- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] CVE-2026-46044
by Cai Xinchen 30 May '26

30 May '26

ipmi:ssif: Clean up kthread on errors is original patch ipmi:ssif: NULL thread on error is new bugfix. Corey Minyard (2): ipmi:ssif: Clean up kthread on errors ipmi:ssif: NULL thread on error drivers/char/ipmi/ipmi_ssif.c | 11 +++++++++++ 1 file changed, 11 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
by Chen Jinghuang 30 May '26

30 May '26

From: Siwei Zhang <oss(a)fourdim.xyz> stable inclusion from stable-v6.6.140 commit 5105f3e6b2df619c635b5f6a49fac131a36c7952 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15079 CVE: CVE-2026-45834 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2ff1a41a912de8517b4482e946dd951b7d80edbf upstream. Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). Fixes: 89bc500e41fc ("Bluetooth: Add state tracking to struct l2cap_chan") Cc: stable(a)kernel.org Signed-off-by: Siwei Zhang <oss(a)fourdim.xyz> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 7c87741a3d9e..2fcac3e28c7a 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1617,6 +1617,9 @@ static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, { struct sock *sk = chan->data; + if (!sk) + return; + sk->sk_state = state; if (err) -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (2): usb: gadget: f_ncm: Fix net_device lifecycle with device_move usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Udipto Goswami (1): usb: gadget: ncm: Fix indentations in documentation of NCM section Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 28 ++++++- drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- 5 files changed, 154 insertions(+), 25 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10 0/2] bonding: Fix CVE-2026-43456 type confusion in bond_setup_by_slave()
by superdcc97＠163.com 30 May '26

30 May '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This patch series fixes CVE-2026-43456 in the OLK-5.10 branch. * Patch 1: bonding: fix type confusion in bond_setup_by_slave() Introduces bond_header_ops wrapper functions to prevent type confusion when non-Ethernet devices are enslaved to a bond. * Patch 2: bonding: prevent potential infinite loop in bond_header_parse() Adds dev parameter to header_ops->parse() to prevent infinite recursion when bonding devices are stacked. Also updates two wireless drivers (hostap and airo) that were missed in the original mainline patch. Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/firewire/net.c | 5 +- drivers/net/bonding/bond_main.c | 49 ++++++++++++++++++- drivers/net/wireless/cisco/airo.c | 4 +- .../wireless/intersil/hostap/hostap_main.c | 1 + include/linux/etherdevice.h | 3 +- include/linux/if_ether.h | 3 +- include/linux/netdevice.h | 6 ++- net/ethernet/eth.c | 9 ++-- net/ipv4/ip_gre.c | 3 +- net/mac802154/iface.c | 4 +- net/phonet/af_phonet.c | 5 +- 11 files changed, 75 insertions(+), 17 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 0/2] bonding: Fix CVE-2026-43456 type confusion in bond_setup_by_slave()
by superdcc97＠163.com 30 May '26

30 May '26

From: Sashiko Review <sashiko(a)example.com> This patch series fixes CVE-2026-43456 in the OLK-6.6 branch. * Patch 1: bonding: fix type confusion in bond_setup_by_slave() (Main CVE fix - prevents kernel crash when non-Ethernet device is enslaved to a bond) * Patch 2: bonding: prevent potential infinite loop in bond_header_parse() (Newbugfix - adds dev parameter to header_ops->parse to prevent infinite loop when bonding devices are stacked) Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/firewire/net.c | 5 ++-- drivers/net/bonding/bond_main.c | 49 ++++++++++++++++++++++++++++++++- include/linux/etherdevice.h | 3 +- include/linux/if_ether.h | 3 +- include/linux/netdevice.h | 6 ++-- net/ethernet/eth.c | 9 ++---- net/ipv4/ip_gre.c | 3 +- net/mac802154/iface.c | 4 ++- net/phonet/af_phonet.c | 5 +++- 9 files changed, 71 insertions(+), 16 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
by Chen Jinghuang 30 May '26

30 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.140 commit 6cb7f67bc28da787499291a562d49a084d9c90cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15492 CVE: CVE-2026-46138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5ddb8014261137cadaf83ab5617a588d80a22586 upstream. hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held. Fix this by terminating the BIG if in case not all BIS could be setup properly. Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes") Cc: stable(a)vger.kernel.org Signed-off-by: ZhiTao Ou <hkbinbinbin(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_event.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index f4b2cddc5370..b89b42966665 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -6896,9 +6896,29 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, continue; } + if (ev->num_bis <= i) { + bt_dev_err(hdev, + "Not enough BIS handles for BIG 0x%2.2x", + ev->handle); + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); + continue; + } + if (hci_conn_set_handle(conn, - __le16_to_cpu(ev->bis_handle[i++]))) + __le16_to_cpu(ev->bis_handle[i++]))) { + bt_dev_err(hdev, + "Failed to set BIS handle for BIG 0x%2.2x", + ev->handle); + /* Force error so BIG gets terminated as not all BIS + * could be connected. + */ + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); continue; + } conn->state = BT_CONNECTED; set_bit(HCI_CONN_BIG_CREATED, &conn->flags); @@ -6907,7 +6927,10 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, hci_iso_setup_path(conn); } - if (!ev->status && !i) + /* If there is an unexpected error or if no BISes have been connected + * for the BIG, terminate it. + */ + if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i)) /* If no BISes have been connected for the BIG, * terminate. This is in case all bound connections * have been closed before the BIG creation -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (1): usb: gadget: f_ncm: Fix net_device lifecycle with device_move Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 22 ++++++ drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- 5 files changed, 150 insertions(+), 23 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] thermal: core: Fix thermal zone governor cleanup issues
by Jinjie Ruan 30 May '26

