{ "version": "https://jsonfeed.org/version/1.1", "title": "Linux: all CVE events", "home_page_url": "https://patchwire.jonathanross.dev/products/linux--linux/", "feed_url": "https://patchwire.jonathanross.dev/feeds/products/linux--linux/all.json", "authors": [ { "name": "Patchwire" } ], "language": "en", "items": [ { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99087/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99087/", "title": "CVE-2026-99087 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix NULL pointer dereference when the 'R' flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the 'R' mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the 'R' mode.", "date_published": "2026-10-23T12:45:05Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99087/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99087/", "title": "CVE-2026-99087 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.12-1.", "date_published": "2026-10-23T12:45:05Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99086/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99086/", "title": "CVE-2026-99086 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: validate the superblock on resume\n\ndm_integrity_resume() re-reads the superblock from the device so that it\npicks up the flags and the recalculate position. It performs no\nvalidation on the result, while the constructor validates the superblock\nit reads and sizes all the in-memory structures according to it. The user\nmay modify the superblock on the underlying device while the dm-integrity\ndevice is suspended, so that the two no longer agree.\n\nIn particular, access_journal_data() shifts the journal entry index by\nic-\u003esb-\u003elog2_sectors_per_block, while ic-\u003ejournal_section_sectors and the\njournal page list were computed with the value that was present at\nconstructor time. Increasing log2_sectors_per_block makes the index run\npast the end of the journal, and dm-integrity then writes 512 bytes\nthrough lowmem_page_address(NULL).\n\nSnapshot the validated superblock in the constructor and refuse to resume\nif any of the fields that describe the on-disk geometry changed.", "date_published": "2026-10-23T12:45:04Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99086/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99086/", "title": "CVE-2026-99086 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.12-1.", "date_published": "2026-10-23T12:45:04Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99085/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99085/", "title": "CVE-2026-99085 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler\n\nA CPU going down has to empty its own rq. Its hotplug thread waits in\nsched_cpu_wait_empty() until nothing else is left, and the only thing that\nwakes it is balance_push(), which runs from __schedule() on the dying CPU\nand pushes off the migratable tasks the CPU picks.\n\nsched_ext breaks this. A task sitting on a user DSQ or held by the BPF\nscheduler is still counted on its rq, but an inactive CPU no longer calls\nops.dispatch() and can't pull the task back. The dying CPU goes idle with\nthe task still counted, and one of two things happens:\n\n- Another CPU consumes the task. The rq empties without a __schedule() on\n the dying CPU, so the hotplug thread is never woken and cpu_down() hangs\n holding cpu_hotplug_lock.\n- The task is affine only to the dying CPU. Nothing can move it, and the\n offline stalls until the watchdog ejects the BPF scheduler.\n\nWhen the rq goes offline, re-enqueue every task on it that isn't already on\nthe local DSQ. An enqueue on an offline rq lands on the local DSQ, so the\ndying CPU itself picks the tasks and balance_push() pushes them off, the\nsame as for the other sched classes. From then on no sched_ext path on\nanother CPU can pull a task off the rq.\n\nops.dispatch() currently stops as soon as the CPU goes inactive, and CPU\nhotplug then waits for an RCU grace period before taking the rq offline. A\nBPF-held task affine only to the dying CPU and preempted inside an RCU\nread-side critical section would block that grace period, and the rq would\nnever go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keeps\nrunning until the rq goes offline. Only the dying CPU's own hotplug thread\nclears the flag during teardown, and task_can_run_on_remote_rq() still keeps\nother rqs' tasks off the CPU.", "date_published": "2026-10-23T12:45:03Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99085/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99085/", "title": "CVE-2026-99085 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.12-1.", "date_published": "2026-10-23T12:45:03Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99084/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99084/", "title": "CVE-2026-99084 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nreaddir: take no inode lock on an immutable directory\n\niterate_dir() takes the directory's i_rwsem shared and holds it across\n-\u003eiterate_shared(). For a directory that never has an entry and is\nnever removed the lock keeps nothing still, it only orders every reader\nand every writer of that inode behind each other.\n\nFor the directory of a nullfs instance that matters. The instance of\nthe initial mount namespace is the root of every empty mount namespace\nand the private instance is the root of every kernel thread, so one\ninode is shared across users who have nothing else in common. And a\nreader can hold the lock for as long as it likes: back the getdents()\nbuffer with a mapping of a file on a FUSE mount of your own, let the\ncopy of \".\" and \"..\" fault and let the server wait. Queue an exclusive\ntaker behind it, a mkdir() in that directory goes through start_dirop()\nbefore the read-only mount is reported, and from then on every lookup\nthat misses the dcache in that directory, every create and every mount\non it waits until the server answers. One user of an empty mount\nnamespace stalls all the others.\n\nAdd FOP_IMMUTABLE for the file operations of a directory that never\nchanges and is never removed and let iterate_dir() skip the lock for\nit. The flag never changes for a file, -\u003ef_pos is protected by\nf_pos_lock since directories are FMODE_ATOMIC_POS, IS_DEADDIR can't be\nset on such a directory and neither touch_atime() nor fsnotify take\ni_rwsem. Set it on the nullfs directory. The placeholder directories of\nlibfs never have an entry either but their owners remove them, so they\nkeep the lock.", "date_published": "2026-10-23T12:45:02Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99084/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99084/", "title": "CVE-2026-99084 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.12-1.", "date_published": "2026-10-23T12:45:02Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99083/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99083/", "title": "CVE-2026-99083 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work-\u003enext_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len \u003c= resp-\u003espnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work-\u003enext_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space.", "date_published": "2026-10-23T12:45:01Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99083/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99083/", "title": "CVE-2026-99083 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.12-1.", "date_published": "2026-10-23T12:45:01Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99082/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99082/", "title": "CVE-2026-99082 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information. Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid. When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, support SMRAM address space\") added the SMM address space,\nthese helpers were not converted to use the active memslots.\n\nConsequently, an update to the SMM memslots can leave an entry from the old\nSMM address space apparently valid after the vCPU returns to the normal\naddress space. A guest can then cause an access to valid RAM at the same\nGFN to be returned to userspace as KVM_EXIT_MMIO.\n\nCompleting that exit through the VMM's RAM address space writes the backing\npage without going through KVM's write-tracking path. If the page backs a\nnested EPT table, KVM can continue using shadow translations derived from\nthe old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()\ncatches this invalid cache and memslot combination.\n\nUse the vCPU's active memslots when caching and validating the entry.\nMemslot generations are unique across address spaces, so the generation\nalso distinguishes the normal and SMM views. This matches the MMIO SPTE\ncache, which already uses kvm_vcpu_memslots().\n\nOn an unpatched current-mainline kernel, a regression test that fills the\ncache in SMM and updates only the SMM memslots fails the intended RAM write\nand triggers the kvm_mmu_write_protect_fault() warning. With this change,\nthe same test completes the RAM write without a warning. The x86/smm_test,\nset_memory_region_test, and memslot_modification_stress_test selftests also\npass.", "date_published": "2026-10-23T12:45:00Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99082/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99082/", "title": "CVE-2026-99082 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.12-1.", "date_published": "2026-10-23T12:45:00Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99081/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99081/", "title": "CVE-2026-99081 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n [fault reason 0x06] PTE Read access is not set\n bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n ...\n NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n if (length \u003c BNXT_MIN_PKT_SIZE) {\n pad = BNXT_MIN_PKT_SIZE - length;\n if (skb_pad(skb, pad))\n goto tx_kick_pending;\n length = BNXT_MIN_PKT_SIZE;\n }\n\n mapping = dma_map_single(\u0026pdev-\u003edev, skb-\u003edata, len, DMA_TO_DEVICE);\n ...\n dma_unmap_len_set(tx_buf, len, len);\n\nHowever, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n txbd-\u003etx_bd_len_flags_type =\n cpu_to_le32(((len + pad) \u003c\u003c TX_BD_LEN_SHIFT) | flags |\n TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb-\u003edata ends near the boundary of a 4KB\npage (within 'pad' bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb-\u003edata\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmit(), before skb_shinfo(skb)-\u003enr_frags is sampled,\nbecause padding might linearize the skb.\nThis ensures skb-\u003elen and skb_headlen(skb) reflect the padded size so\nthat dma_map_single() maps the full buffer and the descriptor length is\nconsistent. This also removes the temporary 'pad' variable and masking logic.\n\nThe padding is done after the SW USO branch, otherwise\nbnxt_sw_udp_gso_xmit() would account the padding as UDP payload\nand send it in extra segments.\n\nNote that SW USO segments are still not padded: with IPv4, a segment\ncarrying less than 10 bytes of UDP payload (small gso_size, or a short\nlast segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.\nThis is a separate issue, left for a followup patch.", "date_published": "2026-10-23T12:23:28Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99081/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99081/", "title": "CVE-2026-99081 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:28Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99081/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99081/", "title": "CVE-2026-99081 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:28Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99080/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99080/", "title": "CVE-2026-99080 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we've had a hard to hit leak of xarray nodes. Hugh\ndocumented it well in commit 786b31121a2c. Recently people and\nsyzbot have found ways to force it to happen with madvise. Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock.", "date_published": "2026-10-23T12:23:27Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99080/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99080/", "title": "CVE-2026-99080 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:27Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99080/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99080/", "title": "CVE-2026-99080 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:27Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99079/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99079/", "title": "CVE-2026-99079 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\n\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors.", "date_published": "2026-10-23T12:23:26Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99079/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99079/", "title": "CVE-2026-99079 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:26Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99079/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99079/", "title": "CVE-2026-99079 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:26Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99078/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99078/", "title": "CVE-2026-99078 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings.", "date_published": "2026-10-23T12:23:25Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99078/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99078/", "title": "CVE-2026-99078 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:25Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99078/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99078/", "title": "CVE-2026-99078 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:25Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99077/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99077/", "title": "CVE-2026-99077 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless predictible\") tried to mitigate such attacks by making it harder\nfor attackers to discover hash collisions in the FNHE cache and by\nrandomizing the number of exceptions a hash bucket can hold,\nrespectively. Unfortunately, both of the mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating a FNHE, even before\ntrying to find a matching socket. Do that by calling ipv4_update_pmtu()\nand ipv4_redirect(), the helpers used when the quoted packet did not\noriginate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in a FNHE being created or updated in the cache that the\nattacker can observe.