From patchwork Mon Aug 3 08:48:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94286 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36C42C55184 for ; Mon, 3 Aug 2026 08:49:08 +0000 (UTC) Received: from out-180.mta1.migadu.com (out-180.mta1.migadu.com [95.215.58.180]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.39070.1785746946718491009 for ; Mon, 03 Aug 2026 01:49:07 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=bltcXLSA; spf=pass (domain: linux.dev, ip: 95.215.58.180, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785746944; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Vr1etC4ZimpGJlnpSHt4rpf8hUsn/jbQfvKQTojn8is=; b=bltcXLSAv531dOpgOynxcSmbtonY5lWjP0TXUh5aZo64srYamFACqgV66UQF66+K9y+OHL UZB2+5ARaYhSE38IWK3Vj5tCO22kqTnvfwlAfQkX8FmgrvLSJWkQXB0TCLaRnxAJ4tn+1t aFFm77hPSejp+0MsAmMKlB1cHkR6ZTQ= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 01/10] cve-exclusion: set status for CVE-2019-14899 Date: Mon, 3 Aug 2026 01:48:18 -0700 Message-ID: <20260803084827.1348810-2-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:49:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242627 A network-adjacent attacker can send packets addressed to a host's VPN tunnel address over the physical interface. Because Linux uses the weak host model by default, the host replies, which lets the attacker infer the tunnel address, confirm active connections and eventually inject into the tunneled TCP stream. No kernel fix exists. The original disclosure states that reverse path filtering is not a solution because the attack also works over IPv6, which has no rp_filter at all: https://www.openwall.com/lists/oss-security/2019/12/05/1 Kernel-level mitigations were discussed on netdev and the WireGuard list in December 2019 but nothing was merged; the mitigation that shipped was a firewall rule added to wg-quick(8) in userspace: https://lore.kernel.org/all/20191205191318.GA44156@zx2c4.com/ Ubuntu has the issue deferred for every release since 2019-12-13 and records "No current fix from upstream": https://ubuntu.com/security/CVE-2019-14899 Debian does not track it against the kernel source package at all, and Red Hat scopes it to openvpn rather than the kernel: https://security-tracker.debian.org/tracker/CVE-2019-14899 https://access.redhat.com/security/cve/CVE-2019-14899 The NVD entry carries an unversioned linux_kernel CPE, so no fixed version can ever match it. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index d27d7644..aaba26fe 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -192,3 +192,10 @@ CVE_STATUS[CVE-2025-68195] = "fixed-version: Fixed from 6.18" # Fix https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3 # Backport https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906 CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3" + +# Consequence of the default weak host model, not a specific defect. +# Mitigation is configuration only: rp_filter for IPv4, or a strong host +# model rule such as the one wg-quick(8) installs, which also covers IPv6. +# https://www.openwall.com/lists/oss-security/2019/12/05/1 +CVE_STATUS[CVE-2019-14899] = "upstream-wontfix: consequence of the default weak \ +host model, no kernel fix exists or is planned, mitigated by firewall configuration" From patchwork Mon Aug 3 08:48:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94287 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31482C55175 for ; Mon, 3 Aug 2026 08:49:28 +0000 (UTC) Received: from out-183.mta0.migadu.com (out-183.mta0.migadu.com [91.218.175.183]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.39073.1785746967123020401 for ; Mon, 03 Aug 2026 01:49:27 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=vPphBxsT; spf=pass (domain: linux.dev, ip: 91.218.175.183, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785746964; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MtWIajyyFcxIT8xrpdsenwui+ADWAk0ntEAs7yee5Ds=; b=vPphBxsTGF/9K+A138CK3mX6wqeVgLGY69Ix8gpTED0qm/VI8w/sgLZTokhbnkwlMSG3QB NQ+7Wp/albL1cI1XITMfvJzrUNSkd87kVvzk2ZUuoAIKL3qrdGzGjV2mevFfKRHMCoxjPL smzqvRH1vuZbB1EdZa6ahIbmYcfN/w0= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 02/10] cve-exclusion: set status for CVE-2021-3714 Date: Mon, 3 Aug 2026 01:48:19 -0700 