From patchwork Mon Aug 24 04:21:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 96117 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BF5BC5DF97 for ; Mon, 24 Aug 2026 02:22:43 +0000 (UTC) Received: from mta1.migadu.com (mta1.migadu.com [95.215.58.233]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8449.1787538161727278953 for ; Sun, 23 Aug 2026 19:22:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@linux.dev header.s=key1 header.b=DkANOwTK; spf=pass (domain: linux.dev, ip: 95.215.58.233, mailfrom: junjie.cao@linux.dev) X-Envelope-To: openembedded-core@lists.openembedded.org DKIM-Signature: a=rsa-sha256; bh=46yqIFbKjSPC822DfPDd3RCk4mdvM+QGpkQsW8rNAGw=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787538160; v=1; x=1788142960; b=DkANOwTKP3iJ/8HbYCydeUZML8CaqvAk4zTaSQc+A9jqA0FWfJ0lq5yH2dpK+BwtxFfRahT/ zWuvlZu+3USW4L1EZ2gVrowggKOa9/7f2n5D3GgAHEZONZIVvGRbOHnWCiv8YiMugP/+h2bAju4 yiwoWfw7qwbC+jwkWioYjpqE= X-Envelope-To: openembedded-core@lists.openembedded.org Received: from localhost (2408:8806:52:f8ea:5de6:8d95:1672:70f3) by smtp.migadu.com with ESMTPS id 510440270f669125; Mon, 24 Aug 2026 02:22:39 +0000 X-Mizu-Trace-ID: 510440270f669125 X-Migadu-Flow: FLOW_OUT From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v4 1/8] cve-exclusions: set status for CVE-2019-14899 Date: Sun, 23 Aug 2026 23:21:16 -0500 Message-ID: <20260824042123.1456876-2-junjie.cao@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824042123.1456876-1-junjie.cao@linux.dev> References: <20260824042123.1456876-1-junjie.cao@linux.dev> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 02:22:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244047 A network-adjacent attacker can send packets addressed to a host's VPN tunnel address over the physical interface. Because Linux uses the weak host model by default, the host replies, which lets the attacker infer the tunnel address, confirm active connections and eventually inject into the tunneled TCP stream. No upstream kernel fix exists. Ubuntu has the fix deferred since 2019-12-13, Debian does not track it against the kernel, and Red Hat scopes it to openvpn: https://ubuntu.com/security/CVE-2019-14899 https://security-tracker.debian.org/tracker/CVE-2019-14899 Record it unpatched so it stays visible rather than excluded. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v4: - use the review's comment and status wording; drop the mitigation discussion v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index d27d7644..b2eb15d0 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -192,3 +192,8 @@ CVE_STATUS[CVE-2025-68195] = "fixed-version: Fixed from 6.18" # Fix https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3 # Backport https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906 CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3" + +# Triaged August 2026 - no upstream fix, Ubuntu fix deferred +# https://ubuntu.com/security/CVE-2019-14899 +CVE_STATUS[CVE-2019-14899] = "unpatched: Consequence of the default weak host \ +model, no upstream fix" From patchwork Mon Aug 24 04:21:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 96118 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1988C5DF9C for ; Mon, 24 Aug 2026 02:22:52 +0000 (UTC) Received: from mta1.migadu.com (mta1.migadu.com [95.215.58.235]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8450.1787538169652705256 for ; Sun, 23 Aug 2026 19:22:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@linux.dev header.s=key1 header.b=DBllYQBV; spf=pass (domain: linux.dev, ip: 95.215.58.235, mailfrom: junjie.cao@linux.dev) X-Envelope-To: openembedded-core@lists.openembedded.org DKIM-Signature: a=rsa-sha256; bh=fn3Kt76z/ne0wvF+12NhERrQBvQKUU7HbJv4M0uxCt4=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787538167; v=1; x=1788142967; b=DBllYQBV5fYXWak4OIt3hsn+Hbll7vf0zNQgCoR6c/HXA8V321D4NtHFbBVfmVIYtF2bZUiO