- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-31759
by Liu Mingrui 28 May '26

28 May '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-31759 Felix Gu (1): usb: ulpi: fix memory leak on ulpi_register() error paths Sean Anderson (1): usb: ulpi: Call of_node_put correctly drivers/usb/common/ulpi.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43427
by Xinyu Zheng 28 May '26

28 May '26

Oliver Neukum (1): usb: class: cdc-wdm: fix reordering issue in read code path Robert Hodaszi (1): usb: cdc-wdm: avoid setting WDM_READ for ZLP-s drivers/usb/class/cdc-wdm.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2026-45968
by Jinjie Ruan 28 May '26

28 May '26

CVE-2026-45968 Aboorva Devarajan (1): cpuidle: Skip governor when only one idle state is available Rafael J. Wysocki (1): sched: idle: Make skipping governor callbacks more consistent kernel/sched/idle.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-45968
by Jinjie Ruan 28 May '26

28 May '26

CVE-2026-45968 Aboorva Devarajan (1): cpuidle: Skip governor when only one idle state is available Rafael J. Wysocki (1): sched: idle: Make skipping governor callbacks more consistent kernel/sched/idle.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 V2 0/5] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Al Viro (3): attach_mnt(): expand in attach_recursive_mnt(), then lose the flag argument get rid of mnt_set_mountpoint_beneath() prevent mount hash conflicts Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/mount.h | 1 + fs/namespace.c | 281 ++++++++++++++++++++++++++++--------- fs/nsfs.c | 32 +++++ include/uapi/linux/mount.h | 3 +- 5 files changed, 248 insertions(+), 71 deletions(-) -- 2.52.0

2 6

[openEuler-1.0-LTS] mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
by Jinjiang Tu 28 May '26

28 May '26

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.136 commit 115a5266749dcde7fe4127e8623d19c752088f69 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9037 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8f5857be99f1ed1fa80991c72449541f634626ee upstream. cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it. Link: https://lore.kernel.org/20260413-blkcg-v1-1-35b72622d16c@debian.org Fixes: 59b57717fff8 ("blkcg: delay blkg destruction until after writeback has finished") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Dennis Zhou <dennis(a)kernel.org> Reviewed-by: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: JP Kobryn <inwardvessel(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Martin KaFai Lau <martin.lau(a)linux.dev> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/backing-dev.c [Context conflicts due to commit d866dbf6.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/backing-dev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/backing-dev.c b/mm/backing-dev.c index a395eba85670..4c3037c27651 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -499,12 +499,13 @@ static void cgwb_release_workfn(struct work_struct *work) wb_shutdown(wb); css_put(wb->memcg_css); - css_put(wb->blkcg_css); - mutex_unlock(&wb->bdi->cgwb_release_mutex); /* triggers blkg destruction if cgwb_refcnt becomes zero */ blkcg_cgwb_put(blkcg); + css_put(wb->blkcg_css); + mutex_unlock(&wb->bdi->cgwb_release_mutex); + fprop_local_destroy_percpu(&wb->memcg_completions); wb_exit(wb); call_rcu(&wb->rcu, cgwb_free_rcu); -- 2.43.0

1 0

[PATCH openEuler-1.0-LTS] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v5.10.253 commit 2f70ba9dae13a190673cc3f9b4aad52179738f60 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 9a2ab6751a23..2a68bd9fe451 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -279,10 +279,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 1

[PATCH OLK-6.6] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
by Xinyu Zheng 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit da39ee627fd82b52068d4d5f115749a8b7d271f9 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e upstream. When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release(). Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak") Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Cc: All applicable <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260401024535.1395801-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/cpufreq/cpufreq_governor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c index 8f5474612b31..00a26fa6292c 100644 --- a/drivers/cpufreq/cpufreq_governor.c +++ b/drivers/cpufreq/cpufreq_governor.c @@ -468,13 +468,13 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) /* Failure, so roll back. */ pr_err("initialization failed (dbs_data kobject init error %d)\n", ret); - kobject_put(&dbs_data->attr_set.kobj); - policy->governor_data = NULL; if (!have_governor_per_policy()) gov->gdbs_data = NULL; - gov->exit(dbs_data); + + kobject_put(&dbs_data->attr_set.kobj); + goto free_policy_dbs_info; free_dbs_data: kfree(dbs_data); -- 2.34.1

2 1

[PATCH OLK-6.6] efi: Fix reservation of unaccepted memory table
by Jinjie Ruan 28 May '26

28 May '26

From: "Kiryl Shutsemau (Meta)" <kas(a)kernel.org> stable inclusion from stable-v6.6.128 commit b7bc182ec1846be437351e44164089d988f9d0dd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15103 CVE: CVE-2026-45851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0862438c90487e79822d5647f854977d50381505 ] The reserve_unaccepted() function incorrectly calculates the size of the memblock reservation for the unaccepted memory table. It aligns the size of the table, but fails to account for cases where the table's starting physical address (efi.unaccepted) is not page-aligned. If the table starts at an offset within a page and its end crosses into a subsequent page that the aligned size does not cover, the end of the table will not be reserved. This can lead to the table being overwritten or inaccessible, causing a kernel panic in accept_memory(). This issue was observed when starting Intel TDX VMs with specific memory sizes (e.g., > 64GB). Fix this by calculating the end address first (including the unaligned start) and then aligning it up, ensuring the entire range is covered by the reservation. Fixes: 8dbe33956d96 ("efi/unaccepted: Make sure unaccepted table is mapped") Reported-by: Moritz Sanft <ms(a)edgeless.systems> Signed-off-by: Kiryl Shutsemau (Meta) <kas(a)kernel.org> Reviewed-by: Tom Lendacky <thomas.lendacky(a)amd.com> Acked-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/firmware/efi/efi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 30f6c4397b40..7e1f96c06d18 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -649,13 +649,13 @@ static __init int match_config_table(const efi_guid_t *guid, static __init void reserve_unaccepted(struct efi_unaccepted_memory *unaccepted) { - phys_addr_t start, size; + phys_addr_t start, end; start = PAGE_ALIGN_DOWN(efi.unaccepted); - size = PAGE_ALIGN(sizeof(*unaccepted) + unaccepted->size); + end = PAGE_ALIGN(efi.unaccepted + sizeof(*unaccepted) + unaccepted->size); - memblock_add(start, size); - memblock_reserve(start, size); + memblock_add(start, end - start); + memblock_reserve(start, end - start); } int __init efi_config_parse_tables(const efi_config_table_t *config_tables, -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Support open_tree OPEN_TREE_NAMESPACE Al Viro (3): attach_mnt(): expand in attach_recursive_mnt(), then lose the flag argument get rid of mnt_set_mountpoint_beneath() prevent mount hash conflicts Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/mount.h | 1 + fs/namespace.c | 281 ++++++++++++++++++++++++++++--------- fs/nsfs.c | 32 +++++ include/uapi/linux/mount.h | 3 +- 5 files changed, 248 insertions(+), 71 deletions(-) -- 2.52.0

2 6