Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: bound DACL dedup walk to copied ACEs<br /> <br /> set_ntacl_dacl() can stop copying ACEs before consuming the full input<br /> DACL when size accounting overflows.<br /> <br /> When that happens, num_aces reflects only the ACEs that were actually<br /> copied into the output DACL, but set_posix_acl_entries_dacl() still<br /> receives nt_num_aces and uses it to walk the existing ACE array during<br /> dedup.<br /> <br /> That makes the dedup walk scan past the copied ACE array and inspect<br /> buffer tail that does not contain valid ACEs.<br /> <br /> Split the two meanings currently carried by the NT ACE count. Pass the<br /> number of copied NT ACEs to bound the dedup walk, and preserve the<br /> original "input DACL had NT ACEs" state separately for the<br /> Everyone/default ACL fallback.<br /> <br /> This keeps the dedup walk aligned with the ACEs that are actually<br /> present in the rebuilt DACL.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL<br /> <br /> check_add_overflow() unconditionally writes the truncated sum into *d<br /> even on overflow, per its contract in include/linux/overflow.h.<br /> The four check_add_overflow() guards in set_posix_acl_entries_dacl()<br /> and set_ntacl_dacl() break out of the ACE-building loops on overflow,<br /> but the truncated *size is then consumed downstream at the end of<br /> set_ntacl_dacl():<br /> <br /> pndacl-&gt;size = cpu_to_le16(le16_to_cpu(pndacl-&gt;size) + size);<br /> <br /> This produces an on-wire NT ACL whose pndacl-&gt;size under-reports the<br /> bytes actually written by the preceding fill_ace_for_sid()/memcpy()<br /> calls, yielding a malformed ACL that can trigger out-of-bounds reads<br /> when re-parsed by clients or ksmbd itself.<br /> <br /> Restore *size to its pre-addition value on each overflow branch (via<br /> `*size -= ace_sz` / `size -= nt_ace_size`) so that after the break,<br /> *size once again holds the cumulative size of the successfully-written<br /> ACEs. The committed ACL is then truncated-but-self-consistent rather<br /> than malformed.<br /> <br /> The ksmbd DACL builders are the only check_add_overflow() sites found<br /> where an overflow path breaks out of a loop and the destination value<br /> is consumed afterward. The other nearby break-style cases either<br /> return -EINVAL on overflow (transport_ipc.c) or break without<br /> consuming the overflowed destination value afterward (buildid.c).

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl<br /> <br /> set_ntacl_dacl() copies each ACE from the attacker-controlled stored<br /> security descriptor verbatim into the response DACL without checking<br /> sid.num_subauth. The ACE bytes (including an unchecked num_subauth)<br /> originate from an authenticated SMB2_SET_INFO(SecInfo=DACL) that is<br /> stored raw via ksmbd_vfs_set_sd_xattr(); parse_dacl() rejects a bad ACE<br /> with `break` rather than an error, so parse_sec_desc() still returns<br /> success and the malformed SD reaches the xattr intact.<br /> <br /> On a subsequent SMB2_QUERY_INFO(SecInfo=DACL) for an inode carrying a<br /> POSIX access ACL, build_sec_desc() -&gt; set_ntacl_dacl() -&gt;<br /> set_posix_acl_entries_dacl() walks the copied ACEs and reads<br /> <br /> ntace-&gt;sid.sub_auth[ntace-&gt;sid.num_subauth - 1]<br /> <br /> with num_subauth taken straight from the stored SD. Since sub_auth[]<br /> is fixed at SID_MAX_SUB_AUTHORITIES (15), a crafted num_subauth (e.g.<br /> 255) drives an out-of-bounds heap read of ~1 KB with an offset fully<br /> controlled by an authenticated client.<br /> <br /> The sibling functions already gate this field:<br /> parse_dacl() -- num_subauth == 0 || &gt; SID_MAX_SUB_AUTHORITIES<br /> parse_sid() -- num_subauth &gt; SID_MAX_SUB_AUTHORITIES<br /> smb_copy_sid() -- min_t(u8, num_subauth, SID_MAX_SUB_AUTHORITIES)<br /> set_ntacl_dacl() is the lone inconsistent path that omits the check.<br /> <br /> Add the same num_subauth validation in set_ntacl_dacl() before copying<br /> the ACE, matching the gate already enforced by parse_dacl().