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] + +* Tue Jul 14 2026 Jan Stancek [5.14.0-687.26.1.el9_8] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] * Thu Jul 09 2026 CKI KWF Bot [5.14.0-687.25.1.el9_8]