Message-ID: <20260803084827.1348810-3-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:49:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242628 KSM merges identical anonymous pages across processes. An attacker who can place chosen page-sized content in a victim's memory can detect the merge through the timing of the resulting copy-on-write fault, and so leak memory contents remotely. This cannot be fixed without removing deduplication, and the affected projects have said so explicitly. Red Hat closed the issue WONTFIX: https://bugzilla.redhat.com/show_bug.cgi?id=1931327 Debian marks src:linux unfixed with the note "Inherent design limitation, can be avoided by not using KSM": https://security-tracker.debian.org/tracker/CVE-2021-3714 Ubuntu records "there is no upstream fix available as of 2024-06-17" and lists disabling KSM as the only mitigation: https://ubuntu.com/security/CVE-2021-3714 CONFIG_KSM=y is set in yocto-kernel-cache (bsp/intel-x86 and the paravirt_kvm fragments), so this is not a configuration exclusion. It does however require two runtime opt-ins: ksm_run defaults to KSM_RUN_STOP in mm/ksm.c, so ksmd must be started by the administrator, and memory is only eligible if the process asks for it with madvise(MADV_MERGEABLE) or prctl(PR_SET_MEMORY_MERGE). CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index aaba26fe..9012d328 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -199,3 +199,10 @@ CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3" # https://www.openwall.com/lists/oss-security/2019/12/05/1 CVE_STATUS[CVE-2019-14899] = "upstream-wontfix: consequence of the default weak \ host model, no kernel fix exists or is planned, mitigated by firewall configuration" + +# Inherent to KSM deduplication, closed WONTFIX by Red Hat. Exposure needs +# ksmd started at runtime (/sys/kernel/mm/ksm/run defaults to 0) and the +# workload to opt in via MADV_MERGEABLE or prctl(PR_SET_MEMORY_MERGE). +# https://bugzilla.redhat.com/show_bug.cgi?id=1931327 +CVE_STATUS[CVE-2021-3714] = "upstream-wontfix: inherent design limitation of \ +KSM page deduplication, closed WONTFIX by Red Hat, no upstream fix planned" From patchwork Mon Aug 3 08:48:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94289 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44779C5518F for ; Mon, 3 Aug 2026 08:49:48 +0000 (UTC) Received: from out-179.mta1.migadu.com (out-179.mta1.migadu.com [95.215.58.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.39075.1785746982737878156 for ; Mon, 03 Aug 2026 01:49:43 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=qZNqjnnG; spf=pass (domain: linux.dev, ip: 95.215.58.179, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785746980; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6tC56JaTaqp694AfIZDTd5uvFh+NRiIFoIiR3V8b4D8=; b=qZNqjnnG4/Mq09Wyp2cGNk3sNGHi/ldMYfnKZ4Jr6RPDgiy8Dex11g87abJeBSh1xfd3qv K5l/M+prjTMuEXnmku10ugzBWVp0hdckqVkQCmWHblJntdz8leBJql16p3DkmoYvHu4YxE LYRk7/lbmjVfkeMaK3Xf5NpGlww9CBo= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 03/10] cve-exclusion: set status for CVE-2021-3864 Date: Mon, 3 Aug 2026 01:48:20 -0700 Message-ID: <20260803084827.1348810-4-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:49:48 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242629 begin_new_exec() resets dumpability to owner-dumpable whenever the real and effective ids match at exec time. A binary exec'd by a setuid program that has already called setuid(0) therefore becomes dumpable as root, and with a relative core_pattern plus an attacker-controlled working directory the resulting core file can be dropped into a privileged directory such as /etc/logrotate.d. Full report with proof of concept: https://www.openwall.com/lists/oss-security/2021/10/20/2 Two fixes were proposed and neither was merged. Waiman Long's patch was NAKed by Eric W. Biederman as an ineffective mitigation: https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/ Wander Lairson Costa's RFC v2 received design feedback and no v3 ever followed: https://lore.kernel.org/all/20211228170910.623156-1-wander@redhat.com/ The flagged logic is unchanged today: fs/exec.c still selects TASK_DUMPABLE_OWNER in that case, and fs/coredump.c only rejects relative core paths when dumpable is 2, so the dumpable==1 case this CVE describes is not covered. Ubuntu records "no fix upstream as of 2022-01-27" and defers it for all releases; Debian lists src:linux as unfixed: https://ubuntu.com/security/CVE-2021-3864 https://security-tracker.debian.org/tracker/CVE-2021-3864 Red Hat rates RHEL 8 and later "Not affected" purely because their default core_pattern does not write relative to the current directory: https://access.redhat.com/security/cve/CVE-2021-3864 Images that set an absolute path, a pipe or a socket core_pattern (for example systemd-coredump) are not exploitable for the same reason. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 9012d328..d7ae3b03 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -206,3 +206,9 @@ host model, no kernel fix exists or is planned, mitigated by firewall configurat # https://bugzilla.redhat.com/show_bug.cgi?id=1931327 CVE_STATUS[CVE-2021-3714] = "upstream-wontfix: inherent design limitation of \ KSM page deduplication, closed WONTFIX by Red Hat, no upstream fix planned" + +# Two fix attempts, neither merged; the fs/exec.c logic is unchanged. +# An absolute, piped or socket kernel.core_pattern prevents exploitation. +# https://www.openwall.com/lists/oss-security/2021/10/20/2 +CVE_STATUS[CVE-2021-3864] = "upstream-wontfix: no accepted mainline fix after \ +several attempts, exploitation requires a relative kernel.core_pattern" From patchwork Mon Aug 3 08:48:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94288 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30635C55184 for ; Mon, 3 Aug 2026 08:49:48 +0000 (UTC) Received: from out-185.mta0.migadu.com (out-185.mta0.migadu.com [91.218.175.185]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.39021.1785746987184853137 for ; Mon, 03 Aug 2026 01:49:47 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=dF0iGndh; spf=pass (domain: linux.dev, ip: 91.218.175.185, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785746985; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0QJHRXPeQrwu+ftHqGPsNXYPm2lvOXOppYHFhVVI39M=; b=dF0iGndh6cWA4iJcXg9Jg+UZa8ehQVb4gqAfUfqLayLGL5fAOhlgrAcRmn6mv59n/HlanT lGv0rUbeZmEm9w21iQBrxNai6qjMs31blMnfyvpO/H5u0XWlOaV3HTeojs2gOD8P4OdaqX 2Op97w3SXcZkQV5Ej+0nRVQZ1muimXU= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 04/10] cve-exclusion: set status for CVE-2022-0400 Date: Mon, 3 Aug 2026 01:48:21 -0700 Message-ID: <20260803084827.1348810-5-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:49:48 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242630 The CVE describes an out-of-bounds read in the SMC protocol stack, but no vulnerable code was ever identified. The MITRE record lists the affected version as "Not Known" and references only two Red Hat bugzillas, the originating one of which was never made public. The public bugzilla is closed as NOTABUG, with the statement "There was no shipped kernel version that was seen affected by this problem": https://bugzilla.redhat.com/show_bug.cgi?id=2044575 https://access.redhat.com/security/cve/CVE-2022-0400 SUSE reached the same conclusion independently, closing bsc#1195329 as RESOLVED / INVALID: https://www.suse.com/security/cve/CVE-2022-0400.html So did Debian, which marks it unimportant with the note "non issue, no security impact": https://security-tracker.debian.org/tracker/CVE-2022-0400 There is no commit in mainline referencing this CVE. The net/smc out-of-bounds fixes that landed in v5.18 (b1871fd48efc, 0558226cebee) are in local, privileged paths and are not linked to this CVE by any tracker. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index d7ae3b03..0ae3a0d6 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -212,3 +212,10 @@ KSM page deduplication, closed WONTFIX by Red Hat, no upstream fix planned" # https://www.openwall.com/lists/oss-security/2021/10/20/2 CVE_STATUS[CVE-2021-3864] = "upstream-wontfix: no accepted mainline fix after \ several attempts, exploitation requires a relative kernel.core_pattern" + +# Never substantiated: no affected version, reproducer or commit was ever +# identified. Closed NOTABUG by Red Hat, INVALID by SUSE (bsc#1195329) and +# "non issue, no security impact" by Debian. +# https://bugzilla.redhat.com/show_bug.cgi?id=2044575 +CVE_STATUS[CVE-2022-0400] = "disputed: the reported net/smc out-of-bounds read \ +was never substantiated and was closed as not-a-bug by Red Hat, SUSE and Debian" From patchwork Mon Aug 3 08:48:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94290 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3755EC55175 for ; Mon, 3 Aug 2026 08:49:58 +0000 (UTC) Received: from out-177.mta0.migadu.com (out-177.mta0.migadu.com [91.218.175.