Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext<br /> <br /> When alloc_slab_obj_exts() fails and then later succeeds in allocating a<br /> slab extension vector, it calls handle_failed_objexts_alloc() to mark all<br /> objects in the vector as empty. As a result all objects in this slab<br /> (slabA) will have their extensions set to CODETAG_EMPTY.<br /> <br /> Later on if this slabA is used to allocate a slabobj_ext vector for<br /> another slab (slabB), we end up with the slabB-&gt;obj_exts pointing to a<br /> slabobj_ext vector that itself has a non-NULL slabobj_ext equal to<br /> CODETAG_EMPTY. When slabB gets freed, free_slab_obj_exts() is called to<br /> free slabB-&gt;obj_exts vector. <br /> <br /> free_slab_obj_exts() calls mark_objexts_empty(slabB-&gt;obj_exts) which will<br /> generate a warning because it expects slabobj_ext vectors to have a NULL<br /> obj_ext, not CODETAG_EMPTY.<br /> <br /> Modify mark_objexts_empty() to skip the warning and setting the obj_ext<br /> value if it&amp;#39;s already set to CODETAG_EMPTY.<br /> <br /> <br /> To quickly detect this WARN, I modified the code from<br /> WARN_ON(slab_exts[offs].ref.ct) to BUG_ON(slab_exts[offs].ref.ct == 1);<br /> <br /> We then obtained this message:<br /> <br /> [21630.898561] ------------[ cut here ]------------<br /> [21630.898596] kernel BUG at mm/slub.c:2050!<br /> [21630.898611] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP<br /> [21630.900372] Modules linked in: squashfs isofs vfio_iommu_type1 <br /> vhost_vsock vfio vhost_net vmw_vsock_virtio_transport_common vhost tap <br /> vhost_iotlb iommufd vsock binfmt_misc nfsv3 nfs_acl nfs lockd grace <br /> netfs tls rds dns_resolver tun brd overlay ntfs3 exfat btrfs <br /> blake2b_generic xor xor_neon raid6_pq loop sctp ip6_udp_tunnel <br /> udp_tunnel nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib <br /> nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct <br /> nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 <br /> nf_tables rfkill ip_set sunrpc vfat fat joydev sg sch_fq_codel nfnetlink <br /> virtio_gpu sr_mod cdrom drm_client_lib virtio_dma_buf drm_shmem_helper <br /> drm_kms_helper drm ghash_ce backlight virtio_net virtio_blk virtio_scsi <br /> net_failover virtio_console failover virtio_mmio dm_mirror <br /> dm_region_hash dm_log dm_multipath dm_mod fuse i2c_dev virtio_pci <br /> virtio_pci_legacy_dev virtio_pci_modern_dev virtio virtio_ring autofs4 <br /> aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject]<br /> [21630.909177] CPU: 3 UID: 0 PID: 3787 Comm: kylin-process-m Kdump: <br /> loaded Tainted: G        W           6.18.0-rc1+ #74 PREEMPT(voluntary)<br /> [21630.910495] Tainted: [W]=WARN<br /> [21630.910867] Hardware name: QEMU KVM Virtual Machine, BIOS unknown <br /> 2/2/2022<br /> [21630.911625] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS <br /> BTYPE=--)<br /> [21630.912392] pc : __free_slab+0x228/0x250<br /> [21630.912868] lr : __free_slab+0x18c/0x250[21630.913334] sp : <br /> ffff8000a02f73e0<br /> [21630.913830] x29: ffff8000a02f73e0 x28: fffffdffc43fc800 x27: <br /> ffff0000c0011c40<br /> [21630.914677] x26: ffff0000c000cac0 x25: ffff00010fe5e5f0 x24: <br /> ffff000102199b40<br /> [21630.915469] x23: 0000000000000003 x22: 0000000000000003 x21: <br /> ffff0000c0011c40<br /> [21630.916259] x20: fffffdffc4086600 x19: fffffdffc43fc800 x18: <br /> 0000000000000000<br /> [21630.917048] x17: 0000000000000000 x16: 0000000000000000 x15: <br /> 0000000000000000<br /> [21630.917837] x14: 0000000000000000 x13: 0000000000000000 x12: <br /> ffff70001405ee66<br /> [21630.918640] x11: 1ffff0001405ee65 x10: ffff70001405ee65 x9 : <br /> ffff800080a295dc<br /> [21630.919442] x8 : ffff8000a02f7330 x7 : 0000000000000000 x6 : <br /> 