Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/tcp-ao: Fix MAC comparison to be constant-time<br /> <br /> To prevent timing attacks, MACs need to be compared in constant<br /> time. Use the appropriate helper function for this.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: Fix rcu_tasks stall in threaded busypoll<br /> <br /> I was debugging a NIC driver when I noticed that when I enable<br /> threaded busypoll, bpftrace hangs when starting up. dmesg showed:<br /> <br /> rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 10658 jiffies old.<br /> rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 40793 jiffies old.<br /> rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 131273 jiffies old.<br /> rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 402058 jiffies old.<br /> INFO: rcu_tasks detected stalls on tasks:<br /> 00000000769f52cd: .N nvcsw: 2/2 holdout: 1 idle_cpu: -1/64<br /> task:napi/eth2-8265 state:R running task stack:0 pid:48300 tgid:48300 ppid:2 task_flags:0x208040 flags:0x00004000<br /> Call Trace:<br /> <br /> ? napi_threaded_poll_loop+0x27c/0x2c0<br /> ? __pfx_napi_threaded_poll+0x10/0x10<br /> ? napi_threaded_poll+0x26/0x80<br /> ? kthread+0xfa/0x240<br /> ? __pfx_kthread+0x10/0x10<br /> ? ret_from_fork+0x31/0x50<br /> ? __pfx_kthread+0x10/0x10<br /> ? ret_from_fork_asm+0x1a/0x30<br /> <br /> <br /> The cause is that in threaded busypoll, the main loop is in<br /> napi_threaded_poll rather than napi_threaded_poll_loop, where the<br /> latter rarely iterates more than once within its loop. For<br /> rcu_softirq_qs_periodic inside napi_threaded_poll_loop to report its<br /> qs state, the last_qs must be 100ms behind, and this can&amp;#39;t happen<br /> because napi_threaded_poll_loop rarely iterates in threaded busypoll,<br /> and each time napi_threaded_poll_loop is called last_qs is reset to<br /> latest jiffies.<br /> <br /> This patch changes so that in threaded busypoll, last_qs is saved<br /> in the outer napi_threaded_poll, and whether busy_poll_last_qs<br /> is NULL indicates whether napi_threaded_poll_loop is called for<br /> busypoll. This way last_qs would not reset to latest jiffies on<br /> each invocation of napi_threaded_poll_loop.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie<br /> <br /> The current code checks &amp;#39;i + 5

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: server: fix use-after-free in smb2_open()<br /> <br /> The opinfo pointer obtained via rcu_dereference(fp-&gt;f_opinfo) is<br /> dereferenced after rcu_read_unlock(), creating a use-after-free<br /> window.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: Don&amp;#39;t log keys in SMB3 signing and encryption key generation<br /> <br /> When KSMBD_DEBUG_AUTH logging is enabled, generate_smb3signingkey() and<br /> generate_smb3encryptionkey() log the session, signing, encryption, and<br /> decryption key bytes. Remove the logs to avoid exposing credentials.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix use-after-free by using call_rcu() for oplock_info<br /> <br /> ksmbd currently frees oplock_info immediately using kfree(), even<br /> though it is accessed under RCU read-side critical sections in places<br /> like opinfo_get() and proc_show_files().<br /> <br /> Since there is no RCU grace period delay between nullifying the pointer<br /> and freeing the memory, a reader can still access oplock_info<br /> structure after it has been freed. This can leads to a use-after-free<br /> especially in opinfo_get() where atomic_inc_not_zero() is called on<br /> already freed memory.<br /> <br /> Fix this by switching to deferred freeing using call_rcu().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: mctp: fix device leak on probe failure<br /> <br /> Driver core holds a reference to the USB interface and its parent USB<br /> device while the interface is bound to a driver and there is no need to<br /> take additional references unless the structures are needed after<br /> disconnect.<br /> <br /> This driver takes a reference to the USB device during probe but does<br /> not to release it on probe failures.<br /> <br /> Drop the redundant device reference to fix the leak, reduce cargo<br /> culting, make it easier to spot drivers where an extra reference is<br /> needed, and reduce the risk of further memory leaks.