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.39077.1785746997393580999 for ; Mon, 03 Aug 2026 01:49:57 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=QeSiBtaK; spf=pass (domain: linux.dev, ip: 91.218.175.177, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785746995; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=PTx+5SaOOeACOLVOogdEN5GezcLEA8jP6JOscJQarbY=; b=QeSiBtaKMqb0sqpPFaNkDTcV3lCbyc0IwchyTn9RTPjy8twl/vj+KAK1Pycolpe/lNUl8I 9+hqsehulfiG4J7AIJk0pAUJaZ8bapgpxwWb29Koi72YkPh5x/BKxwtWjrzwh1rgtwG3mV IO34gKvfUl6o2neMHpTTD4hGldPSQ+0= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 05/10] cve-exclusion: set status for CVE-2022-1247 Date: Mon, 3 Aug 2026 01:48:22 -0700 Message-ID: <20260803084827.1348810-6-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:49:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242631 The CVE describes a race between rose_connect() and the code that frees a rose_neigh once its count and use fields reach zero. Takamitsu Iwai's August 2025 series converts that field to a proper reference count and removes the unlocked increment in rose_connect() which is exactly the operation the CVE describes: https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061 ("net: rose: convert 'use' field to refcount_t", v6.17) https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45 ("net: rose: include node references in rose_neigh refcount", v6.17) The first commit message states the premise of the CVE almost verbatim: "The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths", and its diff deletes the "rose->neighbour->use++;" statement from rose_connect(). The second merges the separate count and use counters, which is the other half of the condition described by the CVE, and closes a syzbot-reported slab-use-after-free. Both are in v6.17 and were backported to 6.1.y, 6.6.y, 6.12.y and 6.16.y in the 2025-09-02 stable round. Kernels from v7.1 onwards are unaffected by construction, since the AX.25 and hamradio subsystems were removed: https://git.kernel.org/linus/dd8d4bc28ad7252610d8e79c1313a2d1e3499a51 The commits predate the association of this CVE with any fix, so no tracker links them yet - Ubuntu, Debian and Red Hat all still show the CVE as open. The identification above is based on the commit contents matching the CVE description; the two 2022 rose patches from Duoming Zhou that Ubuntu's tracker references fix different rose bugs and are not the fix for this issue. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 0ae3a0d6..7547cdfd 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -219,3 +219,9 @@ several attempts, exploitation requires a relative kernel.core_pattern" # https://bugzilla.redhat.com/show_bug.cgi?id=2044575 CVE_STATUS[CVE-2022-0400] = "disputed: the reported net/smc out-of-bounds read \ was never substantiated and was closed as not-a-bug by Red Hat, SUSE and Debian" + +# Fix https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061 +# Fix https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45 +# Also in 6.1.150, 6.6.104, 6.12.y and 6.16.5 via the 2025-09-02 stable round. +# The rose/hamradio subsystem was removed entirely in v7.1 (dd8d4bc28ad7). +CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" From patchwork Mon Aug 3 08:48:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94291 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3641CC55175 for ; Mon, 3 Aug 2026 08:50:08 +0000 (UTC) Received: from out-181.mta0.migadu.com (out-181.mta0.migadu.com [91.218.175.181]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.39025.1785747005700604975 for ; Mon, 03 Aug 2026 01:50:05 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=bklBbRWz; spf=pass (domain: linux.dev, ip: 