\n\nPass an oif of 0, in a similar fashion to icmp_err(). This is also the\noif used by the socket path for sockets that are not bound to a device.\n\nNote that this does not allow attackers to create FNHEs that they could\nnot create before, as both helpers can already be reached with little to\nno validation. For example, by sending an ICMP error that quotes an ICMP\nEcho Reply or one that quotes a UDP source port that matches a wildcard\nsocket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ipv4_sk_update_pmtu() /\nipv4_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the FNHE cache of the nexthop resolved by the no socket helpers and\nanother in the FNHE cache of the nexthop used by the socket.", "date_published": "2026-10-23T12:23:22Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99077/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99077/", "title": "CVE-2026-99077 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:22Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99076/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99076/", "title": "CVE-2026-99076 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: udp: Create exceptions before socket matching\n\nCurrently, when ICMPv6 Packet Too Big and Redirect Message packets are\nlocally delivered and quote a UDP packet, an exception is only created\nin the IPv6 exception cache if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the exception cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 4785305c05b2 (\"ipv6: use siphash in rt6_exception_hash()\") and\ncommit a00df2caffed (\"ipv6: make exception cache less predictible\") tried\nto mitigate such attacks by making it harder for attackers to discover\nhash collisions in the exception cache and by randomizing the number of\nexceptions a hash bucket can hold, respectively. Unfortunately, both of\nthe mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating an exception, even\nbefore trying to find a matching socket. Do that by calling\nip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted\npacket did not originate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in an exception being created or updated in the cache that\nthe attacker can observe.\n\nPass the ifindex of the ingress device and the default uid, in a similar\nfashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any\nnexthop in ip6_redirect_nh_match() and no exception would be created in\nresponse to a Redirect Message.\n\nNote that this does not allow attackers to create exceptions that they\ncould not create before, as both helpers can already be reached with\nlittle to no validation. For example, by sending an ICMPv6 error that\nquotes an ICMPv6 Echo Reply or one that quotes a UDP source port that\nmatches a wildcard socket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ip6_sk_update_pmtu() /\nip6_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the exception cache of the nexthop resolved by the no socket helpers\nand another in the exception cache of the nexthop used by the socket.", "date_published": "2026-10-23T12:23:19Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99076/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99076/", "title": "CVE-2026-99076 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:19Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99075/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99075/", "title": "CVE-2026-99075 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: reschedule node refcount update on thread exit\n\nWhen a thread exits via BINDER_THREAD_EXIT, its pending work items are\ncancelled. If a thread exits while holding a pending node refcount\nincrement (e.g. pushed as deferred work to that thread), the refcount\nincrement was previously dropped because Node::cancel() and\nNodeWrapper::cancel() were no-ops.\n\nDropping the refcount update leaves the node's delivery state and count\nstate desynchronized, and userspace will not receive the notification,\nwhich can cause the node to never be freed from the process's nodes tree\nwhen all external references are dropped.\n\nFix this by implementing DeliverToRead::cancel() for Node and NodeWrapper\nto move the pending refcount update to the process's work queue on thread\nexit so another thread can deliver it to userspace.", "date_published": "2026-10-23T12:23:18Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99075/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99075/", "title": "CVE-2026-99075 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:18Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99074/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99074/", "title": "CVE-2026-99074 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop PMTU walk when nexthop group shrinks\n\nCommit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if\nmultipath enabled\") made __ip_rt_update_pmtu() update every path.\n\nFor nexthop objects, fib_info_num_path() and fib_info_nhc()\nindependently load nh-\u003enh_grp. RCU protects each group's lifetime but\ndoes not make the loads observe the same group. If replacement shrinks\nthe group after the loop accepts an index, fib_info_nhc() returns NULL\nand update_or_create_fnhe() dereferences it.\n\nA deterministic probe only widened the existing window between the real\noperations. On v7.2, an RTM_NEWNEXTHOP replacement published a\none-member group after the PMTU reader accepted index 1 from a two-member\ngroup, producing:\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: update_or_create_fnhe+0x45/0x15b0\n\nStop when the indexed path is absent. Groups are dense, so no later\nindex exists in that snapshot. The same real-writer window completed\n114,423 PMTU iterations without an oops with this check. A reproducer\nis available on request.\n\nReplacement requires CAP_NET_ADMIN in the network namespace. Where\nunprivileged user namespaces are permitted, a local user can obtain it\nin a new user and network namespace.", "date_published": "2026-10-23T12:23:17Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99074/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99074/", "title": "CVE-2026-99074 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:17Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99074/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99074/", "title": "CVE-2026-99074 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:17Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99073/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99073/", "title": "CVE-2026-99073 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop exception dump when nexthop group shrinks\n\nCommit 4ce5dc9316de (\"inet: switch inet_dump_fib() to RCU\nprotection\") allowed IPv4 FIB dumps to run concurrently with nexthop\nreplacement.\n\nfib_dump_info_fnhe() uses fib_info_num_path() as the loop bound,\nthen fib_info_nhc() independently reloads nh-\u003enh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and the dump dereferences it through\nnhc_flags.