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: fix aperture mapping leak<br /> <br /> amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver<br /> fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to<br /> always return false, so iounmap(aper_base_kaddr) never runs on normal<br /> driver unload, leaving an orphaned entry in the x86 PAT interval tree.<br /> <br /> On connected_to_cpu hardware, the aperture is mapped write-back (WB) via<br /> ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC)<br /> over the same range. The WC vs WB conflict causes:<br /> <br /> ioremap error for 0x..., requested 0x1, got 0x0<br /> amdgpu: discovery failed: -2<br /> <br /> Fix by switching to devres-managed mappings so cleanup is guaranteed<br /> regardless of drm_dev_enter() state:<br /> <br /> - connected_to_cpu path: devm_memremap(MEMREMAP_WB). For<br /> IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut,<br /> returning __va(offset) from the existing kernel direct map. No new<br /> ioremap VA or PAT entry is created, so there is nothing to orphan.<br /> <br /> - dGPU path: devm_ioremap_wc() registers iounmap() as a devres action,<br /> guaranteeing cleanup at device_del() time.<br /> <br /> Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio()<br /> since the mapping is now devres-owned.<br /> <br /> v2: Remove redundant x86_64 guard (Lijo)<br /> <br /> (cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: reject mapping a reserved doorbell to a new queue<br /> <br /> When creating an user-queue, the user space<br /> provides a doorbell BO handle and an offset within<br /> the bo to obtain a doorbell.<br /> <br /> However current implementation using xa_store_irq()<br /> to store a doorbell, which allows a later queue created<br /> with the same BO and offset parameters to overwrite an<br /> existing queue and doorbell mapping.<br /> <br /> This can cause problems like misrouting fence IRQ<br /> processing to a wrong queue, and mislead the cleanup<br /> process of one queue erasing the mapping of another queue.<br /> <br /> This commit fixes this issue by replacing xa_store_irq with<br /> xa_insert_irq, which rejects mapping a reserved<br /> doorbell to a newly created queue<br /> <br /> (cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e)

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sched_ext: Preserve rq tracking across local DSQ dispatch<br /> <br /> dispatch_to_local_dsq() can run from scx_bpf_dsq_move_to_local() while<br /> ops.dispatch() has recorded the current rq. Moving a task to a local DSQ<br /> may switch to the source or destination rq before synchronously invoking<br /> ops.dequeue() through the following path:<br /> <br /> SCX_CALL_OP(dispatch, rq)<br /> ops.dispatch()<br /> scx_bpf_dsq_move_to_local()<br /> scx_flush_dispatch_buf()<br /> finish_dispatch()<br /> dispatch_to_local_dsq()<br /> scx_dispatch_enqueue()<br /> local_dsq_post_enq()<br /> call_task_dequeue()<br /> SCX_CALL_OP_TASK(dequeue, locked_rq, ...)<br /> <br /> The nested callback saves the recorded rq and restores it on return. If<br /> the rq tracking does not follow the lock switch, update_locked_rq() can<br /> trigger the following lockdep assertion while restoring an rq which is<br /> no longer held:<br /> <br /> WARNING: kernel/sched/sched.h:1641 at call_task_dequeue+0x160/0x170<br /> Call Trace:<br /> scx_dispatch_enqueue+0x2b0/0x460<br /> dispatch_to_local_dsq+0x138/0x230<br /> scx_flush_dispatch_buf+0x1af/0x220<br /> scx_bpf_dsq_move_to_local___v2+0xe2/0x1c0<br /> bpf__sched_ext_ops_dispatch+0x4b/0xa7<br /> do_pick_task_scx+0x3b6/0x910<br /> __pick_next_task+0x105/0x1f0<br /> __schedule+0x3e7/0x1980<br /> <br /> Introduce switch_rq_lock() to update the tracking state together with<br /> each rq lock handoff. Use it in dispatch_to_local_dsq(),<br /> move_remote_task_to_local_dsq() and the in-balance paths of<br /> scx_dsq_move(), ensuring that scx_locked_rq() consistently refers to the<br /> rq whose lock is actually held throughout the lock dance.