ozxBzqFFAjAUKWunO4AlUXzaZ6gynX0v418BqDB9dGqaYqjm0/XHOOu9/1IP+4VStQcgP35Q9bE 4NjtfjYVHWi0p8pSYH6dAnSA= X-Envelope-To: openembedded-core@lists.openembedded.org Received: from localhost (2408:8806:52:f8ea:5de6:8d95:1672:70f3) by smtp.migadu.com with ESMTPS id 5773324741d78868; Mon, 24 Aug 2026 02:22:47 +0000 X-Mizu-Trace-ID: 5773324741d78868 X-Migadu-Flow: FLOW_OUT From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v4 2/8] cve-exclusions: set status for CVE-2021-3714 Date: Sun, 23 Aug 2026 23:21:17 -0500 Message-ID: <20260824042123.1456876-3-junjie.cao@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824042123.1456876-1-junjie.cao@linux.dev> References: <20260824042123.1456876-1-junjie.cao@linux.dev> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 02:22:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244048 KSM merges identical anonymous pages across processes. An attacker who can place chosen page-sized content in a victim's memory can detect the merge through the timing of the resulting copy-on-write fault, and so leak memory contents. There is no upstream fix; removing the side channel means removing deduplication. Distribution trackers describe it the same way - Debian marks src:linux unfixed with "Inherent design limitation, can be avoided by not using KSM", Red Hat closed its bug WONTFIX, and Ubuntu records no upstream fix as of 2024-06-17: https://security-tracker.debian.org/tracker/CVE-2021-3714 https://bugzilla.redhat.com/show_bug.cgi?id=1931327 https://ubuntu.com/security/CVE-2021-3714 CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v4: - use the review's comment and status wording; drop the KSM runtime opt-in paragraph v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index b2eb15d0..36643ccc 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -197,3 +197,12 @@ CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3" # https://ubuntu.com/security/CVE-2019-14899 CVE_STATUS[CVE-2019-14899] = "unpatched: Consequence of the default weak host \ model, no upstream fix" + +# Triaged August 2026 - no upstream fix, Debian says "Inherent design +# limitation, can be avoided by not using KSM", Red Hat closed their bug as +# WONTFIX. +# https://security-tracker.debian.org/tracker/CVE-2021-3714 +# https://bugzilla.redhat.com/show_bug.cgi?id=1931327 +# https://ubuntu.com/security/CVE-2021-3714 +CVE_STATUS[CVE-2021-3714] = "unpatched: Timing side channel inherent to Kernel \ +Same-page Merging (KSM) page deduplication" From patchwork Mon Aug 24 04:21:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 96119 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E28D1C5DF8C for ; Mon, 24 Aug 2026 02:23:02 +0000 (UTC) Received: from mta1.migadu.com (mta1.migadu.com [95.215.58.236]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8451.1787538176580053917 for ; Sun, 23 Aug 2026 19:22:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@linux.dev header.s=key1 header.b=oF7z9yh0; spf=pass (domain: linux.dev, ip: 95.215.58.236, mailfrom: junjie.cao@linux.dev) X-Envelope-To: openembedded-core@lists.openembedded.org DKIM-Signature: a=rsa-sha256; bh=fidx4U7jtJX+oa/JHY2O2XZVSFhB4JydMSGAvpIvV2I=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787538174; v=1; x=1788142974; b=oF7z9yh0HfGhBcpCakaADxOfm/N86ILZsLKUsZyvPd9bJtCGxs/4sBF2Hqlw9KgkSZ2yaL/d 1pCaqIG8fyptnTXhmA5/Tf7bqcMI+p27AcZsaWpwk6WxCxSIQQIH9naJqJbrCRW2R2AN3V+1tA0 i6NW8nPWC25fC62skBngEw2E= X-Envelope-To: openembedded-core@lists.openembedded.org Received: from localhost (2408:8806:52:f8ea:5de6:8d95:1672:70f3) by smtp.migadu.com with ESMTPS id 2db75e3871ae28aa; Mon, 24 Aug 2026 02:22:54 +0000 X-Mizu-Trace-ID: 2db75e3871ae28aa X-Migadu-Flow: FLOW_OUT From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v4 3/8] cve-exclusions: set status for CVE-2021-3864 