From e44942141f57bd667abbe683c349c53d81d3e8d9 Mon Sep 17 00:00:00 2001 From: Andrew Lukoshko Date: Tue, 21 Jul 2026 19:17:35 +0000 Subject: [PATCH] Fix 13 Important CVEs ahead of RHEL; bump to 211.34.2 Backport upstream stable fixes for RHEL-Affected Important CVEs, closest-to-6.12 stable base, verified zero-fuzz on 211.34.1 (patches 1100-1112): CVE-2026-53398 53399 63794 63797 63824 63829 64037 64042 64051 64061 64113 64132 64191 --- ...secinfo-no-name-decode-error-cleanup.patch | 51 +++++++++ ...ease-layout-stid-on-setlease-failure.patch | 78 ++++++++++++++ ...verflow-in-sev-dbg-crypt-for-encrypt.patch | 97 +++++++++++++++++ ...x-use-after-free-on-probe-error-path.patch | 84 +++++++++++++++ ...overflow-in-keyctl-pkey-params-get-2.patch | 68 ++++++++++++ ...cap-net-admin-in-the-device-netns-fo.patch | 101 ++++++++++++++++++ ...x-tso-segmentation-explosion-when-am.patch | 77 +++++++++++++ ...-resources-before-exporting-a-dmabuf.patch | 47 ++++++++ ...flow-check-to-remap-pfn-range-during.patch | 79 ++++++++++++++ ...put-of-sink-folio-in-netfs-read-gaps.patch | 83 ++++++++++++++ ...er-free-in-vepa-multicast-source-pru.patch | 68 ++++++++++++ ...fresh-hdr-pointer-before-ioam6-event.patch | 68 ++++++++++++ ...-block-transfers-with-invalid-length.patch | 77 +++++++++++++ kernel.spec | 45 +++++++- 14 files changed, 1021 insertions(+), 2 deletions(-) create mode 100644 1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch create mode 100644 1101-nfsd-release-layout-stid-on-setlease-failure.patch create mode 100644 1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt-for-encrypt.patch create mode 100644 1103-rpmsg-char-fix-use-after-free-on-probe-error-path.patch create mode 100644 1104-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch create mode 100644 1105-net-ip-gre-require-cap-net-admin-in-the-device-netns-fo.patch create mode 100644 1106-wifi-iwlwifi-mld-fix-tso-segmentation-explosion-when-am.patch create mode 100644 1107-vfio-pci-check-bar-resources-before-exporting-a-dmabuf.patch create mode 100644 1108-accel-qaic-add-overflow-check-to-remap-pfn-range-during.patch create mode 100644 1109-netfs-fix-early-put-of-sink-folio-in-netfs-read-gaps.patch create mode 100644 1110-ixgbevf-fix-use-after-free-in-vepa-multicast-source-pru.patch create mode 100644 1111-ipv6-ioam-refresh-hdr-pointer-before-ioam6-event.patch create mode 100644 1112-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch diff --git a/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch b/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch new file mode 100644 index 000000000..9c7a8eab7 --- /dev/null +++ b/1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch @@ -0,0 +1,51 @@ +From 161d1aaeb04d620d3692639700512bb5038c1e10 Mon Sep 17 00:00:00 2001 +From: Guannan Wang +Date: Thu, 21 May 2026 16:03:32 +0800 +Subject: [PATCH] NFSD: Fix SECINFO_NO_NAME decode error cleanup + +commit 9e18e83b8846a5c3fe13fc8a464b4865d33996c6 upstream. + +CVE-2026-53398 +Backported-from linux-6.12.y commit 161d1aaeb04d620d3692639700512bb5038c1e10 + +nfsd4_decode_secinfo_no_name() currently initializes sin_exp after +decoding sin_style. If the XDR stream is truncated, the decoder returns +nfserr_bad_xdr before sin_exp is initialized. + +Since commit 3fdc54646234 ("NFSD: Reduce amount of struct +nfsd4_compoundargs that needs clearing"), the inline iops array is not +cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore +leave sin_exp holding stale union contents from a previous operation. + +The error response path still invokes nfsd4_secinfo_no_name_release(), +which calls exp_put() on a non-NULL sin_exp. + +Initialize sin_exp before the first failable decode step, matching +nfsd4_decode_secinfo(). + +Fixes: 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing") +Cc: stable@vger.kernel.org +Signed-off-by: Guannan Wang +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 8471371c6888..9c8767cab51d 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1849,10 +1849,11 @@ static __be32 nfsd4_decode_secinfo_no_name(struct nfsd4_compoundargs *argp, + union nfsd4_op_u *u) + { + struct nfsd4_secinfo_no_name *sin = &u->secinfo_no_name; ++ ++ sin->sin_exp = NULL; + if (xdr_stream_decode_u32(argp->xdr, &sin->sin_style) < 0) + return nfserr_bad_xdr; + +- sin->sin_exp = NULL; + return nfs_ok; + } + +-- +2.50.1 (Apple Git-155) + diff --git a/1101-nfsd-release-layout-stid-on-setlease-failure.patch b/1101-nfsd-release-layout-stid-on-setlease-failure.patch new file mode 100644 index 000000000..f9aae63af --- /dev/null +++ b/1101-nfsd-release-layout-stid-on-setlease-failure.patch @@ -0,0 +1,78 @@ +From 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 Mon Sep 17 00:00:00 2001 +From: Chris Mason +Date: Mon, 18 May 2026 13:16:36 -0700 +Subject: [PATCH] nfsd: release layout stid on setlease failure + +commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 upstream. + +nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via +idr_alloc_cyclic() under cl_lock before returning to +nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then +fails, the error path frees the layout stateid directly with +kmem_cache_free() without ever calling idr_remove(), leaving the +IDR slot pointing at freed slab memory. Any subsequent IDR walker +(states_show, client teardown) dereferences the dangling pointer. + +The correct teardown for an IDR-published stid is nfs4_put_stid(), +which removes the IDR slot under cl_lock, dispatches sc_free +(nfsd4_free_layout_stateid) to release ls->ls_file via +nfsd4_close_layout(), and drops the nfs4_file reference in its +tail. + +A second issue blocks that switch: nfsd4_free_layout_stateid() +unconditionally inspects ls->ls_fence_work