- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] *** fix CVE-2026-31443 ***
by Lin Ruifeng 06 May '26

06 May '26

*** fix CVE-2026-31443 *** Dan Carpenter (1): dmaengine: idxd: Delete unnecessary NULL check Vinicius Costa Gomes (1): dmaengine: idxd: Fix crash when the event log is disabled drivers/dma/idxd/device.c | 3 +++ drivers/dma/idxd/init.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) -- 2.43.0

2 3

[PATCH OLK-6.6] spi: spi-dw-dma: fix print error log when wait finish transaction
by Lin Ruifeng 06 May '26

06 May '26

From: Vladimir Yakovlev <vovchkir(a)gmail.com> stable inclusion from stable-v6.19.11 commit 184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14306 CVE: CVE-2026-31560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3b46d61890632c8f8b117147b6923bff4b42ccb7 ] If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*). Signed-off-by: Vladimir Yakovlev <vovchkir(a)gmail.com> Link: https://patch.msgid.link/20260302222017.992228-2-vovchkir@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/spi/spi-dw-dma.c [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/spi/spi-dw-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/spi-dw-dma.c b/drivers/spi/spi-dw-dma.c index 0ecbb6c36e23..a3bedcdf6f71 100644 --- a/drivers/spi/spi-dw-dma.c +++ b/drivers/spi/spi-dw-dma.c @@ -271,7 +271,7 @@ static int dw_spi_dma_wait(struct dw_spi *dws, unsigned int len, u32 speed) msecs_to_jiffies(ms)); if (ms == 0) { - dev_err(&dws->host->cur_msg->spi->dev, + dev_err(&dws->host->dev, "DMA transaction timed out\n"); return -ETIMEDOUT; } -- 2.43.0

2 1

[PATCH OLK-5.10] spi: spi-dw-dma: fix print error log when wait finish transaction
by Lin Ruifeng 06 May '26

06 May '26

From: Vladimir Yakovlev <vovchkir(a)gmail.com> stable inclusion from stable-v6.19.11 commit 184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14306 CVE: CVE-2026-31560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3b46d61890632c8f8b117147b6923bff4b42ccb7 ] If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*). Signed-off-by: Vladimir Yakovlev <vovchkir(a)gmail.com> Link: https://patch.msgid.link/20260302222017.992228-2-vovchkir@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/spi/spi-dw-dma.c [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/spi/spi-dw-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/spi-dw-dma.c b/drivers/spi/spi-dw-dma.c index 32ac8f9068e8..35e36f75afbb 100644 --- a/drivers/spi/spi-dw-dma.c +++ b/drivers/spi/spi-dw-dma.c @@ -219,7 +219,7 @@ static int dw_spi_dma_wait(struct dw_spi *dws, unsigned int len, u32 speed) msecs_to_jiffies(ms)); if (ms == 0) { - dev_err(&dws->master->cur_msg->spi->dev, + dev_err(&dws->master->dev, "DMA transaction timed out\n"); return -ETIMEDOUT; } -- 2.43.0

2 1

[PATCH OLK-6.6] perf/x86: Fix potential bad container_of in intel_pmu_hw_config
by Luo Gengkun 06 May '26

06 May '26

From: Ian Rogers <irogers(a)google.com> mainline inclusion from mainline-v7.0-rc7 commit dbde07f06226438cd2cf1179745fa1bec5d8914a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14532 CVE: CVE-2026-31782 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Auto counter reload may have a group of events with software events present within it. The software event PMU isn't the x86_hybrid_pmu and a container_of operation in intel_pmu_set_acr_caused_constr (via the hybrid helper) could cause out of bound memory reads. Avoid this by guarding the call to intel_pmu_set_acr_caused_constr with an is_x86_event check. Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload") Signed-off-by: Ian Rogers <irogers(a)google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Thomas Falcon <thomas.falcon(a)intel.com> Link: https://patch.msgid.link/20260312194305.1834035-1-irogers@google.com Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index 1844d4917bbb..dcaa72ba5dfd 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -4423,8 +4423,10 @@ static int intel_pmu_hw_config(struct perf_event *event) intel_pmu_set_acr_caused_constr(leader, idx++, cause_mask); if (leader->nr_siblings) { - for_each_sibling_event(sibling, leader) - intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask); + for_each_sibling_event(sibling, leader) { + if (is_x86_event(sibling)) + intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask); + } } if (leader != event) -- 2.34.1