\n\nStop the walk when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path.", "date_published": "2026-10-23T12:23:16Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99073/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99073/", "title": "CVE-2026-99073 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:16Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99073/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99073/", "title": "CVE-2026-99073 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:16Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99072/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99072/", "title": "CVE-2026-99072 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop route notification sizing when nexthop group shrinks\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib\nhardware flags are changed\") added an RCU-only fib_nlmsg_size() call\nfor asynchronous hardware flag notifications.\n\nfib_nlmsg_size() checks fib_info_num_path() before each iteration,\nthen fib_info_nhc() independently reloads nh-\u003enh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences\nit.\n\nStop sizing when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path.", "date_published": "2026-10-23T12:23:15Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99072/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99072/", "title": "CVE-2026-99072 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:15Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99072/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99072/", "title": "CVE-2026-99072 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:15Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99071/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99071/", "title": "CVE-2026-99071 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU. With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots. fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners.", "date_published": "2026-10-23T12:23:14Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99071/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99071/", "title": "CVE-2026-99071 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:14Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99071/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99071/", "title": "CVE-2026-99071 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:14Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99070/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99070/", "title": "CVE-2026-99070 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node(). With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners.", "date_published": "2026-10-23T12:23:13Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99070/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99070/", "title": "CVE-2026-99070 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:13Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99070/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99070/", "title": "CVE-2026-99070 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:13Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99069/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99069/", "title": "CVE-2026-99069 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer belonging to a struct usb_interface, producing an invalid\nusb_device pointer.\n\nUse to_usb_interface() directly in the attribute handlers to obtain the\ninterface and its driver data.", "date_published": "2026-10-23T12:23:12Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99069/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99069/", "title": "CVE-2026-99069 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:12Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99069/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99069/", "title": "CVE-2026-99069 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:12Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99068/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99068/", "title": "CVE-2026-99068 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n\nCommit e576e7843c0d (\"ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions\")\ncentralized the DAO input mapper clearing logic in\ndao_clear_input(), but omitted the kfree() calls.\n\nIt removes the mapper entries from the list and sets their pointers\nto NULL without freeing the allocated array. This leaks memory each\ntime dao_clear_input() is called.\n\nStore the base pointer of the allocation before clearing the mapper\nentries and free the array after removing entries from the list.", "date_published": "2026-10-23T12:23:11Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99068/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99068/", "title": "CVE-2026-99068 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:11Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99067/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99067/", "title": "CVE-2026-99067 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings. Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too.", "date_published": "2026-10-23T12:23:10Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99067/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99067/", "title": "CVE-2026-99067 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:10Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99067/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99067/", "title": "CVE-2026-99067 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:10Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99066/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99066/", "title": "CVE-2026-99066 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: init_can_skb(): restore skb header initialization\n\nCommit 9f10374bb024 (\"can: remove private CAN skb headroom infrastructure\")\nremoved the skb_reset_mac_header()/skb_reset_network_header()/\nskb_reset_transport_header() calls from init_can_skb(). As a result, RX\nskbs from alloc_can_skb() and friends again carry mac_header = 0xFFFF.\nWhen such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length\ncalculation overflows and triggers skb_under_panic -\u003e kernel BUG -\u003e full\nmachine panic.\n\nThe same issue was originally reported in 2014 on linux-can and fixed by\ncommit 969439016d2c (\"can: add missing initialisations in CAN related\nskbuffs\"). packet_rcv_spkt() itself has never been hardened: only\npacket_rcv() and tpacket_rcv() gained dev_has_header() checks in\ncommit d549699048b4 (\"net/packet: fix packet receive on L3 devices\nwithout visible hard header\").", "date_published": "2026-10-23T12:23:09Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99066/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99066/", "title": "CVE-2026-99066 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:09Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99065/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99065/", "title": "CVE-2026-99065 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()\n\nWith commit 2125c0034c5d (\"cgroup/cpuset: Make cpuset hotplug processing\nsynchronous\"), the cpuset hotplug operation becomes synchronous. That\ncommit also removes the code that handles race between cpuset_hotplug_work\nand cpu hotplug notifier with the assumption that race is now gone.