30 May '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v7.1-rc1 commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15286 CVE: CVE-2026-46021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki Conflicts: drivers/thermal/thermal_core.c [context conflict.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/thermal/thermal_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 93cdceddc94c..2de1176f0952 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -987,6 +987,7 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); thermal_zone_destroy_device_groups(tz); + thermal_set_governor(tz, NULL); kfree(tz); } else if (!strncmp(dev_name(dev), "cooling_device", sizeof("cooling_device") - 1)) { @@ -1448,8 +1449,10 @@ thermal_zone_device_register(const char *type, int trips, int mask, /* sys I/F */ /* Add nodes that are always present via .groups */ result = thermal_zone_create_device_groups(tz, mask); - if (result) + if (result) { + thermal_set_governor(tz, NULL); goto remove_id; + } /* A new thermal zone needs to be updated anyway. */ atomic_set(&tz->need_update, 1); @@ -1578,8 +1581,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) cancel_delayed_work_sync(&tz->poll_queue); - thermal_set_governor(tz, NULL); - thermal_remove_hwmon_sysfs(tz); ida_simple_remove(&thermal_tz_ida, tz->id); ida_destroy(&tz->ida); -- 2.34.1

2 1

[PATCH OLK-6.6] thermal: core: Fix thermal zone governor cleanup issues
by Jinjie Ruan 30 May '26

30 May '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v7.1-rc1 commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15286 CVE: CVE-2026-46021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki Conflicts: drivers/thermal/thermal_core.c [context conflict.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/thermal/thermal_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 2476774af738..677db876a229 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -805,6 +805,7 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); thermal_zone_destroy_device_groups(tz); + thermal_set_governor(tz, NULL); mutex_destroy(&tz->lock); complete(&tz->removal); } else if (!strncmp(dev_name(dev), "cooling_device", @@ -1326,8 +1327,10 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *t /* sys I/F */ /* Add nodes that are always present via .groups */ result = thermal_zone_create_device_groups(tz, mask); - if (result) + if (result) { + thermal_set_governor(tz, NULL); goto remove_id; + } /* A new thermal zone needs to be updated anyway. */ atomic_set(&tz->need_update, 1); @@ -1478,8 +1481,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) cancel_delayed_work_sync(&tz->poll_queue); - thermal_set_governor(tz, NULL); - thermal_remove_hwmon_sysfs(tz); ida_free(&thermal_tz_ida, tz->id); ida_destroy(&tz->ida); -- 2.34.1

2 1

[PATCH] Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
by Chen Jinghuang 30 May '26

30 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.140 commit 6cb7f67bc28da787499291a562d49a084d9c90cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15492 CVE: CVE-2026-46138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5ddb8014261137cadaf83ab5617a588d80a22586 upstream. hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held. Fix this by terminating the BIG if in case not all BIS could be setup properly. Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes") Cc: stable(a)vger.kernel.org Signed-off-by: ZhiTao Ou <hkbinbinbin(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_event.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index f4b2cddc5370..b89b42966665 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -6896,9 +6896,29 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, continue; } + if (ev->num_bis <= i) { + bt_dev_err(hdev, + "Not enough BIS handles for BIG 0x%2.2x", + ev->handle); + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); + continue; + } + if (hci_conn_set_handle(conn, - __le16_to_cpu(ev->bis_handle[i++]))) + __le16_to_cpu(ev->bis_handle[i++]))) { + bt_dev_err(hdev, + "Failed to set BIS handle for BIG 0x%2.2x", + ev->handle); + /* Force error so BIG gets terminated as not all BIS + * could be connected. + */ + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); continue; + } conn->state = BT_CONNECTED; set_bit(HCI_CONN_BIG_CREATED, &conn->flags); @@ -6907,7 +6927,10 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, hci_iso_setup_path(conn); } - if (!ev->status && !i) + /* If there is an unexpected error or if no BISes have been connected + * for the BIG, terminate it. + */ + if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i)) /* If no BISes have been connected for the BIG, * terminate. This is in case all bound connections * have been closed before the BIG creation -- 2.34.1

1 0