91.218.175.181, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785747003; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=B3d2RLakSAdFqAQu5/5q3WoyjBuHBaRHRa6U84R9bDY=; b=bklBbRWzgJbbuTC8CWOBjq5Fk7NVJnEB9XltonrFqIjZbFt5OWvLB+j/23zMPTJE4JwBQ2 OfxZVQ7CZNGqRg+DDVWHaoBlK/zPot2has6ApAeuCFGrcyK0WTRMkLrHWO8vzcfEWIpI1K UyoyO0woptM63MlWQAaBAADVk5ZOnfs= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 06/10] cve-exclusion: set status for CVE-2022-4543 Date: Mon, 3 Aug 2026 01:48:23 -0700 Message-ID: <20260803084827.1348810-7-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:50:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242632 KPTI clones the kernel entry text into the user page tables at its KASLR-slid address and, on CPUs with PGE, sets the global bit on those PTEs. The mapping therefore survives the CR3 write on kernel exit, and a local attacker can time prefetch instructions across the kernel range to recover the KASLR base in well under a second. Disclosure and technical write-up: https://www.openwall.com/lists/oss-security/2022/12/16/3 https://www.willsroot.io/2022/12/entrybleed.html The disclosure states that after discussion with security@kernel.org and linux-distros "a fix for this is currently not available", and none has appeared since. arch/x86/mm/pti.c still clones the entry text and still sets _PAGE_GLOBAL on the cloned PTEs as of v7.2, and no commit in mainline references the issue. Debian marks it unimportant with the note "Ignored upstream and KASLR is not expected to be resistant to local attacks": https://security-tracker.debian.org/tracker/CVE-2022-4543 Ubuntu has it deferred since 2023-01-10 with "unfixed upstream", and Red Hat lists current RHEL as Affected with no mitigation available: https://ubuntu.com/security/CVE-2022-4543 https://access.redhat.com/security/cve/CVE-2022-4543 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area", v6.2) randomizes the CPU entry area, which is CVE-2023-3640. It predates this disclosure and does not address it - the offset of entry_SYSCALL_64 from the KASLR base is unchanged by that commit. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 7547cdfd..3517318e 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -225,3 +225,10 @@ was never substantiated and was closed as not-a-bug by Red Hat, SUSE and Debian" # Also in 6.1.150, 6.6.104, 6.12.y and 6.16.5 via the 2025-09-02 stable round. # The rose/hamradio subsystem was removed entirely in v7.1 (dd8d4bc28ad7). CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" + +# "EntryBleed": KPTI maps __entry_text into the user page tables with the +# global bit set, leaking the KASLR base by prefetch timing. Intel only. +# Not CVE-2023-3640, which is the separate cpu_entry_area (fixed in v6.2). +# https://www.willsroot.io/2022/12/entrybleed.html +CVE_STATUS[CVE-2022-4543] = "upstream-wontfix: no fix planned, KASLR is not \ +considered a defence against local attackers" From patchwork Mon Aug 3 08:48:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94292 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F747C55175 for ; Mon, 3 Aug 2026 08:50:28 +0000 (UTC) Received: from out-181.mta0.migadu.com (out-181.mta0.migadu.com [91.218.175.181]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.39084.1785747017996417977 for ; Mon, 03 Aug 2026 01:50:18 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=cWglyNyq; spf=pass (domain: linux.dev, ip: 91.218.175.181, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785747015; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pywFFLxEQ0YD1Jvb1j+qUEjyeWpPyTbtW1n2ftGvkrQ=; b=cWglyNyq1gniDYtru+mF1ySqDobdomDu9msgJO2Kpq+RYZxK6JayJ5QOmShfJjaacSrnJq eokYi582YyGkgU56Pdl9VCt8nOQ7GztQgyWW1CFG0Nh7pr/S36nI3YSl+oHPuD/QGjqp7V uFuxoYO86k7YxysXkif8sbRYeGN90U4= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 07/10] cve-exclusion: set status for CVE-2023-3397 Date: Mon, 3 Aug 2026 01:48:24 -0700 Message-ID: <20260803084827.1348810-8-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:50:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242633 txEnd() in fs/jfs/jfs_txnmgr.c reads the log pointer from the superblock info, drops TXN_LOCK and then takes log->gclock, while lmLogClose() can free that log during umount. The subsystem in the public CVE data is misleading: the "slub" association