Date: Sun, 23 Aug 2026 23:21:18 -0500 Message-ID: <20260824042123.1456876-4-junjie.cao@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824042123.1456876-1-junjie.cao@linux.dev> References: <20260824042123.1456876-1-junjie.cao@linux.dev> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 02:23:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244049 begin_new_exec() resets dumpability to owner-dumpable whenever the real and effective ids match at exec time. A binary exec'd by a setuid program that has already called setuid(0) therefore becomes dumpable as root, and with a relative core_pattern plus an attacker-controlled working directory the resulting core file can be dropped into a privileged directory such as /etc/logrotate.d. Full report with proof of concept: https://www.openwall.com/lists/oss-security/2021/10/20/2 Two fixes were proposed and neither was merged. Waiman Long's patch was judged "not a particularly effective mitigation" by Eric W. Biederman and the discussion went quiet by early 2022; Wander Lairson Costa's RFC v2 received design feedback and no v3 followed: https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/ https://lore.kernel.org/all/20211228170910.623156-1-wander@redhat.com/ CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v4: - use the review's comment and status wording; drop the coredump path analysis paragraph - quote Biederman's assessment verbatim v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 36643ccc..36920e2c 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -206,3 +206,11 @@ model, no upstream fix" # https://ubuntu.com/security/CVE-2021-3714 CVE_STATUS[CVE-2021-3714] = "unpatched: Timing side channel inherent to Kernel \ Same-page Merging (KSM) page deduplication" + +# Triaged August 2026 - Two fixes proposed upstream but neither was merged, +# attempts to fix seem to have petered out. Unfixed in Debian/Ubuntu. +# https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/ +# https://lore.kernel.org/all/20211228170910.623156-1-wander@redhat.com/ +# https://security-tracker.debian.org/tracker/CVE-2021-3864 +# https://ubuntu.com/security/CVE-2021-3864 +CVE_STATUS[CVE-2021-3864] = "unpatched: Proposed fixes were not merged upstream" From patchwork Mon Aug 24 04:21:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 96120 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09607C5DF97 for ; Mon, 24 Aug 2026 02:23:13 +0000 (UTC) Received: from mta0.migadu.com (mta0.migadu.com [91.218.175.91]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.8497.1787538183585360629 for ; Sun, 23 Aug 2026 19:23:03 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@linux.dev header.s=key1 header.b=J1H4PuN9; spf=pass (domain: linux.dev, ip: 91.218.175.91, mailfrom: junjie.cao@linux.dev) X-Envelope-To: openembedded-core@lists.openembedded.org DKIM-Signature: a=rsa-sha256; bh=m2eZT6oy8fRj4bCNXbioLDgdUeaCWkG+Sqja1xEi4q8=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787538181; v=1; x=1788142981; b=J1H4PuN9hld5oI7yuJZQMN6c56FyUeBBZEbi2a2CPPPOJMwycTc+nU265rK6o7Fst0+93Ffc pcUWhQsENOylx6alZpyO9oQPRK8u3is4b1gJNAjWhkGtPZBmPhhI8pbA5mLbq39B8BDzYzqGI/B 7Hm8mgJQ9wbzJmcD3pEoYXC4= X-Envelope-To: openembedded-core@lists.openembedded.org Received: from localhost (2408:8806:52:f8ea:5de6:8d95:1672:70f3) by smtp.migadu.com with ESMTPS id 386e441e906ce66b; Mon, 24 Aug 2026 02:23:01 +0000 X-Mizu-Trace-ID: 386e441e906ce66b X-Migadu-Flow: FLOW_OUT From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v4 4/8] cve-exclusions: set status for CVE-2022-1247 Date: Sun, 23 Aug 2026 23:21:19 -0500 Message-ID: <20260824042123.1456876-5-junjie.cao@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824042123.1456876-1-junjie.cao@linux.dev> References: <20260824042123.1456876-1-junjie.cao@linux.dev> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 