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: fix race between registration and connection abortion<br /> <br /> This fixes this race:<br /> - thread a: io_uring_enter -&gt; register sqe -&gt;<br /> fuse_uring_create_ring_ent -&gt; allocate ent but doesn&amp;#39;t grab queue_ref<br /> yet<br /> - thread b: fuse_conn_destroy() -&gt; fuse_chan_abort() -&gt;<br /> fuse_uring_abort() is a no-op due to queue ref being 0<br /> - thread a: grabs the queue_ref, queue_ref is now 1, rest of<br /> fuse_uring_do_register() logic executes<br /> - thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs<br /> and calls<br /> "wait_event(ring-&gt;stop_waitq, atomic_read(&amp;ring-&gt;queue_refs) == 0);"<br /> The abort/unmount thread will hang indefinitely in unkillable state as<br /> nothing will decrement queue_refs or wake stop_waitq, and the ring,<br /> queue, and ent are leaked.<br /> <br /> Fix this by checking fch-&gt;connected under fch-&gt;lock after the created<br /> ent has grabbed a ref count on the queue. This ensures that in the<br /> scenario above, it is guaranteed that we either release the queue ref<br /> and wake up stop_waitq (in case fuse_chan_wait_aborted() is already<br /> waiting) in fuse_uring_do_register() when we detect !fch-&gt;connected, or<br /> if the connection is aborted after the check, it is guaranteed that the<br /> async teardown worker will be running in the background cleaning up ents<br /> and decrementing the ent&amp;#39;s ref on the queue, which will unblock the<br /> eventual queue and ring teardown.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> audit: fix recursive locking deadlock in audit_dupe_exe()<br /> <br /> A deadlock occurs in the audit subsystem when duplicating<br /> executable-related rules.<br /> <br /> When a file is moved (e.g., via do_renameat2()), the VFS layer locks<br /> the parent directory (I_MUTEX_PARENT), which synchronously triggers an<br /> fsnotify_move event. If an existing executable audit rule matches the<br /> file being moved, the audit subsystem catches this event and calls<br /> audit_dupe_exe() to duplicate the watch and update the rule. Then,<br /> audit_alloc_mark() would call kern_path_parent() to resolve the path,<br /> leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock<br /> already held by the task, resulting in the following recursive locking<br /> deadlock:<br /> <br /> ============================================<br /> WARNING: possible recursive locking detected<br /> 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted<br /> --------------------------------------------<br /> mv/5099 is trying to acquire lock:<br /> ffff888132845358 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1){+.+.}-{3:3},<br /> at: __kern_path_locked+0x10a/0x2f0<br /> <br /> but task is already holding lock:<br /> ffff888132846b58 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1){+.+.}-{3:3},<br /> at: lock_two_directories+0x13f/0x2b0<br /> <br /> other info that might help us debug this:<br /> Possible unsafe locking scenario:<br /> <br /> CPU0<br /> ----<br /> lock(&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1);<br /> lock(&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1);<br /> <br /> *** DEADLOCK ***<br /> <br /> May be due to missing lock nesting notation<br /> <br /> 6 locks held by mv/5099:<br /> #0: ffff888112a9c440 (sb_writers#13)<br /> at: do_renameat2+0x34c/0xbc0<br /> #1: ffff888112a9c790 (&amp;type-&gt;s_vfs_rename_key#3)<br /> at: do_renameat2+0x415/0xbc0<br /> #2: ffff888132846b58 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1)<br /> at: lock_two_directories+0x13f/0x2b0<br /> #3: ffff888132845358 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/5)<br /> at: lock_two_directories+0x175/0x2b0<br /> #4: ffffffffb3a1fb10 (&amp;fsnotify_mark_srcu)<br /> at: fsnotify+0x454/0x28a0<br /> #5: ffffffffaf886230 (audit_filter_mutex)<br /> at: audit_update_watch+0x36/0x11e0<br /> <br /> stack backtrace:<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x6f/0xb0<br /> print_deadlock_bug.cold+0xbd/0xca<br /> validate_chain+0x83a/0xf00<br /> __lock_acquire+0xcac/0x1d20<br /> lock_acquire.part.0+0x11b/0x360<br /> down_write_nested+0x9f/0x230<br /> __kern_path_locked+0x10a/0x2f0<br /> kern_path_locked+0x26/0x40<br /> audit_alloc_mark+0xfb/0x4f0<br /> audit_dupe_exe+0x6c/0xe0<br /> audit_dupe_rule+0x6c2/0xc00<br /> audit_update_watch+0x4cc/0x11e0<br /> audit_watch_handle_event+0x12c/0x1b0<br /> send_to_group+0x5d0/0x8b0<br /> fsnotify+0x615/0x28a0<br /> fsnotify_move+0x1d8/0x630<br /> vfs_rename+0xdcd/0x1df0<br /> do_renameat2+0x9d4/0xbc0<br /> __x64_sys_renameat+0x192/0x260<br /> do_syscall_64+0x92/0x180<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> RIP: 0033:0x7f0491fe8c4e<br /> Code: 0f 1f 40 00 48 8b 15 c1 e1 16 00 f7 d8 64 89 02 b8 ff ff ff ff<br /> c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 08 01 00 00 0f 05 <br /> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 89<br /> RSP: 002b:00007ffc7210bf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000108<br /> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0491fe8c4e<br /> RDX: 0000000000000003 RSI: 00007ffc7210e6c8 RDI: 00000000ffffff9c<br /> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001<br /> R10: 00005575eb2dae2a R11: 0000000000000246 R12: 00005575eb2dae2a<br /> R13: 00007ffc7210e6c8 R14: 0000000000000003 R15: 00000000ffffff9c<br /> <br /> <br /> The aforementioned deadlock can be consistently reproduced by running<br /> the script below:<br /> <br /> audit-dupe-exe-deadlock.sh<br /> --------------------------<br /> #!/bin/bash<br /> auditctl -D<br /> mkdir -p /tmp/foo<br /> touch /tmp/file<br /> auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr<br /> mv /tmp/file /tmp/foo/file<br /> rm -Rf /tmp/foo<br /> <br /> This patch fixes the issue by introducing struct audit_watch_ctx to pass<br /> the fsnotify event context down to audit_alloc_mark(). By utilizing the<br /> already-resolved directory inode provided by the event, we bypass the<br /> kern_path_parent() path resol<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug<br /> <br /> If a vCPU stays scheduled out (or blocked) while the last pCPU it ran<br /> on goes through a hotplug cycle (online-&gt;offline-&gt;online), and the vCPU<br /> then resumes execution on the same pCPU, then it is possible for it to<br /> run with an ASID that has now been assigned to a different vCPU,<br /> resulting in stale TLB translations being used.<br /> <br /> svm_enable_virtualization_cpu() resets asid_generation to 1 and sets<br /> next_asid to max_asid + 1 on every CPU online event, including hotplug<br /> cycles. Because next_asid starts beyond the pool boundary, the first<br /> call to new_asid() after an online event always wraps the pool,<br /> incrementing asid_generation to 2 and assigning ASIDs starting from<br /> min_asid.<br /> <br /> Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding<br /> asid_generation=2 and ASID=N from before the hotplug event:<br /> <br /> 1. CPU-X goes offline and back online: asid_generation resets to 1,<br /> next_asid = max_asid + 1.<br /> <br /> 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping<br /> the pool and consuming ASIDs starting from min_asid. Eventually<br /> vCPU-B from a different VM is assigned asid_generation=2, ASID=N<br /> — the same ASID that vCPU-A held before the hotplug.<br /> <br /> 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb-&gt;cpu is<br /> unchanged so the migration branch is skipped. Its saved<br /> asid_generation=2 matches sd-&gt;asid_generation=2, so the generation<br /> check silently passes and vCPU-A continues running with ASID=N —<br /> the same ASID just freshly assigned to vCPU-B.<br /> <br /> Both vCPUs from different VMs now run on CPU-X with the same ASID,<br /> causing them to share NPT TLB entries and producing stale translations.<br /> <br /> The collision manifests as a KVM internal error (Suberror: 1, emulation<br /> failure). The NPT page fault reports a faulting GPA far outside the<br /> VM&amp;#39;s physical memory range — a sign of stale TLB translations being<br /> used. KVM falls back to instruction emulation, which fails on<br /> FPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not<br /> implement.<br /> <br /> Fix this by incrementing asid_generation instead of resetting it to 1<br /> in svm_enable_virtualization_cpu(). On module load, asid_generation<br /> starts at 0 (memset) and the increment produces 1, identical to the<br /> old behaviour. On subsequent hotplug cycles the generation advances<br /> beyond any value a vCPU previously observed on this CPU, so the<br /> generation check in pre_svm_run() reliably forces new_asid() on every<br /> vCPU after every hotplug cycle.

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

A flaw was found in GIMP&amp;#39;s PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim&amp;#39;s system.