comes from the KASAN slab report, but the affected code is JFS. Red Hat's own title for the issue is "slab-use-after-free write in txend due to race condition". A fix adding a new mutex was posted, reviewed, and then withdrawn by its author, who wrote "I think my fix method is not a good solution": https://lore.kernel.org/all/20230515095956.17898-1-zyytlz.wz@163.com/ No other fix has been posted, and the sequence in txEnd() is unchanged in mainline as of linux-next 20260727. syzkaller was still reporting "KASAN: slab-use-after-free Write in txEnd" in June 2026. Ubuntu records "unfixed upstream as of 2023-09-01"; Debian lists src:linux as vulnerable in every suite: https://ubuntu.com/security/CVE-2023-3397 https://security-tracker.debian.org/tracker/CVE-2023-3397 CONFIG_JFS_FS=n in both ktypes/standard/standard.cfg and ktypes/preempt-rt/preempt-rt.cfg in yocto-kernel-cache, and no fragment there enables it; the only other occurrence is CONFIG_JFS_SECURITY in the selinux feature, which has no effect without JFS_FS. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 3517318e..827a487e 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -232,3 +232,10 @@ CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" # https://www.willsroot.io/2022/12/entrybleed.html CVE_STATUS[CVE-2022-4543] = "upstream-wontfix: no fix planned, KASLR is not \ considered a defence against local attackers" + +# JFS txEnd()/lmLogClose() use-after-free, not slub as the CVE data says. +# The only proposed fix was withdrawn by its author; the racy code is +# unchanged and syzbot still reproduces it as of June 2026. +# https://lore.kernel.org/all/20230515095956.17898-1-zyytlz.wz@163.com/ +CVE_STATUS[CVE-2023-3397] = "unpatched: no upstream fix, the only proposed \ +patch was withdrawn by its author and the affected fs/jfs code is unchanged" From patchwork Mon Aug 3 08:48:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94293 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36B70C55184 for ; Mon, 3 Aug 2026 08:50:48 +0000 (UTC) Received: from out-185.mta0.migadu.com (out-185.mta0.migadu.com [91.218.175.185]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.39092.1785747039968533617 for ; Mon, 03 Aug 2026 01:50:40 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=CwXd9yz2; spf=pass (domain: linux.dev, ip: 91.218.175.185, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785747037; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2+gYhNkY6i2bJhhPYPWtqxURPLSQDW4cZ70kzzWGI9Q=; b=CwXd9yz2jn6g6/X+1AFGu3Z/RlZASz6lckU8aJUjxT+bUwD7D8IAgrewzKyhca1ttFXl5T lgy0QVXQlPXapkB9pBj9SYqIxtiVTUi3f1oaYOGMRFg6+BfnQvvs8wirddL7dwk8YxzEhD TC/4XLpB7hqggPmMHA34D2uGCYJ3+U4= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 08/10] cve-exclusion: set status for CVE-2023-4010 Date: Mon, 3 Aug 2026 01:48:25 -0700 Message-ID: <20260803084827.1348810-9-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:50:48 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242634 The CVE text attributes a system lockup to usb_giveback_urb() in the USB HCD framework. That function does not exist in the kernel; the closest name is usb_giveback_urb_bh(). Ubuntu's security team noted the same discrepancy when triaging the issue. The reporter's proof of concept identifies the actual driver. Its output shows the imon driver repeatedly printing errors and consuming CPU: https://github.com/wanrenmi/a-usb-kernel-bug usb_rx_callback_intf0() and usb_rx_callback_intf1() in drivers/media/rc/imon.c resubmitted the RX URB after logging an error, so a device returning -EPROTO caused an unbounded warning loop. That is fixed by: https://git.kernel.org/linus/eecd203ada43a4693ce6fdd3a58ae10c7819252c ("media: imon: make send_packet() more robust", v6.18) whose commit message describes the same mechanism: "usb_rx_callback_intf0() resubmits urb after printk(), and resubmitted urb causes usb_rx_callback_intf0() to again get -EPROTO error. This results in printk() flooding (RCU stalls)". The fix returns early for those error codes instead of resubmitting. The impact is lower than the CVE suggests. It needs physical access to attach a malicious device, and Ubuntu's triage concluded "There is no system lockup happening", only unthrottled logging: https://ubuntu.com/security/CVE-2023-4010 Ubuntu's tracker data reaches the same conclusion about which driver is at fault: it records "break-fix: 21677cfc562a -" for this CVE, and 21677cfc562a is "V4L/DVB: ir-core: add imon driver", the commit that introduced the driver. Their note explains the choice: "The imon driver has been issuing those warnings since its inception, so using that as the break commit." The tie to the fixing commit is an inference: eecd203ada43 carries no CVE reference or Fixes tag, so no tracker links the two. It rests on the reported function not existing, Ubuntu and the reporter's PoC both pointing at imon, and the mechanism the commit fixes matching the report. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 827a487e..0647586f 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -239,3 +239,8 @@ considered a defence against local attackers" # https://lore.kernel.org/all/20230515095956.17898-1-zyytlz.wz@163.com/ CVE_STATUS[CVE-2023-3397] = "unpatched: no upstream fix, the only proposed \ patch was withdrawn by its author and the affected fs/jfs code is unchanged" + +# Fix https://git.kernel.org/linus/eecd203ada43a4693ce6fdd3a58ae10c7819252c +# The CVE names usb_giveback_urb(), which does not exist; the reporter's PoC +# and Ubuntu's break-fix data both point at drivers/media/rc/imon.c. +CVE_STATUS[CVE-2023-4010] = "fixed-version: Fixed from version 6.18" From patchwork Mon Aug 3 08:48:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94294 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38CD9C55184 for ; Mon, 3 Aug 2026 08:50:58 +0000 (UTC) Received: from out-173.mta0.migadu.com (out-173.mta0.migadu.com [91.218.175.173]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.39095.1785747050521069224 for ; Mon, 03 Aug 2026 01:50:50 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=exJe2PVC; spf=pass (domain: linux.dev, ip: 91.218.175.173, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785747047; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5Ag27dGr5ZrNePSTpMcmiyuLkAlF/sCHTZZPBlhPERQ=; b=exJe2PVCO7sC88nMibkLbVaONYPUCFnMyVybqkTBoXXqWUEWe5H6KQO4Q4cOQ9J2zgiod7 wWHl7T3k9EK0GKEsD299ots0CIx0o7h7Gy3CGgYiboLlsR/wvsHDFP2EgQMhTDyZcM5U8U cq+NspRxLzi/J+mqxhfx1PgaRZ7yBkg= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 09/10] cve-exclusion: set status for CVE-2023-6238 Date: Mon, 3 Aug 2026 01:48:26 -0700 Message-ID: <20260803084827.1348810-10-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:50:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242635 NVME_IOCTL_IO_CMD and the io_uring passthrough path accept a metadata length from userspace without checking it against the number of blocks and the namespace metadata size that the device uses to size the transfer, so the device can DMA past the end of the buffer. Kanchan Joshi posted a stopgap removing unprivileged passthrough, reviewed by Christoph Hellwig and applied for nvme-6.6: https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/ It was then backed out. Keith Busch wrote "I believe this large change is a bit too late for 6.6 ... It's backed out now", to which Christoph Hellwig replied "We leave an exploitable hole in, so I don't think waiting any longer is an option". No replacement has been merged: the commits the patch would have reverted are all still present, and nvme_map_user_request() still passes the user-supplied metadata length straight to blk_rq_integrity_map_user() with no cross-check. The exposure was introduced by 855b7717f44b ("nvme: fine-granular CAP_SYS_ADMIN for nvme io commands") in v6.2, so branches carrying older kernels are not affected. Debian reached the same conclusion independently, marking the older suites "Vulnerable code not present": https://security-tracker.debian.org/tracker/CVE-2023-6238 Red Hat rates it Low because the device node is root-only by default: https://access.redhat.com/security/cve/CVE-2023-6238 CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 0647586f..506d3705 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -244,3 +244,11 @@ patch was withdrawn by its author and the affected fs/jfs code is unchanged" # The CVE names usb_giveback_urb(), which does not exist; the reporter's PoC # and Ubuntu's break-fix data both point at