via +delayed_work_pending() under ls_lock, but +INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only +after the setlease call. On the setlease-failure path the +destructor would touch an uninitialized delayed_work. + + nfsd4_alloc_layout_stateid() + nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */ + nfsd4_layout_setlease() /* fails */ + nfs4_put_stid() + nfsd4_free_layout_stateid() + delayed_work_pending(&ls->ls_fence_work) /* needs INIT */ + nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */ + put_nfs4_file() + +Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK +initialization above the nfsd4_layout_setlease() call, and replace +the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup +with a single nfs4_put_stid(stp). + +Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") +Cc: stable@vger.kernel.org +Assisted-by: kres (claude-opus-4-7) +Signed-off-by: Chris Mason +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever + +CVE-2026-53399 + +[ Backported from mainline commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9. + The a10 struct nfs4_layout_stateid has no ls_fenced / ls_fence_delay / + ls_fence_work fields (layout fencing was introduced upstream after 6.12), + and nfsd4_free_layout_stateid() never touches a delayed_work, so the + "second issue" does not exist here. Only the core hunk applies: replace + the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup on the + setlease-failure path with a single nfs4_put_stid(stp), which performs + idr_remove() under cl_lock and the full teardown. ] +Signed-off-by: Andrew Lukoshko +--- +diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c +index 683bd11..62762e4 100644 +--- a/fs/nfsd/nfs4layouts.c ++++ b/fs/nfsd/nfs4layouts.c +@@ -256,9 +256,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate, + BUG_ON(!ls->ls_file); + + if (nfsd4_layout_setlease(ls)) { +- nfsd_file_put(ls->ls_file); +- put_nfs4_file(fp); +- kmem_cache_free(nfs4_layout_stateid_cache, ls); ++ nfs4_put_stid(stp); + return NULL; + } + +-- +2.47.3 diff --git a/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt-for-encrypt.patch b/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt-for-encrypt.patch new file mode 100644 index 000000000..8cf31fda5 --- /dev/null +++ b/1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt-for-encrypt.patch @@ -0,0 +1,97 @@ +From e1a0fe288dee07b7da25a71e007c1ecd1080315b Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Fri, 1 May 2026 13:35:32 -0700 +Subject: [PATCH] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT + path + +commit 78ee2d50185a037b3d2452a97f3dad69c3f7f389 upstream. + +CVE-2026-63794 +Backported-from linux-6.12.y commit e1a0fe288dee07b7da25a71e007c1ecd1080315b + +In sev_dbg_crypt(), the per-iteration transfer length is bounded by +the source page offset (PAGE_SIZE - s_off) but not by the destination +page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt +path (__sev_dbg_encrypt_user) performs a read-modify-write using a +single-page intermediate buffer (dst_tpage): + + 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16) + before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, + the PSP writes beyond the end of the 4096-byte dst_tpage allocation. + + 2. The subsequent memcpy()/copy_from_user() into + page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows + by up to 15 bytes under the same condition. + +Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE - +the PSP is instructed to write round_up(4097, 16) = 4112 bytes to +a 4096-byte buffer. + +Fix by also bounding len by (PAGE_SIZE - d_off), the same check that +sev_send_update_data() already performs for its single-page guest +region. + + ================================================================== + BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd] + Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214 + + CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY + Tainted: [U]=USER, [W]=WARN + Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025 + Call Trace: + + dump_stack_lvl+0x54/0x70 + print_report+0xbc/0x260 + kasan_report+0xa2/0xd0 + kasan_check_range+0x25f/0x2c0 + __asan_memcpy+0x40/0x70 + sev_dbg_crypt+0x993/0xd10 [kvm_amd] + sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd] + kvm_vm_ioctl+0x65d/0x6d0 [kvm] + __se_sys_ioctl+0xb2/0x100 + do_syscall_64+0xe8/0x870 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + + + The buggy address belongs to the physical page: + page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb + memcg:ff11000112827d82 + flags: 0x1400000000000000(node=1|zone=1) + raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000 + raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82 + page dumped because: kasan: bad access detected + + Memory state around the buggy address: + ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc + ^ + ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc + ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc + ================================================================== + Disabling lock debugging due to kernel taint + +Fixes: 24f41fb23a39 ("KVM: SVM: Add support for SEV DEBUG_DECRYPT command") +Fixes: 7d1594f5d94b ("KVM: SVM: Add support for SEV DEBUG_ENCRYPT command") +Cc: stable@vger.kernel.org +Signed-off-by: Ashutosh Desai +[sean: add sample KASAN splat, Fixes, and stable@] +Link: https://patch.msgid.link/20260501203537.2120074-2-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman + +diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c +index 6032d7e69a20..ccfa4924196a 100644 +--- a/arch/x86/kvm/svm/sev.c ++++ b/arch/x86/kvm/svm/sev.c +@@ -1280,6 +1280,7 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec) + s_off = vaddr & ~PAGE_MASK; + d_off = dst_vaddr & ~PAGE_MASK; + len = min_t(size_t, (PAGE_SIZE - s_off), size); ++ len = min_t(size_t, len, PAGE_SIZE - d_off); + + if (dec) + ret = __sev_dbg_decrypt_user(kvm, +-- +2.50.1 (Apple Git-155) + diff --git a/1103-rpmsg-char-fix-use-after-free-on-probe-error-path.patch b/1103-rpmsg-char-fix-use-after-free-on-probe-error-path.patch new file mode 100644 index 000000000..3ebb4fba1 --- /dev/null +++ b/1103-rpmsg-char-fix-use-after-free-on-probe-error-path.patch @@ -0,0 +1,84 @@ +From c5ebb06c7e24d531b68707168e04698859d642bc Mon Sep 17 00:00:00 2001 +From: Yuho Choi +Date: Mon, 1 Jun 2026 14:32:47 -0400 +Subject: [PATCH] rpmsg: char: Fix use-after-free on probe error path + +commit 1ff3f528e67d20e2b1483dcaba899dc7832b2e6b upstream. + +CVE-2026-63797 +Backported-from linux-6.12.y commit c5ebb06c7e24d531b68707168e04698859d642bc + +rpmsg_chrdev_probe() stores the newly allocated eptdev in the default +endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If +rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while +the default endpoint may still dispatch callbacks with the stale priv +pointer. + +Avoid publishing eptdev through the default endpoint until +rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv +pointer is published should be ignored by rpmsg_ept_cb(). Flow-control +updates can hit rpmsg_ept_flow_cb() in the same window, so make both +callbacks return success when priv is NULL. + +Fixes: bc69d1066569 ("rpmsg: char: Introduce the "rpmsg-raw" channel") +Signed-off-by: Yuho Choi +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20260601183247.1962010-1-dbgh9129@gmail.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c +index 96fcdd2d7093..d918cb30db9b 100644 +--- a/drivers/rpmsg/rpmsg_char.c ++++ b/drivers/rpmsg/rpmsg_char.c +@@ -104,6 +104,9 @@ static int rpmsg_ept_cb(struct rpmsg_device *rpdev, void *buf, int len, + struct rpmsg_eptdev *eptdev = priv; + struct sk_buff *skb; + ++ if (!eptdev) ++ return 0; ++ + skb = alloc_skb(len, GFP_ATOMIC); + if (!skb) + return -ENOMEM; +@@ -124,6 +127,9 @@ static int rpmsg_ept_flow_cb(struct rpmsg_device *rpdev, void *priv, bool enable + { + struct rpmsg_eptdev *eptdev = priv; + ++ if (!eptdev) ++ return 0; ++ + eptdev->remote_flow_restricted = enable; + eptdev->remote_flow_updated = true; + +@@ -490,6 +496,7 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev) + struct rpmsg_channel_info chinfo; + struct rpmsg_eptdev *eptdev; + struct device *dev = &rpdev->dev; ++ int ret; + + memcpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE); + chinfo.src = rpdev->src; +@@ -502,13 +509,17 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev) + /* Set the default_ept to the rpmsg device endpoint */ + eptdev->default_ept = rpdev->ept; + ++ ret = rpmsg_chrdev_eptdev_add(eptdev, chinfo); ++ ++ if (ret) ++ return ret; + /* + * The rpmsg_ept_cb uses *priv parameter to get its rpmsg_eptdev context. +- * Storedit in default_ept *priv field. ++ * Stored it in default_ept *priv field. + */ + eptdev->default_ept->priv = eptdev; + +- return rpmsg_chrdev_eptdev_add(eptdev, chinfo); ++ return 0; + } + + static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev) +-- +2.50.1 (Apple Git-155) + diff --git a/1104-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch b/1104-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch new file mode 100644 index 000000000..a452fa0bd --- /dev/null +++ b/1104-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch @@ -0,0 +1,68 @@ +From 5165f1cc727f1322456735df212d8e26ec237a8d Mon Sep 17 00:00:00 2001 +From: Jarkko Sakkinen +Date: Mon, 1 Jun 2026 23:11:54 +0300 +Subject: [PATCH] KEYS: fix overflow in keyctl_pkey_params_get_2() + +commit cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b upstream. + +CVE-2026-63824 +Backported-from linux-6.12.y commit 5165f1cc727f1322456735df212d8e26ec237a8d + +The length for the internal output buffer is calculated incorrectly, which +can result overflow when a too small buffer is provided. + +Fix the bug by allocating internal output with the size of the maximum +length of the cryptographic primitive instead of caller provided size. + +Link: https://lore.kernel.org/keyrings/20260531024914.3712130-1-jarkko@kernel.org/ +Cc: stable@vger.kernel.org # v4.20+ +Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]") +Reported-by: Alessandro Groppo +Tested-by: Alessandro Groppo +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman + +diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c +index 97bc27bbf079..ba150ee2d4a3 100644 +--- a/security/keys/keyctl_pkey.c ++++ b/security/keys/keyctl_pkey.c +@@ -138,28 +138,35 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par + if (uparams.in_len > info.max_dec_size || + uparams.out_len > info.max_enc_size) + return -EINVAL; ++ ++ params->out_len = info.max_enc_size; + break; + case KEYCTL_PKEY_DECRYPT: + if (uparams.in_len > info.max_enc_size || + uparams.out_len > info.max_dec_size) + return -EINVAL; ++ ++ params->out_len = info.max_dec_size; + break; + case KEYCTL_PKEY_SIGN: + if (uparams.in_len > info.max_data_size || + uparams.out_len > info.max_sig_size) + return -EINVAL; ++ ++ params->out_len = info.max_sig_size; + break; + case KEYCTL_PKEY_VERIFY: + if (uparams.in_len > info.max_data_size || + uparams.in2_len > info.max_sig_size) + return -EINVAL; ++ ++ params->out_len = info.max_sig_size; + break; + default: + BUG(); + } + + params->in_len = uparams.in_len; +- params->out_len = uparams.out_len; /* Note: same as in2_len */ + return 0; + } + +-- +2.50.1 (Apple Git-155) + diff --git a/1105-net-ip-gre-require-cap-net-admin-in-the-device-netns-fo.patch