\nLater commit 7a0aabd9ce69 (\"cgroup/cpuset: Always use cpu_active_mask\")\nupdates the cpuset code to always use cpu_active_mask instead of\ncpu_online_mask in some places including guarantee_online_cpus() which\nis renamed to guarantee_active_cpus() in that commit.\n\nIn the case of CPU offline operation, cpu_active_mask is updated\nfirst in sched_cpu_deactivate() to remove the offline CPU before\ncpuset_handle_hotplug() is called to update the effective_cpus of the\naffected cpusets. The cpu_online_mask is updated after that near the end\nof the offline operation to remove the offline CPU. As a result, the race\ncomes back and the top cpuset may not have any active CPU leading to NULL\npointer dereference during the race window when guarantee_active_cpus()\nis called after cpu_active_mask is updated to remove the CPU to be torn\ndown but before cpuset_handle_hotplug() is able to properly update the\neffective_cpus of the top cpuset.\n\nFix this by adding back the NULL cs check to avoid this problem.", "date_published": "2026-10-23T12:23:08Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99065/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99065/", "title": "CVE-2026-99065 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:08Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99064/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99064/", "title": "CVE-2026-99064 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncipso: adjust cached option offsets when removing CIPSO\n\ncipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust\ncached offsets for options that follow them.\n\nFor example, with a valid 10-byte CIPSO option followed by a seven-byte\nRR option, parsing records rr at offset 30. Removing CIPSO moves RR to\noffset 20, while the cached offset remains 30. Consumers such as\nip_forward_options() and __ip_options_echo() then access the wrong bytes;\nthe latter may interpret packet data as the option length and copy it into\nfixed-size option storage.\n\nMirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and\nrouter_alert offsets when they follow CIPSO. cipso_len is the distance\nthe first memmove() shifts those options. The later header move and\nnetwork-header reset relocate the bytes and their offset base together.", "date_published": "2026-10-23T12:23:05Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99064/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99064/", "title": "CVE-2026-99064 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:05Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99064/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99064/", "title": "CVE-2026-99064 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:05Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99063/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99063/", "title": "CVE-2026-99063 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: don't let data_start run past the buffer\n\nstruct dm_ioctl has seven bytes of trailing padding, so the smallest\nbuffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),\nis seven bytes shorter than sizeof(struct dm_ioctl).\n\nget_result_buffer() sets data_start to sizeof(struct dm_ioctl) without\nlooking at how big the buffer actually is. Ask for the minimum and\ndata_start ends up seven bytes past the end. Callers add it to\ndata_size, and ctl_ioctl() copies that much back to userspace:\n\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0\n Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140\n ctl_ioctl+0x5e3/0xcb0\n dm_ctl_ioctl+0x25/0x40\n allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)\n\nA DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the\nseven bytes that leak are whatever sat next to the allocation.\n\nClamp data_start to the buffer size.\n\nNote that this is not a security bug because the out-of-bounds read can\nonly be triggered by root.", "date_published": "2026-10-23T12:23:04Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99063/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99063/", "title": "CVE-2026-99063 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:04Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99063/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99063/", "title": "CVE-2026-99063 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:04Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99062/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99062/", "title": "CVE-2026-99062 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: account only unread bytes in read_skb()\n\nAfter a partial stream receive, rx_bytes tracks the unread suffix while\nbuf_used and peer credit still cover the whole packet.\nvirtio_transport_read_skb() dequeues that packet but passes pkt_len for\nboth counters, underflowing rx_bytes.\n\nOn a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte read\nfrom a 100-byte packet made SIOCINQ report -40, an empty recv return\nELOOP, and poll report the empty socket readable. After verdict detach,\nreceiving 40 bytes wrapped the counter to zero and hid those queued bytes\nuntil one more byte arrived. The fixed run kept the counter balanced\nand exposed all queued data immediately.\n\nThis was found during an LLM-assisted manual source audit of VSOCK\nreceive accounting while re-evaluating virtio_transport_read_skb() after\nCVE-2024-50169.\n\nSubtract only skb-\u003elen minus the VSOCK offset from rx_bytes. Retain the\nfull packet length for buf_used and peer credit.", "date_published": "2026-10-23T12:23:03Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99062/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99062/", "title": "CVE-2026-99062 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:23:03Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99062/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99062/", "title": "CVE-2026-99062 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:23:03Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99061/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99061/", "title": "CVE-2026-99061 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n which unregisters the wdev and frees the vif and the ifp.\n\n - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,\n and calls brcmf_remove_interface(ifp, false) for the same ifp.\n brcmf_p2p_ifp_removed() reads ifp-\u003evif and then blocks on\n rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls\n cfg80211_unregister_wdev() on the wdev that was already unregistered\n and freed.