drivers/media/rc/imon.c. CVE_STATUS[CVE-2023-4010] = "fixed-version: Fixed from version 6.18" + +# The user metadata length is not checked against the length the device +# derives from the command. The fix was applied to nvme-6.6 and then backed +# out; nothing has landed since. Kernels before v6.2 predate unprivileged +# passthrough (855b7717f44b) and are not affected. +# https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/ +CVE_STATUS[CVE-2023-6238] = "unpatched: the proposed fix was applied to \ +nvme-6.6 and then reverted, no upstream fix has landed since" From patchwork Mon Aug 3 08:48:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94295 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 371A2C55175 for ; Mon, 3 Aug 2026 08:51:08 +0000 (UTC) Received: from out-189.mta0.migadu.com (out-189.mta0.migadu.com [91.218.175.189]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.39099.1785747059919858781 for ; Mon, 03 Aug 2026 01:51:00 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=BxcvSbVo; spf=pass (domain: linux.dev, ip: 91.218.175.189, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785747057; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=OJQPS/QikPsn+CVxX88CQ4ElnIPEhXE59yy0y5khDcw=; b=BxcvSbVoK+JjzWCUIzjR9e9/VopwUY4Ni0DwpQ0tn/i16IFAsNyX7zf8T/7HwW+hHvv9Xh Bz7gvCJlYlkhI/fjIU45TwnDEoAnM0+pACE1xKpTQXdpKhDccgbxFBn4Y8u2IbVUfbk1qk RjEUMk+mhlfMO45UVelqbkIBJR4pbGI= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, randy.macleod@windriver.com, Venkata.Navuduri@windriver.com Subject: [OE-core][PATCH v2 10/10] cve-exclusion: set status for CVE-2023-6240 Date: Mon, 3 Aug 2026 01:48:27 -0700 Message-ID: <20260803084827.1348810-11-junjie.cao@linux.dev> In-Reply-To: <20260803084827.1348810-1-junjie.cao@linux.dev> References: <20260803084827.1348810-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:51:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242636 "Marvin" is Hubert Kario's Bleichenbacher-style timing oracle research, not a Marvell or s390 issue as some data sets suggest: https://people.redhat.com/~hkario/marvin/ The affected code is the generic software RSA PKCS#1 v1.5 unpadding in crypto/rsa-pkcs1pad.c. pkcs1pad_decrypt_complete() has three secret-dependent early exits (leading zero byte, block type, minimum padding length) and a loop whose trip count depends on the position of the separator, so the time taken reveals padding validity. There is no constant-time unpadding and no implicit-rejection fallback in the tree, and no commit touching that file addresses decryption timing. Red Hat classifies it CWE-203 and has shipped fixes only in RHEL errata (RHSA-2024:2758 for 9.4, RHSA-2024:3618 for 8.10 and others); the corresponding bugzilla is still NEW: https://access.redhat.com/security/cve/CVE-2023-6240 Ubuntu records "appears unfixed in upstream as of 2024.08.24" and Debian lists src:linux as vulnerable in all suites: https://ubuntu.com/security/CVE-2023-6240 https://security-tracker.debian.org/tracker/CVE-2023-6240 Practical exposure is narrow: kernel PKCS#1 v1.5 use is dominated by signature verification rather than decryption, and an attacker needs a service driving KEYCTL_PKEY_DECRYPT with a long-lived key. The leaky primitive is nevertheless reachable. e8829ef1f73f ("crypto: rsa - restrict plaintext/ciphertext values more", v6.9) is unrelated: it enforces SP800-56B value restrictions and is not a timing fix. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 506d3705..4ac5e343 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -252,3 +252,10 @@ CVE_STATUS[CVE-2023-4010] = "fixed-version: Fixed from version 6.18" # https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/ CVE_STATUS[CVE-2023-6238] = "unpatched: the proposed fix was applied to \ nvme-6.6 and then reverted, no upstream fix has landed since" + +# "Marvin": the PKCS#1 v1.5 unpadding in crypto/rsa-pkcs1pad.c branches on +# secret-derived data, leaking padding validity by timing. Not a Marvell or +# s390 issue despite some data sets. Fixed only in RHEL downstream. +# https://people.redhat.com/~hkario/marvin/ +CVE_STATUS[CVE-2023-6240] = "unpatched: Bleichenbacher-style timing oracle in \ +crypto/rsa-pkcs1pad.c is still present in mainline, fixed only downstream in RHEL"