b/1105-net-ip-gre-require-cap-net-admin-in-the-device-netns-fo.patch new file mode 100644 index 000000000..1abfbf1ec --- /dev/null +++ b/1105-net-ip-gre-require-cap-net-admin-in-the-device-netns-fo.patch @@ -0,0 +1,101 @@ +From 9831bc9ecb402957810c2045c663fbfe9b09e296 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:35 +0800 +Subject: [PATCH] net: ip_gre: require CAP_NET_ADMIN in the device netns for + changelink + +commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 upstream. + +CVE-2026-63829 +Backported-from linux-6.12.y commit 9831bc9ecb402957810c2045c663fbfe9b09e296 + +A tunnel changelink() operates on at most two netns, dev_net(dev) and +the tunnel link netns t->net. They differ once the device is created in +or moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in +net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is +skipped when the link netns is dev_net(dev), where the rtnl path already +checked it. The other patches in this series use the same helper. + +Gate ipgre_changelink() and erspan_changelink() with it, at the top of +the op before any attribute is parsed, because the parsers update live +tunnel fields first. ipgre_netlink_parms() sets t->collect_md before +ip_tunnel_changelink() runs. + +Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in +vti6_siocdevprivate().") added the same check on the ioctl path. This +adds it on RTM_NEWLINK. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: b57708add314 ("gre: add x-netns support") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-2-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h +index 2d3eb7cb4dff..7c057611f4ab 100644 +--- a/include/net/rtnetlink.h ++++ b/include/net/rtnetlink.h +@@ -212,6 +212,8 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm, + int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer, + struct netlink_ext_ack *exterr); + struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid); ++bool rtnl_dev_link_net_capable(const struct net_device *dev, ++ const struct net *link_net); + + #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 2176cd1bc765..118612325ce9 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2205,6 +2205,14 @@ struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid) + } + EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable); + ++bool rtnl_dev_link_net_capable(const struct net_device *dev, ++ const struct net *link_net) ++{ ++ return net_eq(link_net, dev_net(dev)) || ++ ns_capable(link_net->user_ns, CAP_NET_ADMIN); ++} ++EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable); ++ + static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh, + bool strict_check, struct nlattr **tb, + struct netlink_ext_ack *extack) +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 084556b03a2e..ffad16b023ad 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -1446,6 +1446,9 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[], + __u32 fwmark = t->fwmark; + int err; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + err = ipgre_newlink_encap_setup(dev, data); + if (err) + return err; +@@ -1475,6 +1478,9 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[], + __u32 fwmark = t->fwmark; + int err; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + err = ipgre_newlink_encap_setup(dev, data); + if (err) + return err; +-- +2.50.1 (Apple Git-155) + diff --git a/1106-wifi-iwlwifi-mld-fix-tso-segmentation-explosion-when-am.patch b/1106-wifi-iwlwifi-mld-fix-tso-segmentation-explosion-when-am.patch new file mode 100644 index 000000000..f8b423678 --- /dev/null +++ b/1106-wifi-iwlwifi-mld-fix-tso-segmentation-explosion-when-am.patch @@ -0,0 +1,77 @@ +From 92cee08dc4f00e77fd1317e4343c5d458b0abab7 Mon Sep 17 00:00:00 2001 +From: Cole Leavitt +Date: Sat, 4 Apr 2026 22:41:44 -0700 +Subject: [PATCH] wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU + is disabled + +commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7 upstream. + +When the TLC notification disables AMSDU for a TID, the MLD driver sets +max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in +iwl_mld_tx_tso_segment() checks for zero but not for this sentinel, +allowing it to reach the num_subframes calculation: + + num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) + = (1 + 2) / (1534 + 2) = 0 + +This zero propagates to iwl_tx_tso_segment() which sets: + + gso_size = num_subframes * mss = 0 + +Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny +segments from a single GSO skb. This floods the TX ring with ~1024 +micro-frames (the rest are purged), creating a massive burst of TX +completion events that can lead to memory corruption and a subsequent +use-after-free in TCP's retransmit queue (refcount underflow in +tcp_shifted_skb, NULL deref in tcp_rack_detect_loss). + +The MVM driver is immune because it checks mvmsta->amsdu_enabled before +reaching the num_subframes calculation. The MLD driver has no equivalent +bitmap check and relies solely on max_tid_amsdu_len, which does not +catch the sentinel value. + +Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the +existing check and falling back to non-AMSDU TSO segmentation. Also add +a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth +to catch any future code paths that produce zero through a different +mechanism. + +Suggested-by: Miriam Rachel Korenblit +Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") +Signed-off-by: Cole Leavitt +Link: https://patch.msgid.link/20260405054145.1064152-3-cole@unwrap.rs +Signed-off-by: Miri Korenblit + +CVE-2026-64037 + +Backported from mainline commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7. +The iwlmld sub-driver (drivers/net/wireless/intel/iwlwifi/mld/) is present +in the a10 