02:23:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244050 The CVE describes a race between rose_connect() and the code that frees a rose_neigh once its count and use fields reach zero. The race in the original report [1] is the one fixed independently in v6.17 by the rose_neigh refcount conversion: https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061 ("net: rose: convert 'use' field to refcount_t", v6.17) https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45 ("net: rose: include node references in rose_neigh refcount", v6.17) The Linux kernel CVE team assigned these commits CVE-2025-39826 and CVE-2025-39827. [1] https://bugzilla.redhat.com/show_bug.cgi?id=2066799 CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v4: - simplify the explanation as suggested; reference the original report instead of arguing from the commit diffs v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 36920e2c..a9b4d9a2 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -214,3 +214,11 @@ Same-page Merging (KSM) page deduplication" # https://security-tracker.debian.org/tracker/CVE-2021-3864 # https://ubuntu.com/security/CVE-2021-3864 CVE_STATUS[CVE-2021-3864] = "unpatched: Proposed fixes were not merged upstream" + +# net/rose and rose_connect() were removed entirely in v7.1 (dd8d4bc28ad7). +# The 6.18 kernel on master still carries net/rose; there the race is +# closed by the v6.17 refcount conversion, which upstream tracks as +# CVE-2025-39826 / CVE-2025-39827. +# Fix https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061 +# Fix https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45 +CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" From patchwork Mon Aug 24 04:21:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 96121 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2B01C5DF8C for ; Mon, 24 Aug 2026 02:23:12 +0000 (UTC) Received: from mta0.migadu.com (mta0.migadu.com [91.218.175.94]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8454.1787538190246982376 for ; Sun, 23 Aug 2026 19:23:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@linux.dev header.s=key1 header.b=H7bXPWX0; spf=pass (domain: linux.dev, ip: 91.218.175.94, mailfrom: junjie.cao@linux.dev) X-Envelope-To: openembedded-core@lists.openembedded.org DKIM-Signature: a=rsa-sha256; bh=pGsGDpWg+aHZqf4+4vY7kYtTtruOeEcGmceQZURz7Nc=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787538188; v=1; x=1788142988; b=H7bXPWX0S8/bu9LF6a7oS/rCF2AeI/ij/MYF9+8FdaEQMFuFvH91p69bmBeuir02QIenaaOY uEKHwrdeaxdXTvyUOdyc2O6G0E0XB9+eyyxSy2sxhv/4cfE1sF+f/bizMweJrDu0vhyPWD8RVFj lqOifujc4qVEKSg5oGz8NjJ4= X-Envelope-To: openembedded-core@lists.openembedded.org Received: from localhost (2408:8806:52:f8ea:5de6:8d95:1672:70f3) by smtp.migadu.com with ESMTPS id a42adbead9210cca; Mon, 24 Aug 2026 02:23:08 +0000 X-Mizu-Trace-ID: a42adbead9210cca X-Migadu-Flow: FLOW_OUT From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v4 5/8] cve-exclusions: set status for CVE-2022-4543 Date: Sun, 23 Aug 2026 23:21:20 -0500 Message-ID: <20260824042123.1456876-6-junjie.cao@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824042123.1456876-1-junjie.cao@linux.dev> References: <20260824042123.1456876-1-junjie.cao@linux.dev> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 02:23:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244051 KPTI clones the kernel entry text into the user page tables at its KASLR-slid address and, on CPUs with PGE, sets the global bit on those entries. The translation survives the CR3 write on kernel exit, and a local attacker can time prefetch instructions across the kernel range to recover the KASLR base in under a second. Disclosure and write-up: https://www.openwall.com/lists/oss-security/2022/12/16/3 https://www.willsroot.io/2022/12/entrybleed.html The disclosure states that