0000000000003000<br /> [21630.920232] x5 : 0000000024924925 x4 : 0000000000000001 x3 : <br /> 0000000000000007<br /> [21630.921021] x2 : 0000000000001b40 x1 : 000000000000001f x0 : <br /> 0000000000000001<br /> [21630.921810] Call trace:<br /> [21630.922130]  __free_slab+0x228/0x250 (P)<br /> [21630.922669]  free_slab+0x38/0x118<br /> [21630.923079]  free_to_partial_list+0x1d4/0x340<br /> [21630.923591]  __slab_free+0x24c/0x348<br /> [21630.924024]  ___cache_free+0xf0/0x110<br /> [21630.924468]  qlist_free_all+0x78/0x130<br /> [21630.924922]  kasan_quarantine_reduce+0x11<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Add bpf_prog_run_data_pointers()<br /> <br /> syzbot found that cls_bpf_classify() is able to change<br /> tc_skb_cb(skb)-&gt;drop_reason triggering a warning in sk_skb_reason_drop().<br /> <br /> WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]<br /> WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214<br /> <br /> struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched:<br /> Extend qdisc control block with tc control block"), which added a wrong<br /> interaction with db58ba459202 ("bpf: wire in data and data_end for<br /> cls_act_bpf").<br /> <br /> drop_reason was added later.<br /> <br /> Add bpf_prog_run_data_pointers() helper to save/restore the net_sched<br /> storage colliding with BPF data_meta/data_end.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: remove two invalid BUG_ON()s<br /> <br /> Those can be triggered trivially by userspace.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing<br /> <br /> Theoretically it&amp;#39;s an oopsable race, but I don&amp;#39;t believe one can manage<br /> to hit it on real hardware; might become doable on a KVM, but it still<br /> won&amp;#39;t be easy to attack.<br /> <br /> Anyway, it&amp;#39;s easy to deal with - since xdr_encode_hyper() is just a call of<br /> put_unaligned_be64(), we can put that under -&gt;d_lock and be done with that.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up<br /> <br /> The function ring_buffer_map_get_reader() is a bit more strict than the<br /> other get reader functions, and except for certain situations the<br /> rb_get_reader_page() should not return NULL. If it does, it triggers a<br /> warning.<br /> <br /> This warning was triggering but after looking at why, it was because<br /> another acceptable situation was happening and it wasn&amp;#39;t checked for.<br /> <br /> If the reader catches up to the writer and there&amp;#39;s still data to be read<br /> on the reader page, then the rb_get_reader_page() will return NULL as<br /> there&amp;#39;s no new page to get.<br /> <br /> In this situation, the reader page should not be updated and no warning<br /> should trigger.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: mdio: Check regmap pointer returned by device_node_to_regmap()<br /> <br /> The call to device_node_to_regmap() in airoha_mdio_probe() can return<br /> an ERR_PTR() if regmap initialization fails. Currently, the driver<br /> stores the pointer without validation, which could lead to a crash<br /> if it is later dereferenced.<br /> <br /> Add an IS_ERR() check and return the corresponding error code to make<br /> the probe path more robust.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()<br /> <br /> Use RCU to avoid a pair of atomic operations and a potential<br /> UAF on dst_dev()-&gt;flags.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/msm: Fix GEM free for imported dma-bufs<br /> <br /> Imported dma-bufs also have obj-&gt;resv != &amp;obj-&gt;_resv. So we should<br /> check both this condition in addition to flags for handling the<br /> _NO_SHARE case.