kernel-6.12.0-211.34.1.el10_2 tree and iwl_mld_tx_tso_segment() carries the vulnerable +pre-image verbatim, so the change applies cleanly, zero-fuzz (line offset only). + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c +index 546d09a38dab..094a28f75559 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c +@@ -834,7 +834,7 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, + return -EINVAL; + + max_tid_amsdu_len = sta->cur->max_tid_amsdu_len[tid]; +- if (!max_tid_amsdu_len) ++ if (!max_tid_amsdu_len || max_tid_amsdu_len == 1) + return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs); + + /* Sub frame header + SNAP + IP header + TCP header + MSS */ +@@ -846,6 +846,9 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, + */ + num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad); + ++ if (WARN_ON_ONCE(!num_subframes)) ++ return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs); ++ + if (sta->max_amsdu_subframes && + num_subframes > sta->max_amsdu_subframes) + num_subframes = sta->max_amsdu_subframes; +-- +2.50.1 (Apple Git-155) + diff --git a/1107-vfio-pci-check-bar-resources-before-exporting-a-dmabuf.patch b/1107-vfio-pci-check-bar-resources-before-exporting-a-dmabuf.patch new file mode 100644 index 000000000..312454956 --- /dev/null +++ b/1107-vfio-pci-check-bar-resources-before-exporting-a-dmabuf.patch @@ -0,0 +1,47 @@ +From 702809dabdecca807bdd50cfdcc1c980feb2ba62 Mon Sep 17 00:00:00 2001 +From: Matt Evans +Date: Mon, 11 May 2026 07:58:24 -0700 +Subject: [PATCH] vfio/pci: Check BAR resources before exporting a DMABUF + +commit 702809dabdecca807bdd50cfdcc1c980feb2ba62 upstream. + +A DMABUF exports access to BAR resources and, although they are +requested at startup time, we need to ensure they really were reserved +before exporting. Otherwise, it's possible to access unreserved +resources through the export. + +Add a check to the DMABUF-creation path. + +Fixes: 5d74781ebc86c ("vfio/pci: Add dma-buf export support for MMIO regions") +Signed-off-by: Matt Evans +Link: https://lore.kernel.org/r/20260511145829.2993601-3-mattev@meta.com +Signed-off-by: Alex Williamson + +CVE-2026-64042 + +Backported from mainline commit 702809dabdecca807bdd50cfdcc1c980feb2ba62. +drivers/vfio/pci/vfio_pci_dmabuf.c is present in the a10 kernel-6.12.0-211.34.1.el10_2 tree and the +exported helper vfio_pci_core_setup_barmap() exists; the vulnerable pre-image +matches verbatim, so the change applies cleanly, zero-fuzz (line offset only). + +diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c +index fdc22e8b4656..1a177ce7de54 100644 +--- a/drivers/vfio/pci/vfio_pci_dmabuf.c ++++ b/drivers/vfio/pci/vfio_pci_dmabuf.c +@@ -244,9 +244,11 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags, + return -EINVAL; + + /* +- * For PCI the region_index is the BAR number like everything else. ++ * For PCI the region_index is the BAR number like everything ++ * else. Check that PCI resources have been claimed for it. + */ +- if (get_dma_buf.region_index >= VFIO_PCI_ROM_REGION_INDEX) ++ if (get_dma_buf.region_index >= VFIO_PCI_ROM_REGION_INDEX || ++ vfio_pci_core_setup_barmap(vdev, get_dma_buf.region_index)) + return -ENODEV; + + dma_ranges = memdup_array_user(&arg->dma_ranges, get_dma_buf.nr_ranges, +-- +2.50.1 (Apple Git-155) + diff --git a/1108-accel-qaic-add-overflow-check-to-remap-pfn-range-during.patch b/1108-accel-qaic-add-overflow-check-to-remap-pfn-range-during.patch new file mode 100644 index 000000000..c782c1ddc --- /dev/null +++ b/1108-accel-qaic-add-overflow-check-to-remap-pfn-range-during.patch @@ -0,0 +1,79 @@ +From aa16b2bc0f02709919e2435f531406531e5bcc69 Mon Sep 17 00:00:00 2001 +From: Zack McKevitt +Date: Thu, 30 Apr 2026 12:39:01 -0700 +Subject: [PATCH] accel/qaic: Add overflow check to remap_pfn_range during mmap + +commit aa16b2bc0f02709919e2435f531406531e5bcc69 upstream. + +The call to remap_pfn_range in qaic_gem_object_mmap is susceptible to +(re)mapping beyond the VMA if the BO is too large. This can cause use +after free issues when munmap() unmaps only the VMA region and not the +additional mappings. To prevent this, check the remaining size of the +VMA before remapping and truncate the remapped length if sg->length is +too large. + +Reported-by: Lukas Maar +Fixes: ff13be830333 ("accel/qaic: Add datapath") +Reviewed-by: Karol Wachowski +Signed-off-by: Zack McKevitt +Reviewed-by: Jeff Hugo +[jhugo: fix braces from checkpatch --strict] +Signed-off-by: Jeff Hugo +Link: https://patch.msgid.link/20260430193858.1178641-1-zachary.mckevitt@oss.qualcomm.com +Signed-off-by: Sasha Levin + +CVE-2026-64051 + +[ Adjusted context: the a10 tree uses drm_gem_is_imported(obj) in place of + obj->import_attach; the code change is otherwise identical to the upstream + stable commit 8dd6edbe26770df147136c3f2ac976c873b82650 (linux-6.12.y). ] +Signed-off-by: Andrew Lukoshko +--- +diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c +index 60cb4d6..46f2b41 100644 +--- a/drivers/accel/qaic/qaic_data.c ++++ b/drivers/accel/qaic/qaic_data.c +@@ -606,8 +606,11 @@ static const struct vm_operations_struct drm_vm_ops = { + static int qaic_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma) + { + struct qaic_bo *bo = to_qaic_bo(obj); ++ unsigned long remap_start; + unsigned long offset = 0; ++ unsigned long remap_end; + struct scatterlist *sg; ++ unsigned long length; + int ret = 0; + + if (drm_gem_is_imported(obj)) +@@ -615,11 +618,27 @@ static int qaic_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struc + + for (sg = bo->sgt->sgl; sg; sg = sg_next(sg)) { + if (sg_page(sg)) { ++ /* if sg is too large for the VMA, so truncate it to fit */ ++ if (check_add_overflow(vma->vm_start, offset, &remap_start)) ++ return -EINVAL; ++ if (check_add_overflow(remap_start, sg->length, &remap_end)) ++ return -EINVAL; ++ ++ if (remap_end > vma->vm_end) { ++ if (check_sub_overflow(vma->vm_end, remap_start, &length)) ++ return -EINVAL; ++ } else { ++ length = sg->length; ++ } ++ ++ if (length == 0) ++ goto out; ++ + ret = remap_pfn_range(vma, vma->vm_start + offset, page_to_pfn(sg_page(sg)), +- sg->length, vma->vm_page_prot); ++ length, vma->vm_page_prot); + if (ret) + goto out; +- offset += sg->length; ++ offset += length; + } + } + +-- +2.47.3 diff --git a/1109-netfs-fix-early-put-of-sink-folio-in-netfs-read-gaps.patch b/1109-netfs-fix-early-put-of-sink-folio-in-netfs-read-gaps.patch new file mode 100644 index 000000000..0e8da05f6 --- /dev/null +++ b/1109-netfs-fix-early-put-of-sink-folio-in-netfs-read-gaps.patch @@ -0,0 +1,83 @@ +From 3e5dd91b87a8b1450217b56a336bee315f40da7d Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 12 May 2026 13:33:54 +0100 +Subject: [PATCH] netfs: Fix early put of sink folio in netfs_read_gaps() + +commit 3e5dd91b87a8b1450217b56a336bee315f40da7d upstream. + +Fix netfs_read_gaps() to release the sink page it uses after waiting for +the request to complete. The way the sink page is used is that an +ITER_BVEC-class iterator is created that has the gaps from the target folio +at either end, but has the sink page tiled over the middle so that a single +read op can fill in both gaps. + +The bug was found by KASAN detecting a UAF on the generic/075 xfstest in +the cifsd kernel thread that handles reception of data from the TCP socket: + + BUG: KASAN: use-after-free in _copy_to_iter+0x48a/0xa20 + Write of size 885 at addr ffff888107f92000 by task cifsd/1285 + CPU: 2 UID: 0 PID: 1285 Comm: cifsd Not tainted 7.0.0 #6 PREEMPT(lazy) + Call Trace: + dump_stack_lvl+0x5d/0x80 + print_report+0x17f/0x4f1 + kasan_report+0x100/0x1e0 + kasan_check_range+0x10f/0x1e0 + __asan_memcpy+0x3c/0x60 + _copy_to_iter+0x48a/0xa20 + __skb_datagram_iter+0x2c9/0x430 + skb_copy_datagram_iter+0x6e/0x160 + tcp_recvmsg_locked+0xce0/0x1130 + tcp_recvmsg+0xeb/0x300 + inet_recvmsg+0xcf/0x3a0 + sock_recvmsg+0xea/0x100 + cifs_readv_from_socket+0x3a6/0x4d0 [cifs] + cifs_read_iter_from_socket+0xdd/0x130 [cifs] + cifs_readv_receive+0xaad/0xb10 [cifs] + cifs_demultiplex_thread+0x1148/0x1740 [cifs] + kthread+0x1cf/0x210 + +Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") +Reported-by: Steve French +Signed-off-by: David Howells +Link: https://patch.msgid.link/20260512123404.719402-18-dhowells@redhat.com +Reviewed-by: Paulo Alcantara (Red Hat) +cc: Paulo Alcantara +cc: Matthew Wilcox +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin + +CVE-2026-64061 + +[ Adjusted context to the a10 netfs_read_gaps(): it predates the upstream + "if (group)" block, so the sink folio_put is moved to just before + folio_unlock(), immediately after the ret>=0 uptodate block. Semantically + identical to stable commit d4f4bc87c76511cf2532448b0fa40c25e894bd7d + (linux-6.12.y). ] +Signed-off-by: Andrew Lukoshko +--- +diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c +index 37ab6f2..8bfdef9 100644 +--- a/fs/netfs/buffered_read.c ++++ b/fs/netfs/buffered_read.c +@@ -459,14 +459,14 @@ static int netfs_read_gaps(struct file *file, struct folio *folio) + + netfs_read_to_pagecache(rreq, NULL); + +- if (sink) +- folio_put(sink); +- + ret = netfs_wait_for_read(rreq); + if (ret >= 0) { + flush_dcache_folio(folio); + folio_mark_uptodate(folio); + } ++ ++ if (sink) ++ folio_put(sink); + folio_unlock(folio); + netfs_put_request(rreq, netfs_rreq_trace_put_return); + return ret < 0 ? ret : 0; +-- +2.47.3 diff --git a/1110-ixgbevf-fix-use-after-free-in-vepa-multicast-source-pru.patch b/1110-ixgbevf-fix-use-after-free-in-vepa-multicast-source-pru.patch new file mode 100644 index 000000000..a3d3b9f43 --- /dev/null +++ b/1110-ixgbevf-fix-use-after-free-in-vepa-multicast-source-pru.patch @@ -0,0 +1,68 @@ +From a244395d8c563ed1bb26c3ef708db6aeeaa08084 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Fri, 15 May 2026 11:24:14 -0700 +Subject: [PATCH] ixgbevf: fix use-after-free in VEPA multicast source pruning + +commit 5d49b568c188dc77199d8d2b959c91da8cc27cf1 upstream. + +ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's +own address (VEPA multicast workaround) by freeing the skb and +continuing to the next descriptor: + + dev_kfree_skb_irq(skb); + continue; + +The skb pointer is declared outside the while loop and persists across +iterations. Because the continue skips the "skb = NULL" reset at the +bottom of the loop, the next iteration enters the "else if (skb)" path +and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing +skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. + +The sibling driver iavf already handles this correctly by nulling the +pointer before continuing. Apply the same pattern here. + +I do not have ixgbevf hardware; the bug was found by static analysis +(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool +corroboration with the highest score in the scan). The UAF was confirmed +under KASAN by loading a test module that reproduces the exact code +pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): + + BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 + Read of size 8 at addr 000000006163ae78 by task insmod/30 + freed 208-byte region [000000006163adc0, 000000006163ae90) + +QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF +driver does not include the VEPA source pruning path, so a full +end-to-end reproduction with emulated hardware was not possible. + +Fixes: bad17234ba70 ("ixgbevf: Change receive model to use double buffered page based receives") +Cc: stable@vger.kernel.org +Signed-off-by: Michael Bommarito +Reviewed-by: Simon Horman +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Link: https://patch.msgid.link/20260515182419.1597859-8-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +CVE-2026-64113 + +Backported from linux-6.12.y commit a244395d8c563ed1bb26c3ef708db6aeeaa08084 +(mainline 5d49b568c188dc77199d8d2b959c91da8cc27cf1); applies cleanly to the +a10 kernel-6.12.0-211.34.1.el10_2 tree, zero-fuzz (line offset only). + +diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +index a2a7cb6d8ea1..73225f59cd6c 100644 +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -1224,6 +1224,7 @@ static int ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector, + ether_addr_equal(rx_ring->netdev->dev_addr, + eth_hdr(skb)->h_source)) { + dev_kfree_skb_irq(skb); ++ skb = NULL; + continue; + } + +-- +2.50.1 (Apple Git-155) + diff --git a/1111-ipv6-ioam-refresh-hdr-pointer-before-ioam6-event.patch b/1111-ipv6-ioam-refresh-hdr-pointer-before-ioam6-event.patch new file mode 100644 index 000000000..a47ad2671 --- /dev/null +++ b/1111-ipv6-ioam-refresh-hdr-pointer-before-ioam6-event.patch @@ -0,0 +1,68 @@ +From 769723124b7c3b2bfea4cf68ad292698b87c8d01 Mon Sep 17 00:00:00 2001 +From: Justin Iurman +Date: Wed, 20 May 2026 14:42:42 +0200 +Subject: [PATCH] ipv6: ioam: refresh hdr pointer before ioam6_event() + +commit e46e6bc97fb1f339730ff1ba74267fbf48e7a422 upstream. + +Reported by Sashiko: + +In ipv6_hop_ioam(), the hdr pointer is initialized to point into the +skb's linear data buffer. Later, the code calls skb_ensure_writable(), +which might reallocate the buffer: + + if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len)) + goto drop; + + /* Trace pointer may have changed */ + trace = (struct ioam6_trace_hdr *)(skb_network_header(skb) + + optoff + sizeof(*hdr)); + + ioam6_fill_trace_data(skb, ns, trace, true); + + ioam6_event(IOAM6_EVENT_TRACE, dev_net(skb->dev), + GFP_ATOMIC, (void *)trace, hdr->opt_len - 2); + +If the skb is cloned or lacks sufficient linear headroom, +skb_ensure_writable() will invoke pskb_expand_head(), which reallocates +the skb's data buffer and frees the old one, invalidating pointers to +it. While the code recalculates the trace pointer immediately after the +call to skb_ensure_writable(), it fails to recalculate the hdr pointer. + +This patch fixes the above by recalculating the hdr pointer before +passing hdr->opt_len to ioam6_event(), so that we avoid any UaF. + +Fixes: f655c78d6225 ("net: exthdrs: ioam6: send trace event") +Cc: stable@vger.kernel.org +Signed-off-by: Justin Iurman +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/20260520124242.32320-1-justin.iurman@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +CVE-2026-64132 + +Backported from linux-6.12.y commit 769723124b7c3b2bfea4cf68ad292698b87c8d01 +(mainline e46e6bc97fb1f339730ff1ba74267fbf48e7a422); applies cleanly to the +a10 kernel-6.12.0-211.34.1.el10_2 tree, zero-fuzz (line offset only). + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index d09ae48030b3..a330aaf70b5a 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -957,9 +957,9 @@ static bool ipv6_hop_ioam(struct sk_buff *skb, int optoff) + if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len)) + goto drop; + +- /* Trace pointer may have changed */ +- trace = (struct ioam6_trace_hdr *)(skb_network_header(skb) +- + optoff + sizeof(*hdr)); ++ /* Trace and hdr pointers may have changed */ ++ hdr = (struct ioam6_hdr *)(skb_network_header(skb) + optoff); ++ trace = (struct ioam6_trace_hdr *)((u8 *)hdr + sizeof(*hdr)); + + ioam6_fill_trace_data(skb, ns, trace, true); + +-- +2.50.1 (Apple Git-155) + diff --git a/1112-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch b/1112-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch new file mode 100644 index 000000000..b35d84dee --- /dev/null +++ b/1112-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch @@ -0,0 +1,77 @@ +From 4bd8635f28c135a08aac6badcd7d9b5cdb34335f Mon Sep 17 00:00:00 2001 +From: Weiming Shi +Date: Wed, 15 Apr 2026 01:23:39 +0800 +Subject: [PATCH] i2c: stub: Reject I2C block transfers with invalid length + +commit 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e upstream. + +The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] +as the transfer length. The existing check only clamps it to avoid +overrunning the chip->words[256] register array, but does not validate +it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union +i2c_smbus_data.block buffer (34 bytes total). The driver is a +development/test tool (CONFIG_I2C_STUB=m, not built by default) +that must be loaded with a chip_addr= parameter. + +A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl +with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing +stub_xfer() to read or write past the end of the union +i2c_smbus_data.block buffer: + + BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223) + Read of size 1 at addr ffff88800abcfd92 by task exploit/81 + Call Trace: + + stub_xfer (drivers/i2c/i2c-stub.c:223) + __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593) + i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536) + i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391) + i2cdev_ioctl (drivers/i2c/i2c-dev.c:478) + __x64_sys_ioctl (fs/ioctl.c:583) + do_syscall_64 (arch/x86/entry/syscall_64.c:94) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) + + +The bug exists because i2c-stub implements .smbus_xfer directly, +bypassing the I2C_SMBUS_BLOCK_MAX validation in +i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same +function correctly validates against I2C_SMBUS_BLOCK_MAX, but the +I2C_SMBUS_I2C_BLOCK_DATA case does not. + +Fix by rejecting transfers with data->block[0] == 0 or +data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with +both the I2C_SMBUS_BLOCK_DATA case in the same function and the +I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated(). + +Fixes: 4710317891e4 ("i2c-stub: Implement I2C block support") +Reported-by: Xiang Mei +Signed-off-by: Weiming Shi +Reviewed-by: Jean Delvare +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +CVE-2026-64191 + +Backported from linux-6.12.y commit 4bd8635f28c135a08aac6badcd7d9b5cdb34335f +(mainline 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e); applies cleanly to the +a10 kernel-6.12.0-211.34.1.el10_2 tree, zero-fuzz (line offset only). + +diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c +index 09e7b7bf4c5f..a6e2ce4360ca 100644 +--- a/drivers/i2c/i2c-stub.c ++++ b/drivers/i2c/i2c-stub.c +@@ -214,6 +214,11 @@ static s32 stub_xfer(struct i2c_adapter *adap, u16 addr, unsigned short flags, + * We ignore banks here, because banked chips don't use I2C + * block transfers + */ ++ if (data->block[0] == 0 || ++ data->block[0] > I2C_SMBUS_BLOCK_MAX) { ++ ret = -EINVAL; ++ break; ++ } + if (data->block[0] > 256 - command) /* Avoid overrun */ + data->block[0] = 256 - command; + len = data->block[0]; +-- +2.50.1 (Apple Git-155) + diff --git a/kernel.spec b/kernel.spec index ea6887009..4b563d908 100644 --- a/kernel.spec +++ b/kernel.spec @@ -176,13 +176,13 @@ Summary: The Linux kernel %define specrpmversion 6.12.0 %define specversion 6.12.0 %define patchversion 6.12 -%define pkgrelease 211.34.1 +%define pkgrelease 211.34.2 %define kversion 6 %define tarfile_release 6.12.0-211.34.1.el10_2 # This is needed to do merge window version magic %define patchlevel 12 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 211.34.1%{?buildid}%{?dist} +%define specrelease 211.34.2%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 6.12.0-211.34.1.el10_2 @@ -1139,6 +1139,19 @@ Patch2008: 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch Patch2009: 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch Patch2010: 0001-Keep-fs-btrfs-files-in-modules-package.patch +Patch1100: 1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch +Patch1101: 1101-nfsd-release-layout-stid-on-setlease-failure.patch +Patch1102: 1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt-for-encrypt.patch +Patch1103: 1103-rpmsg-char-fix-use-after-free-on-probe-error-path.patch +Patch1104: 1104-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch +Patch1105: 1105-net-ip-gre-require-cap-net-admin-in-the-device-netns-fo.patch +Patch1106: 1106-wifi-iwlwifi-mld-fix-tso-segmentation-explosion-when-am.patch +Patch1107: 1107-vfio-pci-check-bar-resources-before-exporting-a-dmabuf.patch +Patch1108: 1108-accel-qaic-add-overflow-check-to-remap-pfn-range-during.patch +Patch1109: 1109-netfs-fix-early-put-of-sink-folio-in-netfs-read-gaps.patch +Patch1110: 1110-ixgbevf-fix-use-after-free-in-vepa-multicast-source-pru.patch +Patch1111: 1111-ipv6-ioam-refresh-hdr-pointer-before-ioam6-event.patch +Patch1112: 1112-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch # END OF PATCH DEFINITIONS %description @@ -2000,6 +2013,19 @@ ApplyPatch 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch ApplyPatch 0001-Keep-fs-btrfs-files-in-modules-package.patch %{log_msg "End of patch applications"} +ApplyPatch 1100-nfsd-fix-secinfo-no-name-decode-error-cleanup.patch +ApplyPatch 1101-nfsd-release-layout-stid-on-setlease-failure.patch +ApplyPatch 1102-kvm-svm-fix-page-overflow-in-sev-dbg-crypt-for-encrypt.patch +ApplyPatch 1103-rpmsg-char-fix-use-after-free-on-probe-error-path.patch +ApplyPatch 1104-keys-fix-overflow-in-keyctl-pkey-params-get-2.patch +ApplyPatch 1105-net-ip-gre-require-cap-net-admin-in-the-device-netns-fo.patch +ApplyPatch 1106-wifi-iwlwifi-mld-fix-tso-segmentation-explosion-when-am.patch +ApplyPatch 1107-vfio-pci-check-bar-resources-before-exporting-a-dmabuf.patch +ApplyPatch 1108-accel-qaic-add-overflow-check-to-remap-pfn-range-during.patch +ApplyPatch 1109-netfs-fix-early-put-of-sink-folio-in-netfs-read-gaps.patch +ApplyPatch 1110-ixgbevf-fix-use-after-free-in-vepa-multicast-source-pru.patch +ApplyPatch 1111-ipv6-ioam-refresh-hdr-pointer-before-ioam6-event.patch +ApplyPatch 1112-i2c-stub-reject-i2c-block-transfers-with-invalid-length.patch # END OF PATCH APPLICATIONS # Any further pre-build tree manipulations happen here. @@ -4511,6 +4537,21 @@ fi\ # # %changelog +* Tue Jul 21 2026 Andrew Lukoshko - 6.12.0-211.34.2 +- NFSD: Fix SECINFO_NO_NAME decode error cleanup (Guannan Wang) {CVE-2026-53398} +- nfsd: release layout stid on setlease failure (Chris Mason) {CVE-2026-53399} +- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (Ashutosh Desai) {CVE-2026-63794} +- rpmsg: char: Fix use-after-free on probe error path (Yuho Choi) {CVE-2026-63797} +- KEYS: fix overflow in keyctl_pkey_params_get_2() (Jarkko Sakkinen) {CVE-2026-63824} +- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) {CVE-2026-63829} +- wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Cole Leavitt) {CVE-2026-64037} +- vfio/pci: Check BAR resources before exporting a DMABUF (Matt Evans) {CVE-2026-64042} +- accel/qaic: Add overflow check to remap_pfn_range during mmap (Zack McKevitt) {CVE-2026-64051} +- netfs: Fix early put of sink folio in netfs_read_gaps() (David Howells) {CVE-2026-64061} +- ixgbevf: fix use-after-free in VEPA multicast source pruning (Michael Bommarito) {CVE-2026-64113} +- ipv6: ioam: refresh hdr pointer before ioam6_event() (Justin Iurman) {CVE-2026-64132} +- i2c: stub: Reject I2C block transfers with invalid length (Weiming Shi) {CVE-2026-64191} + * Fri Jul 17 2026 Eduard Abdullin - 6.12.0-211.34.1 - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert