- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] CVE-2026-64137
by Yifan Qiao 13 Aug '26

13 Aug '26

Ido Schimmel (1): genetlink: Use internal flags for multicast groups Michael Bommarito (1): smb: client: require net admin for CIFS SWN netlink include/net/genetlink.h | 7 ++++++- fs/smb/client/netlink.c | 6 +++++- net/core/drop_monitor.c | 2 +- net/mptcp/pm_netlink.c | 2 +- net/netlink/genetlink.c | 4 ++-- net/psample/psample.c | 2 +- 6 files changed, 16 insertions(+), 7 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10 0/2] fix CVE-2026-45893
by Gu Bowen 13 Aug '26

13 Aug '26

CVE-2026-45893 Helge Deller (2): AppArmor: Allow apparmor to handle unaligned dfa tables apparmor: Fix & Optimize table creation from possibly unaligned memory security/apparmor/include/match.h | 12 +++++++----- security/apparmor/match.c | 22 +++++++++++----------- 2 files changed, 18 insertions(+), 16 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 0/2] CVE-2026-64137
by Yifan Qiao 13 Aug '26

13 Aug '26

Ido Schimmel (1): genetlink: Use internal flags for multicast groups Michael Bommarito (1): smb: client: require net admin for CIFS SWN netlink include/net/genetlink.h | 9 ++++++--- fs/smb/client/netlink.c | 6 +++++- net/core/drop_monitor.c | 2 +- net/mptcp/pm_netlink.c | 2 +- net/netlink/genetlink.c | 4 ++-- net/psample/psample.c | 2 +- 6 files changed, 16 insertions(+), 9 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10] ksmbd: defer destroy_previous_session() until after NTLM authentication
by Lai Zewei 12 Aug '26

12 Aug '26

mainline inclusion from mainline-v7.2-rc5 commit c74801ee524f477c174a1899782b6c3b6918d407 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16939 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM. Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/linux-cifs/20260702155449.3639773-1-james_montgomer… Signed-off-by: James Montgomery <james_montgomery(a)disroot.org> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/ksmbd/smb2pdu.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index ff3bcd2f7c46..d8262429e31b 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1487,11 +1487,6 @@ static int ntlm_authenticate(struct ksmbd_work *work, return -EPERM; } - /* Check for previous session */ - prev_id = le64_to_cpu(req->PreviousSessionId); - if (prev_id && prev_id != sess->id) - destroy_previous_session(conn, user, prev_id); - if (sess->state == SMB2_SESSION_VALID) { /* * Reuse session if anonymous try to connect @@ -1526,6 +1521,10 @@ static int ntlm_authenticate(struct ksmbd_work *work, } } + prev_id = le64_to_cpu(req->PreviousSessionId); + if (prev_id && prev_id != sess->id) + destroy_previous_session(conn, sess->user, prev_id); + /* * If session state is SMB2_SESSION_VALID, We can assume * that it is reauthentication. And the user/password -- 2.52.0

2 3

[PATCH OLK-6.6] sctp: fix auth_hmacs array size in struct sctp_cookie
by Pu Lehui 12 Aug '26

12 Aug '26

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v6.6.148 commit 0b4414e43e0861d67276031cc21401d7e87de3da category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17108 CVE: CVE-2026-68376 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e0b5252a59383b77d1b8dbeda00b7184dd95f4d3 ] The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie. As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac(). Fix the array size calculation by including the full SCTP parameter header size. Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals") Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Xin Liu <dstsmallbird(a)foxmail.com> Reported-by: Zihan Xi <xizh2024(a)lzu.edu.cn> Reported-by: Ren Wei <enjou1224z(a)gmail.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/634a0de0d5de29532915e6d47c92a0cbc206e03f.178370715… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/net/sctp/structs.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h index d943bb454b17..5baf98eac3db 100644 --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -322,7 +322,8 @@ struct sctp_cookie { __u8 auth_random[sizeof(struct sctp_paramhdr) + SCTP_AUTH_RANDOM_LENGTH]; - __u8 auth_hmacs[SCTP_AUTH_NUM_HMACS * sizeof(__u16) + 2]; + __u8 auth_hmacs[sizeof(struct sctp_paramhdr) + + SCTP_AUTH_NUM_HMACS * sizeof(__u16)]; __u8 auth_chunks[sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS]; /* This is a shim for my peer's INIT packet, followed by -- 2.34.1

2 1

[PATCH OLK-5.10] drm/edid: fix OOB read in drm_parse_tiled_block()
by Hongtao Zhang 12 Aug '26

12 Aug '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.261 commit c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ] drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_edid.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index 39eb39e78d7a2..cbe7f79fd0e1e 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -5895,6 +5895,14 @@ static void drm_parse_tiled_block(struct drm_connector *connector, u8 num_v_tile, num_h_tile; struct drm_tile_group *tg; + /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */ + if (block->num_bytes < 22) { + drm_dbg_kms(connector->dev, + "[CONNECTOR:%d:%s] Unexpected tiled block size %u\n", + connector->base.id, connector->name, block->num_bytes); + return; + } + w = tile->tile_size[0] | tile->tile_size[1] << 8; h = tile->tile_size[2] | tile->tile_size[3] << 8; -- 2.43.0

2 1

[PATCH OLK-5.10] drm/edid: fix OOB read in drm_parse_tiled_block()
by Hongtao Zhang 12 Aug '26

12 Aug '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.261 commit c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 category: bugfix bugzilla: 16848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ] drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_edid.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index 39eb39e78d7a2..cbe7f79fd0e1e 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -5895,6 +5895,14 @@ static void drm_parse_tiled_block(struct drm_connector *connector, u8 num_v_tile, num_h_tile; struct drm_tile_group *tg; + /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */ + if (block->num_bytes < 22) { + drm_dbg_kms(connector->dev, + "[CONNECTOR:%d:%s] Unexpected tiled block size %u\n", + connector->base.id, connector->name, block->num_bytes); + return; + } + w = tile->tile_size[0] | tile->tile_size[1] << 8; h = tile->tile_size[2] | tile->tile_size[3] << 8; -- 2.43.0

2 1

[PATCH OLK-6.6] sctp: validate embedded INIT chunk and address list lengths in cookie
by Zhang Qilong 12 Aug '26

12 Aug '26

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v6.18.36 commit 7560afb8cddafd829e709d7ea09230e45a825557 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15910 CVE: CVE-2026-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6f4c80a2a7e6d06753b89a578b710a2499a5e62b ] sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Sashiko <sashiko-bot(a)kernel.org> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/75af23a89adf881a0895d511775e4770da367cbf.178087342… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/sctp/sm_make_chunk.c [Just context conflicts.] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/sctp/bind_addr.c | 11 ++++++++++- net/sctp/sm_make_chunk.c | 9 +++++++-- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c index 6b95d3ba8fe1..0947b276d1e0 100644 --- a/net/sctp/bind_addr.c +++ b/net/sctp/bind_addr.c @@ -273,10 +273,20 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, /* Convert the raw address to standard address format */ while (addrs_len) { param = (struct sctp_paramhdr *)raw_addr_list; rawaddr = (union sctp_addr_param *)raw_addr_list; + if (addrs_len < sizeof(*param)) { + retval = -EINVAL; + goto out_err; + } + len = ntohs(param->length); + if (addrs_len < len) { + retval = -EINVAL; + goto out_err; + } + af = sctp_get_af_specific(param_type2af(param->type)); if (unlikely(!af) || !af->from_addr_param(&addr, rawaddr, htons(port), 0)) { retval = -EINVAL; goto out_err; @@ -289,11 +299,10 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, if (retval) /* Can't finish building the list, clean up. */ goto out_err; next: - len = ntohs(param->length); addrs_len -= len; raw_addr_list += len; } return retval; diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 2f910e6b00d4..7269a8e8e54b 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -1748,13 +1748,13 @@ struct sctp_association *sctp_unpack_cookie( int headersize, bodysize, fixed_size; struct sctp_signed_cookie *cookie; struct sk_buff *skb = chunk->skb; struct sctp_cookie *bear_cookie; struct sctp_chunkhdr *ch; + unsigned int len, chlen; __u8 *digest = ep->digest; enum sctp_scope scope; - unsigned int len; ktime_t kt; /* Header size is static data prior to the actual cookie, including * any padding. */ @@ -1779,11 +1779,16 @@ struct sctp_association *sctp_unpack_cookie( /* Process the cookie. */ cookie = chunk->subh.cookie_hdr; bear_cookie = &cookie->c; ch = (struct sctp_chunkhdr *)(bear_cookie + 1); - if (ntohs(ch->length) > len - fixed_size) + chlen = ntohs(ch->length); + if (chlen < sizeof(struct sctp_init_chunk)) + goto malformed; + if (chlen > len - fixed_size) + goto malformed; + if (bear_cookie->raw_addr_list_len > len - fixed_size - chlen) goto malformed; if (!sctp_sk(ep->base.sk)->hmac) goto no_hmac; -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] *** proc: fix ptrace access locking and error paths ***
by Zhang Yuwei 12 Aug '26

12 Aug '26

*** BLURB HERE *** Jann Horn (2): proc: protect ptrace_may_access() with exec_update_lock (part 1) proc: Fix broken error paths for namespace links fs/proc/array.c | 6 ++++++ fs/proc/base.c | 41 ++++++++++++++++++++++++----------------- fs/proc/namespaces.c | 16 +++++++++++++++- 3 files changed, 45 insertions(+), 18 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6 0/2] CVE-2026-64137
by Yifan Qiao 12 Aug '26

12 Aug '26

Ido Schimmel (1): genetlink: Use internal flags for multicast groups Michael Bommarito (1): smb: client: require net admin for CIFS SWN netlink include/net/genetlink.h | 8 ++++++-- fs/smb/client/netlink.c | 6 +++++- net/core/drop_monitor.c | 2 +- net/mptcp/pm_netlink.c | 2 +- net/netlink/genetlink.c | 4 ++-- net/psample/psample.c | 2 +- 6 files changed, 16 insertions(+), 8 deletions(-) -- 2.52.0

2 3