after discussion with security@kernel.org and linux-distros "a fix for this is currently not available", and none has appeared since; arch/x86/mm/pti.c still clones the entry text and sets _PAGE_GLOBAL on the cloned mapping. Debian notes "Ignored upstream and KASLR is not expected to be resistant to local attacks"; Ubuntu has the fix deferred since 2023-01-10: https://security-tracker.debian.org/tracker/CVE-2022-4543 https://ubuntu.com/security/CVE-2022-4543 CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v4: - use the review's comment and status wording; drop the cpu_entry_area commit reference - tighten the mechanism wording and the timing claim to match the cited sources v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index a9b4d9a2..4318fc79 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -222,3 +222,12 @@ CVE_STATUS[CVE-2021-3864] = "unpatched: Proposed fixes were not merged upstream" # Fix https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061 # Fix https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45 CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" + +# Triaged August 2026 - "EntryBleed", discussed with the kernel security team +# but no fix appears to have been published since then. Debian says "Ignored +# upstream and KASLR is not expected to be resistant to local attacks", fix +# deferred in Ubuntu. +# https://www.openwall.com/lists/oss-security/2022/12/16/3 +# https://security-tracker.debian.org/tracker/CVE-2022-4543 +# https://ubuntu.com/security/CVE-2022-4543 +CVE_STATUS[CVE-2022-4543] = "unpatched: No fix has been proposed" From patchwork Mon Aug 24 04:21:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 96122 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E08E5C5DF97 for ; Mon, 24 Aug 2026 02:23:22 +0000 (UTC) Received: from mta0.migadu.com (mta0.migadu.com [91.218.175.98]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.8500.1787538197634567540 for ; Sun, 23 Aug 2026 19:23:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@linux.dev header.s=key1 header.b=O/s1COKG; spf=pass (domain: linux.dev, ip: 91.218.175.98, mailfrom: junjie.cao@linux.dev) X-Envelope-To: openembedded-core@lists.openembedded.org DKIM-Signature: a=rsa-sha256; bh=CSlll7AdLE98TBmmVIe0thr3faY5DopwGjR0uRMpTQA=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787538195; v=1; x=1788142995; b=O/s1COKGjz9gMd2KWv/gPWbymrl8+wKQ2wRyH52wVVNqT6pd6pNxQvyjVI3UUqgUSBmatfa5 c4Zfz24D5Wa/lyDPVbPyFLiAuH8WTGr5K/JZlVoGhHeIpV8Aj9nzMB8w1uffB/PI6uUAgZldUtS MDNDAn6CZFCpaIX7orQ2sD2E= X-Envelope-To: openembedded-core@lists.openembedded.org Received: from localhost (2408:8806:52:f8ea:5de6:8d95:1672:70f3) by smtp.migadu.com with ESMTPS id 26be0d46bcbf65e0; Mon, 24 Aug 2026 02:23:15 +0000 X-Mizu-Trace-ID: 26be0d46bcbf65e0 X-Migadu-Flow: FLOW_OUT From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v4 6/8] cve-exclusions: set status for CVE-2023-3397 Date: Sun, 23 Aug 2026 23:21:21 -0500 Message-ID: <20260824042123.1456876-7-junjie.cao@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824042123.1456876-1-junjie.cao@linux.dev> References: <20260824042123.1456876-1-junjie.cao@linux.dev> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 02:23:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244052 txEnd() in fs/jfs/jfs_txnmgr.c reads the log pointer from the superblock info, drops TXN_LOCK and then takes log->gclock, while lmLogClose() can free that log during umount. No fix has been merged. The 2023 proposal was withdrawn by its author ("I think my fix method is not a good solution"), and proposals in 2026 for similar jfs slab use-after-free races are unreviewed: https://lore.kernel.org/all/20230515095956.17898-1-zyytlz.wz@163.com/ https://lore.kernel.org/all/20260505123330.2822833-1-tristmd@gmail.com/ https://lore.kernel.org/all/20260603171620.2532527-1-jie.wang@intel.com/ A similar use-after-free was reported against 7.0-rc1 in June 2026, with the free stack in lmLogClose() via jfs_umount(), and syzbot has an open slab use-after-free write in lmLogSync(); the txEnd() sequence is unchanged in linux-next 20260727: https://lore.kernel.org/all/6a3eedfa.fd822575.2d6b21.e180@mx.google.com/ https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v4: - describe the 2026 proposals and reports as similar races rather than the same one; drop the kernel-cache configuration paragraph; use the review's comment and status wording - name the open syzbot bug as the lmLogSync write rather than the txEnd write v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 4318fc79..a133bf08 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -231,3 +231,12 @@ CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" # https://security-tracker.debian.org/tracker/CVE-2022-4543 # https://ubuntu.com/security/CVE-2022-4543 CVE_STATUS[CVE-2022-4543] = "unpatched: No fix has been proposed" + +# Triaged August 2026 - Originally proposed fix was withdrawn, similar +# slab-use-after-free appears to have been re-found by syzkaller in 2026. +# Unfixed in Debian, "needs evaluation" in Ubuntu. +# https://lore.kernel.org/lkml/CAJedcCzmx02bfa22QezE8mu-iDsSdSy_oApT2ozCWO8O-8MJEQ@mail.gmail.com/ +# https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb +# https://security-tracker.debian.org/tracker/CVE-2023-3397 +# https://ubuntu.com/security/CVE-2023-3397 +CVE_STATUS[CVE-2023-3397] = "unpatched: Proposed fix was withdrawn" From patchwork Mon Aug 24 04:21:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 96123 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF00FC5DF8C for ; Mon, 24 Aug 2026 02:23:32 +0000 (UTC) Received: from mta0.migadu.com (mta0.migadu.com [91.218.175.101]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.8502.1787538205209437363 for ; Sun, 23 Aug 2026 19:23:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@linux.dev header.s=key1 header.b=k8CRj9vl; spf=pass (domain: linux.dev, ip: 91.218.175.101, mailfrom: junjie.cao@linux.dev) X-Envelope-To: openembedded-core@lists.openembedded.org DKIM-Signature: a=rsa-sha256; bh=KuMDP1LgrOZ/zEuqpbHDNKCjoPiy9m8vEeMlCOmT9vY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787538203; v=1; x=1788143003; b=k8CRj9vl2b/vdlKeAZMW+ngGuNTBm9BcfkwvwEPdmPzkVoBq+nRK7sBYf2/J48O2uTJG9rmv SbvnSEapB3lJBettYYV/0SnxxxGERGljGy86KTABHQsm2SYI2pqfsYqX9qfp5QYmI46vJ/Q/LbN HaMiYl8/PiafJaIQzc2EzYN8= X-Envelope-To: openembedded-core@lists.openembedded.org Received: from localhost (2408:8806:52:f8ea:5de6:8d95:1672:70f3) by smtp.migadu.com with ESMTPS id d89bb3072466822a; Mon, 24 Aug 2026 02:23:23 +0000 X-Mizu-Trace-ID: d89bb3072466822a X-Migadu-Flow: FLOW_OUT From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v4 7/8] cve-exclusions: set status for CVE-2023-6238 Date: Sun, 23 Aug 2026 23:21:22 -0500 Message-ID: <20260824042123.1456876-8-junjie.cao@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824042123.1456876-1-junjie.cao@linux.dev> References: <20260824042123.1456876-1-junjie.cao@linux.dev> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 02:23:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244053 NVME_IOCTL_IO_CMD and the io_uring passthrough path have never checked the user-supplied metadata length against the number of blocks and the namespace metadata size that the device uses to size the transfer, so the device can DMA past the end of the buffer. 