\n\nThe second list_del_rcu() of wdev-\u003elist faults on LIST_POISON2:\n\n brcmfmac: brcmf_p2p_del_vif delete P2P vif\n brcmfmac: brcmf_p2p_deinit_discovery enter\n brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared\n brcmfmac: brcmf_detach Enter\n brcmfmac: brcmf_bus_change_state 1 -\u003e 0\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n [1.5 s later, brcmf_p2p_del_vif() timed out]\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n Unable to handle kernel paging request at virtual address dead000000000122\n Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP\n pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n Call trace:\n _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n cfg80211_unregister_wdev+0x10/0x1c [cfg80211]\n brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]\n brcmf_remove_interface+0x1f4/0x254 [brcmfmac]\n brcmf_detach+0x88/0x180 [brcmfmac]\n brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]\n brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]\n brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]\n sdio_bus_remove+0x38/0x144\n device_release_driver_internal+0x1e8/0x2c0\n device_release_driver+0x14/0x20\n brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]\n brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]\n __exit_compat+0x18/0x418 [brcmfmac_cyw]\n __arm64_sys_delete_module+0x1ac/0x244\n\nThe log was taken with debug=0x406 on an i.MX 8M Plus board with a\nCYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of\nbrcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same\nin mainline.\n\nTo reproduce:\n\n 1. Start wpa_supplicant on wlan0 and let it associate. It creates the\n P2P device (iw dev shows \"type P2P-device\").\n 2. Stop wpa_supplicant and remove the driver without waiting for\n wpa_supplicant to exit:\n\n kill $(pidof wpa_supplicant)\n rmmod brcmfmac_cyw brcmfmac\n\nThe crash is reproducible on that board.\n\nFor the interface without a netdev (the P2P device), take RTNL and the\nwiphy mutex in brcmf_detach() before reading iflist, and remove it with\nlocked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the\nslot empty. If brcmf_detach() runs first, nl80211 does not find the wdev\nany more. The interfaces with a netdev are removed as before, because\nbrcmf_del_if() takes RTNL on its own for the primary interface.", "date_published": "2026-10-23T12:22:59Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99061/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99061/", "title": "CVE-2026-99061 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:59Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99061/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99061/", "title": "CVE-2026-99061 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:59Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99060/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99060/", "title": "CVE-2026-99060 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7603: initialize global station WCID\n\nmt7603 uses a driver-private global station WCID for frames that have\nneither a station nor a vif, including frames injected through a monitor\ninterface. Unlike the core global WCID initialized by\nmt76_register_device(), this WCID is published without ever being passed\nto mt76_wcid_init().\n\nSince commit 0335c034e726 (\"wifi: mt76: fix race condition related to\nchecking tx queue fill status\"), mt76_tx() queues every such frame on the\nWCID's tx_pending or tx_offchannel queue and links its tx_list. The first\ninjected frame therefore reaches __skb_queue_tail() with an uninitialized\nsk_buff_head and dereferences a NULL prev pointer.\n\nInitialize the WCID before publishing it.\n\nThe fix was tested on an MT7603 PCIe device. Three wildcard probe requests\nwere injected through a monitor interface. The hardware queue head and tail\nadvanced from 0 to 3 and a second radio captured the third request over the\nair. No oops or reset occurred. After restoring AP mode, a 150 MB transfer\nalso completed without a reset.", "date_published": "2026-10-23T12:22:49Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99060/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99060/", "title": "CVE-2026-99060 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:49Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99060/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99060/", "title": "CVE-2026-99060 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:49Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99059/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99059/", "title": "CVE-2026-99059 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: noise: reject response consumption after intermediate initiation\n\nTwo threads begin processing the identical response message, received\ntwice. The first thread, A, runs. While it's running, the second one,\nB, gets partway through, and during that slow calculation, or even while\nblocking on down_write(), A completes and then also a handshake\ninitiation that's already been queued up runs in thread C, which itself\ntakes that same down_write(). The handshake initiation creation\nsucceeds, and sets the state back to waiting-for-response, and calls\nup_write(), at which point thread B resumes, because either its finished\nits calculations or was finally allowed to acquire down_write(). Thread\nB then copies the state back to the peer, and begins a new session,\nusing that state, which is the same session as the one made in thread A.\n\nThread A\t\t\tThread B\t\t\tThread C\n\ndown_read()\n sA = handshake-\u003estate\n memcpy(cA, handshake-\u003ecrypto)\nup_read()\nif (sA != 1)\n goto fail\nslow_crypto(cA)\n\t\t\t\tdown_read()\n\t\t\t\t sB = handshake-\u003estate\n\t\t\t\t memcpy(cB, handshake-\u003ecrypto)\n\t\t\t\tup_read()\n\t\t\t\tif (sB != 1)\n\t\t\t\t goto fail\n\t\t\t\tslow_crypto(cB)\ndown_write()\n if (sA != handshake-\u003estate)\n goto fail\n memcpy(handshake-\u003ecrypto, cA)\n handshake-\u003estate = 2\nup_write()\ndown_write()\n if (handshake-\u003estate != 2)\n goto fail\n derive_session(handshake-\u003ecrypto)\nup_write()\n\t\t\t\t\t\t\t\tdown_write()\n\t\t\t\t\t\t\t\t slow_crypto(handshake-\u003ecrypto)\n\t\t\t\t\t\t\t\t handshake-\u003estate = 1\n\t\t\t\t\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (sB != handshake-\u003estate)\n\t\t\t\t goto fail\n\t\t\t\t memcpy(handshake-\u003ecrypto, cB)\n\t\t\t\t handshake-\u003estate = 2\n\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (handshake-\u003estate != 2)\n\t\t\t\t goto fail\n\t\t\t\t derive_session(handshake-\u003ecrypto)\n\t\t\t\tup_write()\n\nThis seems basically impossible to hit in a meaningful way in practice,\nbut ensure that it absolutely cannot happen by comparing the ephemeral\nprivate key that's on the stack with the latest one that the peer's\nhandshake state has.", "date_published": "2026-10-23T12:22:47Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99059/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99059/", "title": "CVE-2026-99059 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:47Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99059/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99059/", "title": "CVE-2026-99059 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:47Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99058/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99058/", "title": "CVE-2026-99058 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL current_pwq deref in chained work check\n\ncurrent_wq_worker() only tells us that %current is a kworker. It does\nnot guarantee that the worker is currently executing a work item, as\nworker-\u003ecurrent_pwq is populated only while process_one_work() is running\nthe work function.