2 1

[PATCH OLK-6.6] drm/i915/gt: Check set_default_submission() before deferencing
by Hongtao Zhang 06 May '26

06 May '26

From: Rahul Bukte <rahul.bukte(a)sony.com> stable inclusion from stable-v6.6.130 commit df1f4a7d9cf689b4e96c95255228896505f44c31 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14286 CVE: CVE-2026-31540 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0162ab3220bac870e43e229e6e3024d1a21c3f26 ] When the i915 driver firmware binaries are not present, the set_default_submission pointer is not set. This pointer is dereferenced during suspend anyways. Add a check to make sure it is set before dereferencing. [ 23.289926] PM: suspend entry (deep) [ 23.293558] Filesystems sync: 0.000 seconds [ 23.298010] Freezing user space processes [ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds) [ 23.309766] OOM killer disabled. [ 23.313027] Freezing remaining freezable tasks [ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 23.342038] serial 00:05: disabled [ 23.345719] serial 00:02: disabled [ 23.349342] serial 00:01: disabled [ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache [ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache [ 23.361635] ata1.00: Entering standby power mode [ 23.368863] ata2.00: Entering standby power mode [ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 23.452194] #PF: supervisor instruction fetch in kernel mode [ 23.457896] #PF: error_code(0x0010) - not-present page [ 23.463065] PGD 0 P4D 0 [ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI [ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary) [ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [ 23.496511] Workqueue: async async_run_entry_fn [ 23.501087] RIP: 0010:0x0 [ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246 [ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f [ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000 [ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff [ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8 [ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68 [ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000 [ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0 [ 23.572539] PKRU: 55555554 [ 23.575281] Call Trace: [ 23.577770] <TASK> [ 23.579905] intel_engines_reset_default_submission+0x42/0x60 [ 23.585695] __intel_gt_unset_wedged+0x191/0x200 [ 23.590360] intel_gt_unset_wedged+0x20/0x40 [ 23.594675] gt_sanitize+0x15e/0x170 [ 23.598290] i915_gem_suspend_late+0x6b/0x180 [ 23.602692] i915_drm_suspend_late+0x35/0xf0 [ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10 [ 23.611843] dpm_run_callback+0x78/0x1c0 [ 23.615817] device_suspend_late+0xde/0x2e0 [ 23.620037] async_suspend_late+0x18/0x30 [ 23.624082] async_run_entry_fn+0x25/0xa0 [ 23.628129] process_one_work+0x15b/0x380 [ 23.632182] worker_thread+0x2a5/0x3c0 [ 23.635973] ? __pfx_worker_thread+0x10/0x10 [ 23.640279] kthread+0xf6/0x1f0 [ 23.643464] ? __pfx_kthread+0x10/0x10 [ 23.647263] ? __pfx_kthread+0x10/0x10 [ 23.651045] ret_from_fork+0x131/0x190 [ 23.654837] ? __pfx_kthread+0x10/0x10 [ 23.658634] ret_from_fork_asm+0x1a/0x30 [ 23.662597] </TASK> [ 23.664826] Modules linked in: [ 23.667914] CR2: 0000000000000000 [ 23.671271] ------------[ cut here ]------------ Signed-off-by: Rahul Bukte <rahul.bukte(a)sony.com> Reviewed-by: Suraj Kandpal <suraj.kandpal(a)intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal(a)intel.com> Link: https://patch.msgid.link/20260203044839.1555147-1-suraj.kandpal@intel.com (cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad) Fixes: ff44ad51ebf8 ("drm/i915: Move engine->submit_request selection to a vfunc") Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index 0729ab5955171..6ea2c14f78160 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -1973,7 +1973,8 @@ void intel_engines_reset_default_submission(struct intel_gt *gt) if (engine->sanitize) engine->sanitize(engine); - engine->set_default_submission(engine); + if (engine->set_default_submission) + engine->set_default_submission(engine); } } -- 2.43.0

2 1

[PATCH OLK-6.6 0/5] CVE
by Liu Kai 06 May '26

06 May '26

CVE Helen Koike (1): Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Hyunwoo Kim (3): Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete net/bluetooth/l2cap_core.c | 32 ++++++++++++++++++++------------ net/bluetooth/l2cap_sock.c | 3 +++ net/bluetooth/mgmt.c | 2 +- 3 files changed, 24 insertions(+), 13 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
by Pan Taixi 06 May '26