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: nexthop: fix percpu use-after-free in remove_nh_grp_entry<br /> <br /> When removing a nexthop from a group, remove_nh_grp_entry() publishes<br /> the new group via rcu_assign_pointer() then immediately frees the<br /> removed entry&amp;#39;s percpu stats with free_percpu(). However, the<br /> synchronize_net() grace period in the caller remove_nexthop_from_groups()<br /> runs after the free. RCU readers that entered before the publish still<br /> see the old group and can dereference the freed stats via<br /> nh_grp_entry_stats_inc() -&gt; get_cpu_ptr(nhge-&gt;stats), causing a<br /> use-after-free on percpu memory.<br /> <br /> Fix by deferring the free_percpu() until after synchronize_net() in the<br /> caller. Removed entries are chained via nh_list onto a local deferred<br /> free list. After the grace period completes and all RCU readers have<br /> finished, the percpu stats are safely freed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: ncsi: fix skb leak in error paths<br /> <br /> Early return paths in NCSI RX and AEN handlers fail to release<br /> the received skb, resulting in a memory leak.<br /> <br /> Specifically, ncsi_aen_handler() returns on invalid AEN packets<br /> without consuming the skb. Similarly, ncsi_rcv_rsp() exits early<br /> when failing to resolve the NCSI device, response handler, or<br /> request, leaving the skb unfreed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: dsa: microchip: Fix error path in PTP IRQ setup<br /> <br /> If request_threaded_irq() fails during the PTP message IRQ setup, the<br /> newly created IRQ mapping is never disposed. Indeed, the<br /> ksz_ptp_irq_setup()&amp;#39;s error path only frees the mappings that were<br /> successfully set up.<br /> <br /> Dispose the newly created mapping if the associated<br /> request_threaded_irq() fails at setup.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: macb: Shuffle the tx ring before enabling tx<br /> <br /> Quanyang observed that when using an NFS rootfs on an AMD ZynqMp board,<br /> the rootfs may take an extended time to recover after a suspend.<br /> Upon investigation, it was determined that the issue originates from a<br /> problem in the macb driver.<br /> <br /> According to the Zynq UltraScale TRM [1], when transmit is disabled,<br /> the transmit buffer queue pointer resets to point to the address<br /> specified by the transmit buffer queue base address register.<br /> <br /> In the current implementation, the code merely resets `queue-&gt;tx_head`<br /> and `queue-&gt;tx_tail` to &amp;#39;0&amp;#39;. This approach presents several issues:<br /> <br /> - Packets already queued in the tx ring are silently lost,<br /> leading to memory leaks since the associated skbs cannot be released.<br /> <br /> - Concurrent write access to `queue-&gt;tx_head` and `queue-&gt;tx_tail` may<br /> occur from `macb_tx_poll()` or `macb_start_xmit()` when these values<br /> are reset to &amp;#39;0&amp;#39;.<br /> <br /> - The transmission may become stuck on a packet that has already been sent<br /> out, with its &amp;#39;TX_USED&amp;#39; bit set, but has not yet been processed. However,<br /> due to the manipulation of &amp;#39;queue-&gt;tx_head&amp;#39; and &amp;#39;queue-&gt;tx_tail&amp;#39;,<br /> `macb_tx_poll()` incorrectly assumes there are no packets to handle<br /> because `queue-&gt;tx_head == queue-&gt;tx_tail`. This issue is only resolved<br /> when a new packet is placed at this position. This is the root cause of<br /> the prolonged recovery time observed for the NFS root filesystem.<br /> <br /> To resolve this issue, shuffle the tx ring and tx skb array so that<br /> the first unsent packet is positioned at the start of the tx ring.<br /> Additionally, ensure that updates to `queue-&gt;tx_head` and<br /> `queue-&gt;tx_tail` are properly protected with the appropriate lock.<br /> <br /> [1] https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: Fix use-after-free race in VM acquire<br /> <br /> Replace non-atomic vm-&gt;process_info assignment with cmpxchg()<br /> to prevent race when parent/child processes sharing a drm_file<br /> both try to acquire the same VM after fork().<br /> <br /> (cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)