Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler<br /> <br /> Look up the IRQ index in oct_hw-&gt;irqs instead of assuming<br /> irq - irqs[0]. This supports non-contiguous IRQ numbers and<br /> avoids incorrect ring indexing when irqs[0] is not the base.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vhost/net: complete zerocopy ubufs only once<br /> <br /> vhost-net initializes one ubuf_info per outstanding zerocopy TX<br /> descriptor and hands it to the backend socket. The networking stack may<br /> then clone a zerocopy skb before all skb references are released. For<br /> example, batman-adv fragmentation reaches skb_split(), which calls<br /> skb_zerocopy_clone() and increments the same ubuf_info refcount.<br /> <br /> vhost_zerocopy_complete() currently treats every ubuf callback as a<br /> completed vhost descriptor. It dereferences ubuf-&gt;ctx, writes the<br /> descriptor completion state, and drops the vhost_net_ubuf_ref even when<br /> the callback only releases a cloned skb reference. A backend reset can<br /> therefore wait for and free the vhost_net_ubuf_ref while another cloned<br /> skb still carries the same ubuf_info. A later completion then<br /> dereferences the freed ubufs pointer.<br /> <br /> KASAN reports the stale completion as:<br /> <br /> BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0<br /> BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0<br /> vhost_zerocopy_complete<br /> skb_copy_ubufs<br /> __dev_forward_skb2<br /> veth_xmit<br /> <br /> The freed object was allocated from vhost_net_ioctl() while setting the<br /> backend and freed through kfree_rcu()/kvfree_rcu_bulk after backend<br /> removal, while delayed skb completion still reached<br /> vhost_zerocopy_complete().<br /> <br /> Honor the generic ubuf_info refcount before touching vhost state, and run<br /> the vhost descriptor completion only for the final ubuf reference. This<br /> matches the msg_zerocopy_complete() ownership rule for cloned zerocopy<br /> skbs.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ASoC: codecs: hdac_hdmi: Validate written enum value<br /> <br /> hdac_hdmi_set_pin_port_mux() uses the written enum value to index the<br /> texts array before calling snd_soc_dapm_put_enum_double(), which validates<br /> that the value is within the enum item range.<br /> <br /> An out-of-range value can therefore make the driver read past the texts<br /> array before the helper rejects the write. Move the lookup after the helper<br /> has accepted the value.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one<br /> <br /> Free the UAR index returned by the hardware.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/mlx5: Fix undefined shift of user RQ WQE size<br /> <br /> set_rq_size() computes the RQ WQE size as "1

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/core: Fix FRMR set pinned push error path<br /> <br /> Add destruction of FRMR handles in case the push to the pool fails.<br /> This prevents resources leak in case pool page allocation fails.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/core: Fix FRMR aging push to queue error flow<br /> <br /> Aging pools with pinned handles requires moving handles from the<br /> active queue to a non-empty inactive queue that might fail on new page<br /> allocation, we are currently not handling the fault and leaking any mkey<br /> that fails the push.<br /> <br /> Fix by Introducing push_queue_to_queue_locked() that fills the<br /> destination&amp;#39;s partial tail page from the source and then splices the<br /> remaining source pages onto the destination, performing no allocation.<br /> <br /> Replace the per-handle move loop in age_pinned_pool() and the<br /> open-coded splice in pool_aging_work() with calls to the helper.<br /> As the helper cannot fail under memory pressure, removing a class of<br /> GFP_ATOMIC allocations under the pool lock and simplifying the error<br /> flow.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci: validate codec capability element length<br /> <br /> Read Local Codec Capabilities returns a sequence of capability elements.<br /> Each element starts with a one-byte length followed by that many payload<br /> bytes.<br /> <br /> hci_read_codec_capabilities() checks that the skb contains the length<br /> byte, but then validates only caps-&gt;len against the remaining skb<br /> length. A malformed controller response with one remaining byte and<br /> caps-&gt;len set to one passes that check even though the element needs two<br /> bytes. The parser then records a two-byte capability and copies one<br /> byte beyond the advertised response payload into the codec list.<br /> <br /> Validate the full element size, including the length byte, before adding<br /> it to the accumulated capability length. This preserves all well-formed<br /> capability elements and drops only truncated controller responses.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path<br /> <br /> When btmtk_isopkt_pad() fails, the previously allocated URB is not freed,<br /> leaking the urb structure. Add usb_free_urb() before returning the error.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_core: Fix UAF in hci_unregister_dev()<br /> <br /> hci_unregister_dev() does not disable cmd_timer and ncmd_timer<br /> before the hci_dev structure is freed. If a timeout fires<br /> during device teardown, the callback dereferences freed memory<br /> (including the hdev-&gt;reset function pointer), leading to a<br /> use-after-free.<br /> <br /> Add disable_delayed_work_sync() calls alongside the existing<br /> disable_work_sync() calls to ensure both timers are fully<br /> quiesced before teardown proceeds.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device<br /> <br /> hu-&gt;serdev is NULL for hci_uart attached via non-serdev paths, but<br /> qca_dmp_hdr() unconditionally dereferences hu-&gt;serdev-&gt;dev.driver-&gt;name,<br /> causing a NULL pointer dereference.<br /> <br /> Fix by guarding the dereference with a NULL check and falling back to<br /> "hci_ldisc_qca" for the non-serdev case.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: Stop leased rxq before uninstalling its memory provider<br /> <br /> netif_rxq_cleanup_unlease() tears down the memory provider that was<br /> installed on a physical RX queue through a netkit queue lease. It<br /> currently revokes the provider&amp;#39;s DMA mappings before stopping the<br /> physical queue:<br /> <br /> __netif_mp_uninstall_rxq(virt_rxq, p); /* DMA unmap */<br /> __netif_mp_close_rxq(phys_rxq-&gt;dev, rxq_idx, p); /* queue stop */<br /> <br /> This inverts the ordering used by the regular teardown paths (normal<br /> device unregister and the io_uring zcrx close path), which stop the<br /> queue before revoking the provider&amp;#39;s mappings.<br /> <br /> With the physical queue still live, its NAPI can keep consuming<br /> net_iov entries from the page_pool alloc cache after the<br /> __netif_mp_uninstall_rxq() has already cleared their dma_addr,<br /> opening a window for the device to DMA to a stale or zero address.<br /> <br /> Fix it by swapping the two calls so the queue is stopped (and its<br /> NAPI quiesced) before the provider is uninstalled. No functional<br /> regression was observed across repeated runs of the nk_qlease.py<br /> HW selftest, which exercises the lease teardown path; this was<br /> tested against fbnic QEMU emulation.