06 May '26

From: Kohei Enju <kohei(a)enjuk.jp> mainline inclusion from mainline-v7.0-rc6 commit fecacfc95f195b99c71c579a472120d0b4ed65fa category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14241 CVE: CVE-2026-31505 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the value could change in runtime, we should use num_tx_queues instead. Moreover iavf_get_ethtool_stats() uses num_active_queues while iavf_get_sset_count() and iavf_get_stat_strings() use real_num_tx_queues, which triggers out-of-bounds writes when we do "ethtool -L" and "ethtool -S" simultaneously [1]. For example when we change channels from 1 to 8, Thread 3 could be scheduled before Thread 2, and out-of-bounds writes could be triggered in Thread 3: Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S) iavf_set_channels() ... iavf_alloc_queues() -> num_active_queues = 8 iavf_schedule_finish_config() iavf_get_sset_count() real_num_tx_queues: 1 -> buffer for 1 queue iavf_get_ethtool_stats() num_active_queues: 8 -> out-of-bounds! iavf_finish_config() -> real_num_tx_queues = 8 Use immutable num_tx_queues in all related functions to avoid the issue. [1] BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270 Write of size 8 at addr ffffc900031c9080 by task ethtool/5800 CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_report+0x170/0x4f3 kasan_report+0xe1/0x180 iavf_add_one_ethtool_stat+0x200/0x270 iavf_get_ethtool_stats+0x14c/0x2e0 __dev_ethtool+0x3d0c/0x5830 dev_ethtool+0x12d/0x270 dev_ioctl+0x53c/0xe30 sock_do_ioctl+0x1a9/0x270 sock_ioctl+0x3d4/0x5e0 __x64_sys_ioctl+0x137/0x1c0 do_syscall_64+0xf3/0x690 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7da0e6e36d ... </TASK> The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88813a013de0 pfn:0x13a013 flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 Fixes: 64430f70ba6f ("iavf: Fix displaying queue statistics shown by ethtool") Signed-off-by: Kohei Enju <kohei(a)enjuk.jp> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel(a)intel.com> Reviewed-by: Paul Menzel <pmenzel(a)molgen.mpg.de> Tested-by: Rafal Romanowski <rafal.romanowski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/iavf/iavf_ethtool.c [Context conflicts due to ummerged commit 53844673d555 ("iavf: kill "legacy-rx" for good")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- .../net/ethernet/intel/iavf/iavf_ethtool.c | 31 +++++++++---------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c index 1ac97bd606e3..f2288e2aedb0 100644 --- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c @@ -334,14 +334,13 @@ static int iavf_get_sset_count(struct net_device *netdev, int sset) { /* Report the maximum number queues, even if not every queue is * currently configured. Since allocation of queues is in pairs, - * use netdev->real_num_tx_queues * 2. The real_num_tx_queues is set - * at device creation and never changes. + * use netdev->num_tx_queues * 2. The num_tx_queues is set at + * device creation and never changes. */ if (sset == ETH_SS_STATS) return IAVF_STATS_LEN + - (IAVF_QUEUE_STATS_LEN * 2 * - netdev->real_num_tx_queues); + (IAVF_QUEUE_STATS_LEN * 2 * netdev->num_tx_queues); else if (sset == ETH_SS_PRIV_FLAGS) return IAVF_PRIV_FLAGS_STR_LEN; else @@ -368,19 +367,19 @@ static void iavf_get_ethtool_stats(struct net_device *netdev, iavf_add_ethtool_stats(&data, adapter, iavf_gstrings_stats); rcu_read_lock(); - /* As num_active_queues describe both tx and rx queues, we can use - * it to iterate over rings' stats. + /* Use num_tx_queues to report stats for the maximum number of queues. + * Queues beyond num_active_queues will report zero. */ - for (i = 0; i < adapter->num_active_queues; i++) { - struct iavf_ring *ring; + for (i = 0; i < netdev->num_tx_queues; i++) { + struct iavf_ring *tx_ring = NULL, *rx_ring = NULL; - /* Tx rings stats */ - ring = &adapter->tx_rings[i]; - iavf_add_queue_stats(&data, ring); + if (i < adapter->num_active_queues) { + tx_ring = &adapter->tx_rings[i]; + rx_ring = &adapter->rx_rings[i]; + } - /* Rx rings stats */ - ring = &adapter->rx_rings[i]; - iavf_add_queue_stats(&data, ring); + iavf_add_queue_stats(&data, tx_ring); + iavf_add_queue_stats(&data, rx_ring); } rcu_read_unlock(); } @@ -417,9 +416,9 @@ static void iavf_get_stat_strings(struct net_device *netdev, u8 *data) iavf_add_stat_strings(&data, iavf_gstrings_stats); /* Queues are always allocated in pairs, so we just use - * real_num_tx_queues for both Tx and Rx queues. + * num_tx_queues for both Tx and Rx queues. */ - for (i = 0; i < netdev->real_num_tx_queues; i++) { + for (i = 0; i < netdev->num_tx_queues; i++) { iavf_add_stat_strings(&data, iavf_gstrings_queue_stats, "tx", i); iavf_add_stat_strings(&data, iavf_gstrings_queue_stats, -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] Fix CVE-2026-31431
by Lu Jialin 01 May '26

