Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()<br /> <br /> There&amp;#39;s no need to crash the kernel for these cases.<br /> <br /> (cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tipc: clear sock-&gt;sk on the failed-insert path in tipc_sk_create()<br /> <br /> When tipc_sk_create() fails to insert the new socket (tipc_sk_insert()<br /> returns non-zero), its error path frees the sk with sk_free() but leaves<br /> sock-&gt;sk pointing at the freed object:<br /> <br /> if (tipc_sk_insert(tsk)) {<br /> sk_free(sk);<br /> pr_warn("Socket create failed; port number exhausted\n");<br /> return -EINVAL;<br /> }<br /> <br /> This is harmless for plain socket(): the syscall layer clears sock-&gt;ops<br /> before releasing, so tipc_release() is never called. It is not harmless<br /> on the accept() path. tipc_accept() creates the pre-allocated child<br /> socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves<br /> new_sock-&gt;sk dangling and new_sock-&gt;ops non-NULL, and do_accept() then<br /> fput()s the new file, so __sock_release() -&gt; tipc_release() runs<br /> lock_sock(new_sock-&gt;sk) on the freed sk -- a use-after-free write of the<br /> sk_lock spinlock.<br /> <br /> tipc_release() already guards this exact "failed accept() releases a<br /> pre-allocated child" case with "if (sk == NULL) return 0;", but the<br /> guard is bypassed because tipc_sk_create() left sock-&gt;sk non-NULL<br /> (dangling) rather than NULL.<br /> <br /> Clear sock-&gt;sk on the failed-insert path so the existing tipc_release()<br /> NULL check fires and the use-after-free is avoided.<br /> <br /> The tipc_sk_insert() failure is reached when the per-netns socket<br /> rhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M<br /> elements) -- i.e. once a netns holds ~2M TIPC sockets every insert<br /> returns -E2BIG.<br /> <br /> BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)<br /> Write of size 8 at addr ffff8880047cdc38 by task init/1<br /> lock_sock_nested (net/core/sock.c:3839)<br /> tipc_release (net/tipc/socket.c:638)<br /> __sock_release (net/socket.c:710)<br /> sock_close (net/socket.c:1501)<br /> __fput (fs/file_table.c:512)<br /> Allocated by task 1:<br /> sk_alloc (net/core/sock.c:2308)<br /> tipc_sk_create (net/tipc/socket.c:487)<br /> tipc_accept (net/tipc/socket.c:2744)<br /> do_accept (net/socket.c:2034)<br /> Freed by task 1:<br /> __sk_destruct (net/core/sock.c:2391)<br /> tipc_sk_create (net/tipc/socket.c:504)<br /> tipc_accept (net/tipc/socket.c:2744)<br /> do_accept (net/socket.c:2034)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: Fix kernel panic during driver load failure<br /> <br /> Avoid kernel panic if MES init fails during driver load. The KIQ ring is<br /> falsely marked as ready as ASICs that use MES, KIQ is owned by MES.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> RIP: 0010:gfx_v12_1_wait_reg_mem+0x5a/0x1f0 [amdgpu]<br /> Call Trace:<br /> gfx_v12_1_ring_emit_reg_write_reg_wait+0x1f/0x30 [amdgpu]<br /> amdgpu_gmc_fw_reg_write_reg_wait+0xb2/0x190 [amdgpu]<br /> amdgpu_gmc_flush_gpu_tlb+0x1cc/0x230 [amdgpu]<br /> amdgpu_gart_invalidate_tlb+0x81/0xa0 [amdgpu]<br /> amdgpu_gart_unbind+0x72/0x90 [amdgpu]<br /> amdgpu_ttm_backend_unbind+0xa4/0xb0 [amdgpu]<br /> amdgpu_ttm_tt_unpopulate+0x13/0xd0 [amdgpu]<br /> amdttm_tt_unpopulate+0x29/0x70 [amdttm]<br /> ttm_bo_put+0x1eb/0x360 [amdttm]<br /> amdgpu_bo_free_kernel+0xf9/0x1f0 [amdgpu]<br /> amdgpu_ih_ring_fini+0x5a/0x90 [amdgpu]<br /> amdgpu_irq_fini_hw+0x58/0x80 [amdgpu]<br /> amdgpu_device_fini_hw+0x4e0/0x5b0 [amdgpu]<br /> amdgpu_driver_load_kms+0x60/0xa0 [amdgpu]<br /> amdgpu_pci_probe+0x28e/0x6d0 [amdgpu]<br /> pci_device_probe+0x19f/0x220<br /> really_probe+0x1ed/0x340<br /> driver_probe_device+0x1e/0x80<br /> __driver_attach+0xd3/0x1a0<br /> bus_for_each_dev+0x68/0xa0<br /> bus_add_driver+0x19f/0x270<br /> driver_register+0x5d/0xf0<br /> do_one_initcall+0xac/0x200<br /> do_init_module+0x1ec/0x280<br /> __se_sys_finit_module+0x2de/0x310<br /> do_syscall_64+0x6a/0x250<br /> entry_SYSCALL_64_after_hwframe+0x4b/0x53<br /> <br /> (cherry picked from commit 4623b958dd6da0f4c3026afdf330626a09ecb0f0)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu/vcn4: avoid rereading IB param length<br /> <br /> Reuse the parameter length returned by<br /> vcn_v4_0_enc_find_ib_param() instead of rereading it from<br /> the IB.<br /> <br /> This avoids a potential TOCTOU issue if the IB contents<br /> change between reads.<br /> <br /> (cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()<br /> <br /> There&amp;#39;s no need to crash the kernel for these cases.<br /> <br /> (cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()<br /> <br /> There&amp;#39;s no need to crash the kernel for these cases.<br /> <br /> (cherry picked from commit fa4f86a148271e325e95287630a3a15a9cd35fdc)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: invoke pm_genpd_remove() before freeing genpd<br /> <br /> Call pm_genpd_remove() to unregister from global list prior to releasing<br /> acp_genpd memory, and clear the pointer after free.<br /> <br /> (cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: fix division by zero with invalid uvd dimensions<br /> <br /> When width or height is less than 16, width_in_mb or height_in_mb<br /> becomes 0, leading to fs_in_mb being 0. This causes a division by<br /> zero when calculating num_dpb_buffer in H264 and H264 Perf decode<br /> paths.<br /> <br /> Add validation to reject frames with width

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu/vce: fix integer overflow in image size<br /> <br /> Fix a security vulnerability where malicious VCE command streams<br /> with oversized dimensions (e.g. 65536×65536) cause 32-bit integer<br /> overflow, wrapping the calculated buffer size to 0. This bypasses<br /> validation and allows GPU firmware to perform out-of-bound memory<br /> access.<br /> <br /> The fix uses 64-bit arithmetic to detect overflow and rejects<br /> invalid dimensions before they reach the hardware.<br /> <br /> V2: remove redundant check<br /> V3: modify max height value<br /> V4: remove size64<br /> <br /> (cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()<br /> <br /> There&amp;#39;s no need to crash the kernel for these cases.<br /> <br /> (cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: validate ACE size against SID sub-authorities<br /> <br /> set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but<br /> does not verify that the declared ACE size contains all sub-authorities<br /> described by that field. An undersized ACE can therefore be copied<br /> and later make the POSIX ACL deduplication walk inspect data beyond<br /> the copied ACE boundary.<br /> <br /> The existing initial bound check is also too small. It only ensures<br /> that the ACE size field is accessible before set_ntacl_dacl() reads<br /> sid.num_subauth farther into the input buffer.<br /> <br /> Require enough input for the fixed SID header before accessing<br /> num_subauth, reject ACEs smaller than that header, and skip ACEs<br /> whose declared size cannot contain the complete SID. This makes the<br /> validation consistent with the other ACE walk paths.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: bound DACL dedup walk to copied ACEs<br /> <br /> set_ntacl_dacl() can stop copying ACEs before consuming the full input<br /> DACL when size accounting overflows.<br /> <br /> When that happens, num_aces reflects only the ACEs that were actually<br /> copied into the output DACL, but set_posix_acl_entries_dacl() still<br /> receives nt_num_aces and uses it to walk the existing ACE array during<br /> dedup.<br /> <br /> That makes the dedup walk scan past the copied ACE array and inspect<br /> buffer tail that does not contain valid ACEs.<br /> <br /> Split the two meanings currently carried by the NT ACE count. Pass the<br /> number of copied NT ACEs to bound the dedup walk, and preserve the<br /> original "input DACL had NT ACEs" state separately for the<br /> Everyone/default ACL fallback.<br /> <br /> This keeps the dedup walk aligned with the ACEs that are actually<br /> present in the rebuilt DACL.