<br /> <br /> Fixes this splat that was reported with IRIS video playback:<br /> <br /> ------------[ cut here ]------------<br /> WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm]<br /> CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT<br /> pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)<br /> pc : msm_gem_free_object+0x1f8/0x264 [msm]<br /> lr : msm_gem_free_object+0x138/0x264 [msm]<br /> sp : ffff800092a1bb30<br /> x29: ffff800092a1bb80 x28: ffff800092a1bce8 x27: ffffbc702dbdbe08<br /> x26: 0000000000000008 x25: 0000000000000009 x24: 00000000000000a6<br /> x23: ffff00083c72f850 x22: ffff00083c72f868 x21: ffff00087e69f200<br /> x20: ffff00087e69f330 x19: ffff00084d157ae0 x18: 0000000000000000<br /> x17: 0000000000000000 x16: ffffbc704bd46b80 x15: 0000ffffd0959540<br /> x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000<br /> x11: ffffbc702e6cdb48 x10: 0000000000000000 x9 : 000000000000003f<br /> x8 : ffff800092a1ba90 x7 : 0000000000000000 x6 : 0000000000000020<br /> x5 : ffffbc704bd46c40 x4 : fffffdffe102cf60 x3 : 0000000000400032<br /> x2 : 0000000000020000 x1 : ffff00087e6978e8 x0 : ffff00087e6977e8<br /> Call trace:<br /> msm_gem_free_object+0x1f8/0x264 [msm] (P)<br /> drm_gem_object_free+0x1c/0x30 [drm]<br /> drm_gem_object_handle_put_unlocked+0x138/0x150 [drm]<br /> drm_gem_object_release_handle+0x5c/0xcc [drm]<br /> drm_gem_handle_delete+0x68/0xbc [drm]<br /> drm_gem_close_ioctl+0x34/0x40 [drm]<br /> drm_ioctl_kernel+0xc0/0x130 [drm]<br /> drm_ioctl+0x360/0x4e0 [drm]<br /> __arm64_sys_ioctl+0xac/0x104<br /> invoke_syscall+0x48/0x104<br /> el0_svc_common.constprop.0+0x40/0xe0<br /> do_el0_svc+0x1c/0x28<br /> el0_svc+0x34/0xec<br /> el0t_64_sync_handler+0xa0/0xe4<br /> el0t_64_sync+0x198/0x19c<br /> ---[ end trace 0000000000000000 ]---<br /> ------------[ cut here ]------------<br /> <br /> Patchwork: https://patchwork.freedesktop.org/patch/676273/

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()<br /> <br /> kcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws<br /> remains NULL while ectx.ws_size is set, leading to a potential NULL<br /> pointer dereference in atom_get_src_int() when accessing WS entries.<br /> <br /> Return -ENOMEM on allocation failure to avoid the NULL dereference.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> udp_tunnel: use netdev_warn() instead of netdev_WARN()<br /> <br /> netdev_WARN() uses WARN/WARN_ON to print a backtrace along with<br /> file and line information. In this case, udp_tunnel_nic_register()<br /> returning an error is just a failed operation, not a kernel bug.<br /> <br /> udp_tunnel_nic_register() can fail due to a memory allocation<br /> failure (kzalloc() or udp_tunnel_nic_alloc()).<br /> This is a normal runtime error and not a kernel bug.<br /> <br /> Replace netdev_WARN() with netdev_warn() accordingly.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup<br /> <br /> Raw IP packets have no MAC header, leaving skb-&gt;mac_header uninitialized.<br /> This can trigger kernel panics on ARM64 when xfrm or other subsystems<br /> access the offset due to strict alignment checks.<br /> <br /> Initialize the MAC header to prevent such crashes.<br /> <br /> This can trigger kernel panics on ARM when running IPsec over the<br /> qmimux0 interface.<br /> <br /> Example trace:<br /> <br /> Internal error: Oops: 000000009600004f [#1] SMP<br /> CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1<br /> Hardware name: LS1028A RDB Board (DT)<br /> pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> pc : xfrm_input+0xde8/0x1318<br /> lr : xfrm_input+0x61c/0x1318<br /> sp : ffff800080003b20<br /> Call trace:<br /> xfrm_input+0xde8/0x1318<br /> xfrm6_rcv+0x38/0x44<br /> xfrm6_esp_rcv+0x48/0xa8<br /> ip6_protocol_deliver_rcu+0x94/0x4b0<br /> ip6_input_finish+0x44/0x70<br /> ip6_input+0x44/0xc0<br /> ipv6_rcv+0x6c/0x114<br /> __netif_receive_skb_one_core+0x5c/0x8c<br /> __netif_receive_skb+0x18/0x60<br /> process_backlog+0x78/0x17c<br /> __napi_poll+0x38/0x180<br /> net_rx_action+0x168/0x2f0