01 May '26

Douya Le (1): crypto: algif_aead - snapshot IV for async AEAD requests Eric Biggers (3): crypto: scatterwalk - Backport memcpy_sglist() crypto: algif_aead - use memcpy_sglist() instead of null skcipher crypto: authenc - use memcpy_sglist() instead of null skcipher Herbert Xu (5): crypto: algif_aead - Fix minimum RX size check for decryption crypto: algif_aead - Revert to operating out-of-place crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption crypto: authencesn - Fix src offset when decrypting in-place crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl crypto/Kconfig | 2 - crypto/af_alg.c | 51 ++------- crypto/algif_aead.c | 205 +++++++---------------------------- crypto/algif_skcipher.c | 6 +- crypto/authenc.c | 32 +----- crypto/authencesn.c | 84 ++++++-------- crypto/scatterwalk.c | 94 ++++++++++++++++ include/crypto/if_alg.h | 5 +- include/crypto/scatterwalk.h | 31 ++++++ 9 files changed, 216 insertions(+), 294 deletions(-) -- 2.34.1

2 10

[PATCH openEuler-1.0-LTS v4 00/10] CVE-2026-31431
by GONG Ruiqi 30 Apr '26

30 Apr '26

Douya Le (1): crypto: algif_aead - snapshot IV for async AEAD requests Eric Biggers (3): crypto: scatterwalk - Backport memcpy_sglist() crypto: algif_aead - use memcpy_sglist() instead of null skcipher crypto: authenc - use memcpy_sglist() instead of null skcipher Herbert Xu (5): crypto: algif_aead - Revert to operating out-of-place crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption crypto: authencesn - Fix src offset when decrypting in-place crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl crypto: algif_aead - Fix minimum RX size check for decryption Randy Dunlap (1): crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c crypto/Kconfig | 2 - crypto/af_alg.c | 138 +++++++++++------------- crypto/algif_aead.c | 203 ++++++++--------------------------- crypto/algif_skcipher.c | 6 +- crypto/authenc.c | 32 +----- crypto/authencesn.c | 84 ++++++--------- crypto/scatterwalk.c | 98 +++++++++++++++++ include/crypto/if_alg.h | 5 +- include/crypto/scatterwalk.h | 32 ++++++ 9 files changed, 270 insertions(+), 330 deletions(-) -- 2.43.0

2 11

[PATCH openEuler-1.0-LTS v3 00/10] CVE-2026-31431
by GONG Ruiqi 30 Apr '26

30 Apr '26

Douya Le (1): crypto: algif_aead - snapshot IV for async AEAD requests Eric Biggers (3): crypto: scatterwalk - Backport memcpy_sglist() crypto: algif_aead - use memcpy_sglist() instead of null skcipher crypto: authenc - use memcpy_sglist() instead of null skcipher Herbert Xu (5): crypto: algif_aead - Revert to operating out-of-place crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption crypto: authencesn - Fix src offset when decrypting in-place crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl crypto: algif_aead - Fix minimum RX size check for decryption Randy Dunlap (1): crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c crypto/Kconfig | 2 - crypto/af_alg.c | 138 +++++++++++------------- crypto/algif_aead.c | 203 ++++++++--------------------------- crypto/algif_skcipher.c | 6 +- crypto/authenc.c | 32 +----- crypto/authencesn.c | 84 ++++++--------- crypto/scatterwalk.c | 98 +++++++++++++++++ include/crypto/if_alg.h | 5 +- include/crypto/scatterwalk.h | 32 ++++++ 9 files changed, 270 insertions(+), 330 deletions(-) -- 2.43.0

2 12