\n\nis_chained_work() can be reached while queueing on a draining or\ndestroying workqueue. If a kworker outside work-item execution reaches\nthat path, current_wq_worker() returns a worker but worker-\u003ecurrent_pwq is\nNULL, and the chained-work test can fault before it emits the intended\nwarning.\n\nGuard the chained-work test with worker-\u003ecurrent_pwq. A kworker without\ncurrent_pwq is not executing work on the target workqueue, so the helper\nshould return false and let the draining/destroying warning fire.", "date_published": "2026-10-23T12:22:45Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99058/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99058/", "title": "CVE-2026-99058 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:45Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99058/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99058/", "title": "CVE-2026-99058 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:45Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99057/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99057/", "title": "CVE-2026-99057 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: don't leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb's frags,\nxennet_fill_frags() returns an error and xennet_poll() jumps to its\nerror path. That path moves what's left on tmpq to errq to be freed,\nbut the skb being filled was already dequeued from tmpq, so it's never\nfreed. Each chain that overflows leaks the skb and the pages attached\nto it as frags, and the backend decides how many slots it sends.\n\nPut the skb back on tmpq before taking the error path, like the\nxennet_set_skb_gso() failure just above it does.", "date_published": "2026-10-23T12:22:44Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99057/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99057/", "title": "CVE-2026-99057 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:44Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99057/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99057/", "title": "CVE-2026-99057 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:44Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99056/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99056/", "title": "CVE-2026-99056 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nstrparser: make sure __strp_recv isn't running before tearing down the parser\n\nThe comment above strp_done() claims that if strp is stopped,\nstrp_recv will no longer be called. That's only true if the caller has\na mechanism (eg locking) to guarantee that strp_recv() calls that\nstarted before strp_stop() have completed by the time we call\nstrp_done().\n\nThis adds a dummy lock_sock/release_sock pair to guarantee that any\nin-flight strp_recv() (which runs under either bh_lock_sock or\nlock_sock, depending if it's called from -\u003esk_data_ready or strp_work)\nhas completed.\n\nOnly espintcp can be affected by this race condition, but this patch\nmakes sure no future user of strp can have the bug.\n\nThis could crash on strp-\u003esk (\"general mode\" of strp), but this mode\nhas been here for 9 years and has never been used. It'll be gone soon,\nno point worrying about it.\n\nSwitch the stopped/paused/etc bits to u8's to avoid races between\nstrp_stop() and strp_pause/unpause().\n\nA reproducer has been published and turns the possible UAF into an\nexploit [1].", "date_published": "2026-10-23T12:22:42Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99056/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99056/", "title": "CVE-2026-99056 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:42Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99056/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99056/", "title": "CVE-2026-99056 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:42Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99055/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99055/", "title": "CVE-2026-99055 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: reject net_iov in zerocopy receive mapping hints\n\nAfter copying a readable prefix, receive_fallback_to_copy() asks\ntcp_zerocopy_set_hint_for_skb() where page mapping can resume. If the\nnext skb is unreadable, find_next_mappable_frag() passes its net_iov\nfragment to can_map_frag().\n\nskb_frag_page() returns NULL for a net_iov, but can_map_frag()\ndereferences it in PageCompound(). A v7.2 KASAN run on a connected TCP\nsocket with 64 readable bytes followed by a 4096-byte NET_IOV_DMABUF\nfragment reported:\n\n BUG: KASAN: null-ptr-deref in can_map_frag\n tcp_zerocopy_receive -\u003e can_map_frag\n Kernel panic - not syncing: KASAN: panic_on_warn set\n\nThe diagnostic inserted the net_iov directly because the test host has\nno devmem-capable NIC. Hardware end-to-end reachability remains untested\nand requires CONFIG_NET_DEVMEM plus a supported DMA-buf-bound RX queue.\n\nReject all net_iov fragments before skb_frag_page(). This covers both\nDMABUF and IOURING net_iov types while leaving page-backed checks\nunchanged. With the guard, the same queue copied the readable prefix,\nreturned a 4096-byte skip hint, and completed without a fault.", "date_published": "2026-10-23T12:22:39Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99055/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99055/", "title": "CVE-2026-99055 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:39Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99055/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99055/", "title": "CVE-2026-99055 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:39Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99054/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99054/", "title": "CVE-2026-99054 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: destroy topsrv workqueues before closing connections\n\ntipc_topsrv_stop() closed subscriber connections while the topology\nserver's send and receive workqueues were still running. Socket\ncallbacks and subscription events could then queue more work, and\nin-flight send/recv work could drop the last connection reference\nduring the conn_idr walk.\n\nThat race produced several teardown failures: refcount_t addition on\n0 from conn_get() on a connection whose release was blocked on\nidr_lock, a subsequent use-after-free in tipc_conn_close(),\nqueue_work() on an already destroyed workqueue from the listener\ndata-ready callback, and an RCU stall in tipc_topsrv_exit_net()\nwhile the walk spun under idr_lock.\n\nClear srv-\u003elistener under idr_lock so it acts as a shutdown flag,\nskip queue_work() once it is NULL, destroy the workqueues to flush\nin-flight work, and only then close the remaining connections.\nRefuse tipc_conn_lookup() after that flag is cleared, and drop\nidr_lock when the teardown walk finds no connection, so an\nin-flight subscription event cannot pin idr_in_use while the\nwalk holds the lock.