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Fix NULL deref in debugfs odm_combine_segments<br /> <br /> When a connector is connected but inactive (e.g., disabled by desktop<br /> environments), pipe_ctx-&gt;stream_res.tg will be destroyed. Then, reading<br /> odm_combine_segments causes kernel NULL pointer dereference.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> #PF: supervisor read access in kernel mode<br /> #PF: error_code(0x0000) - not-present page<br /> PGD 0 P4D 0<br /> Oops: Oops: 0000 [#1] SMP NOPTI<br /> CPU: 16 UID: 0 PID: 26474 Comm: cat Not tainted 6.17.0+ #2 PREEMPT(lazy) e6a17af9ee6db7c63e9d90dbe5b28ccab67520c6<br /> Hardware name: LENOVO 21Q4/LNVNB161216, BIOS PXCN25WW 03/27/2025<br /> RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu]<br /> Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 8b 07 48 8b 80 08 02 00&gt;<br /> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286<br /> RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8<br /> RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000<br /> RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0<br /> R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08<br /> R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001<br /> FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> seq_read_iter+0x125/0x490<br /> ? __alloc_frozen_pages_noprof+0x18f/0x350<br /> seq_read+0x12c/0x170<br /> full_proxy_read+0x51/0x80<br /> vfs_read+0xbc/0x390<br /> ? __handle_mm_fault+0xa46/0xef0<br /> ? do_syscall_64+0x71/0x900<br /> ksys_read+0x73/0xf0<br /> do_syscall_64+0x71/0x900<br /> ? count_memcg_events+0xc2/0x190<br /> ? handle_mm_fault+0x1d7/0x2d0<br /> ? do_user_addr_fault+0x21a/0x690<br /> ? exc_page_fault+0x7e/0x1a0<br /> entry_SYSCALL_64_after_hwframe+0x6c/0x74<br /> RIP: 0033:0x7f44d4031687<br /> Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 c3 0f 1f 80 00 00 00 00&gt;<br /> RSP: 002b:00007ffdb4b5f0b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000<br /> RAX: ffffffffffffffda RBX: 00007f44d3f9f740 RCX: 00007f44d4031687<br /> RDX: 0000000000040000 RSI: 00007f44d3f5e000 RDI: 0000000000000003<br /> RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000<br /> R10: 0000000000000000 R11: 0000000000000202 R12: 00007f44d3f5e000<br /> R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000040000<br /> <br /> Modules linked in: tls tcp_diag inet_diag xt_mark ccm snd_hrtimer snd_seq_dummy snd_seq_midi snd_seq_oss snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device x&gt;<br /> snd_hda_codec_atihdmi snd_hda_codec_realtek_lib lenovo_wmi_helpers think_lmi snd_hda_codec_generic snd_hda_codec_hdmi snd_soc_core kvm snd_compress uvcvideo sn&gt;<br /> platform_profile joydev amd_pmc mousedev mac_hid sch_fq_codel uinput i2c_dev parport_pc ppdev lp parport nvme_fabrics loop nfnetlink ip_tables x_tables dm_cryp&gt;<br /> CR2: 0000000000000000<br /> ---[ end trace 0000000000000000 ]---<br /> RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu]<br /> Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 8b 07 48 8b 80 08 02 00&gt;<br /> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286<br /> RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8<br /> RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000<br /> RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0<br /> R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08<br /> R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001<br /> FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0<br /> PKRU: 55555554<br /> <br /> Fix this by checking pipe_ctx-&gt;<br /> ---truncated---