\n\nv3 supersedes the narrower in-thread diff Tung Quang Nguyen\nposted on 2026-09-23. It keeps his teardown order and adds the\nlookup refusal and the empty-idr unlock.", "date_published": "2026-10-23T12:22:36Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99054/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99054/", "title": "CVE-2026-99054 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:36Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99054/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99054/", "title": "CVE-2026-99054 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:36Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99053/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99053/", "title": "CVE-2026-99053 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer. Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n CPU 0: find the node under RCU and release the node read lock\n CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n CPU 1: drop the list and timer references, queuing tipc_node_free()\n CPU 0: leave the RCU read-side critical section\n CPU 1: complete the grace period and free the node\n CPU 0: acquire the node lock through the stale pointer\n\nLINK_SET also uses the node's media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\n\nKASAN on v7.3-rc5 reported:\n\n BUG: KASAN: slab-use-after-free in _raw_read_lock_bh\n Write of size 4 at addr ffff88807e06f008 by task poc/92\n Call Trace:\n _raw_read_lock_bh kernel/locking/spinlock.c:287\n tipc_nl_node_set_link net/tipc/node.c:2475\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1114\n genl_rcv_msg net/netlink/genetlink.c:1209\n netlink_rcv_skb net/netlink/af_netlink.c:2575\n\n Allocated by task 0:\n tipc_node_create net/tipc/node.c:539\n tipc_node_check_dest net/tipc/node.c:1196\n tipc_disc_rcv net/tipc/discover.c:252\n\n Freed by task 92:\n kfree mm/slub.c:6801\n rcu_core kernel/rcu/tree.c:2919\n\n Last potentially related work creation:\n __call_rcu_common.constprop.0 kernel/rcu/tree.c:3181\n tipc_node_timeout net/tipc/node.c:814\n\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released. Release\nthat reference on every caller exit after the last node access, including\ntransmission in LINK_SET. Keep the existing link lookup order and locking\nso concurrent link removal still takes the existing error paths.", "date_published": "2026-10-23T12:22:35Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99053/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99053/", "title": "CVE-2026-99053 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:35Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99053/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99053/", "title": "CVE-2026-99053 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:35Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99052/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99052/", "title": "CVE-2026-99052 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts\n\nWhen an NFSv4 filesystem exported with security_label is mounted a\nsecond time, sget_fc() returns the existing superblock and\nnfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the\nsuperblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an\nearly exit without setting SECURITY_LSM_NATIVE_LABELS in\n*set_kern_flags. nfs_get_root() then sees kflags without\nSECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on\nthe shared nfs_server, silently disabling per-file labeling for both\nthe new and the original mount.\n\nCommit 3815a245b501 (\"security/selinux: fix SECURITY_LSM_NATIVE_LABELS\non reused superblock\") fixed the same problem in\nselinux_sb_clone_mnt_opts(). The reused-superblock path for a plain\nsecond mount now goes through sb_set_mnt_opts rather than\nsb_clone_mnt_opts, so it needs the same treatment: on both\nSE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in\n*set_kern_flags when the superblock was already using\nSECURITY_FS_USE_NATVE.", "date_published": "2026-10-23T12:22:34Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99052/fixed/debian-13", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99052/", "title": "CVE-2026-99052 fixed in Debian:13", "content_text": "Fixed versions: linux 6.12.113-1.", "date_published": "2026-10-23T12:22:34Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99052/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99052/", "title": "CVE-2026-99052 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:34Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99051/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99051/", "title": "CVE-2026-99051 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsverity: RCU-delay the freeing of struct fsverity_info\n\n__fsverity_get_info() calls rhashtable_lookup_fast(), which just uses\nrcu_read_lock() and doesn't directly synchronize with\nfsverity_remove_info().\n\nFor the same inode this isn't a problem: its fsverity_info is removed\nonly at inode eviction time or upon failure to enable verity, when the\ninode no longer needs its fsverity_info and it will no longer be\naccessed via that inode.\n\nHowever, this is broken and can cause a use-after-free for concurrent\n__fsverity_get_info() for *different* inodes. Those rely on following\nfsverity_info::rhash_head in the rhashtable under rcu_read_lock() only.\nThey also use fsverity_info::inode to do the key comparison.\n\nFix this by RCU-delaying the freeing of 'struct fsverity_info' after\nit's been removed from the rhashtable.", "date_published": "2026-10-23T12:22:30Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99051/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99051/", "title": "CVE-2026-99051 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:30Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99050/disclosed", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99050/", "title": "CVE-2026-99050 disclosed", "content_text": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mpsse: fix race when arming the IRQ poll worker\n\ngpio_mpsse_irq_enable() arms the poll worker before publishing it:\nschedule_work() runs before the worker is added to priv-\u003eworkers. If\ngpio_mpsse_disconnect() walks the list in that window it misses the\nworker, and once disconnect returns, the USB core frees mpsse_priv\nwhile the orphaned gpio_mpsse_poll() work keeps accessing it, causing\na use-after-free.\n\nFix this by publishing and arming the worker in one irq_spin\ncritical section. Teardown walks the same list under irq_spin, so a\nworker found on the list is guaranteed to be armed, and\ncancel_work_sync() handles it whether it is queued or running.\n\nA worker armed after the disconnect walk would still be missed, so\nalso set a new priv-\u003edying flag under irq_spin before the teardown\nwalk, and check it in the same critical section, freeing it via\nkfree_rcu() instead when the device is going away, since kfree()\nwould be called with the IRQ core's raw spinlock held and may sleep\non PREEMPT_RT. schedule_work() is safe to call with irq_spin held,\nand the next probe gets a fresh mpsse_priv, so the flag never needs\nto be cleared.\n\nThis issue was found by an in-house static analysis tool.", "date_published": "2026-10-23T12:22:29Z" }, { "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-99050/fixed/debian-14", "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-99050/", "title": "CVE-2026-99050 fixed in Debian:14", "content_text": "Fixed versions: linux 7.2.11-1.", "date_published": "2026-10-23T12:22:29Z" } ] }