855b7717f44b ("nvme: fine-granular CAP_SYS_ADMIN for nvme io commands", v6.2) let users with write access to the device node issue the ioctl, turning the missing check into an exposure; kernels before v6.2 are not affected, as Debian concluded independently: https://security-tracker.debian.org/tracker/CVE-2023-6238 A fix removing unprivileged passthrough was proposed but not merged to mainline, and nvme_map_user_request() still passes the metadata length to blk_rq_integrity_map_user() with no cross-check: https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/ CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v4: - rework the explanation around 855b7717f44b making the ioctl reachable, per review; drop the applied-then-backed-out narrative - status reads "Proposed fix was not merged" rather than "withdrawn", as flagged on the v3 thread: the fix was backed out by the nvme maintainer, not withdrawn by its author v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index a133bf08..4729191a 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -240,3 +240,13 @@ CVE_STATUS[CVE-2022-4543] = "unpatched: No fix has been proposed" # https://security-tracker.debian.org/tracker/CVE-2023-3397 # https://ubuntu.com/security/CVE-2023-3397 CVE_STATUS[CVE-2023-3397] = "unpatched: Proposed fix was withdrawn" + +# Triaged August 2026 - Issue was introduced by kernel commit 855b7717f44b +# ("nvme: fine-granular CAP_SYS_ADMIN for nvme io commands") in Linux v6.2. +# Linux 6.1 and earlier not affected. Unfixed in recent Debian/Ubuntu releases +# which use affected kernels. There was a fix proposed, but it was not merged +# to mainline. +# https://security-tracker.debian.org/tracker/CVE-2023-6238 +# https://ubuntu.com/security/CVE-2023-6238 +# https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/ +CVE_STATUS[CVE-2023-6238] = "unpatched: Proposed fix was not merged" From patchwork Mon Aug 24 04:21:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 96124 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF4E4C5DF97 for ; Mon, 24 Aug 2026 02:23:42 +0000 (UTC) Received: from mta0.migadu.com (mta0.migadu.com [91.218.175.104]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8457.1787538213511796482 for ; Sun, 23 Aug 2026 19:23:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@linux.dev header.s=key1 header.b=siSW86hx; spf=pass (domain: linux.dev, ip: 91.218.175.104, mailfrom: junjie.cao@linux.dev) X-Envelope-To: openembedded-core@lists.openembedded.org DKIM-Signature: a=rsa-sha256; bh=YuzcV3cpAkWBYxsF++ENJKXzEd/h+DU4NZgBxOQCE3g=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787538211; v=1; x=1788143011; b=siSW86hxVNC9AXhMD7LChTQQPyhNx2C3LJdbXAJF6/YiG9nwOq+yEro6FsE+TmGe/P6z+c/5 xjSd9csU8TG843xOL0Q01LnhMv6dWbnojVm6IOATOS9ju0CpNWOcsULq1JCTd8l8aKS6rf1QvaN N3avmHa3sHoWGn/poW343fPU= X-Envelope-To: openembedded-core@lists.openembedded.org Received: from localhost (2408:8806:52:f8ea:5de6:8d95:1672:70f3) by smtp.migadu.com with ESMTPS id 71a6d3be8ebede7c; Mon, 24 Aug 2026 02:23:31 +0000 X-Mizu-Trace-ID: 71a6d3be8ebede7c X-Migadu-Flow: FLOW_OUT From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v4 8/8] cve-exclusions: set status for CVE-2023-6240 Date: Sun, 23 Aug 2026 23:21:23 -0500 Message-ID: <20260824042123.1456876-9-junjie.cao@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824042123.1456876-1-junjie.cao@linux.dev> References: <20260824042123.1456876-1-junjie.cao@linux.dev> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 02:23:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244054 "Marvin" is Hubert Kario's Bleichenbacher-style timing oracle research: https://people.redhat.com/~hkario/marvin/ The affected code is the generic software RSA PKCS#1 v1.5 unpadding in crypto/rsa-pkcs1pad.c. pkcs1pad_decrypt_complete() has three secret-dependent early exits (leading zero byte, block type, minimum padding length) and a loop whose trip count depends on the position of the separator, so the time taken reveals padding validity. There is no constant-time unpadding or implicit-rejection fallback in the tree. Red Hat classifies it CWE-203 and has shipped fixes only in RHEL errata (RHSA-2024:2758, RHSA-2024:3618 and others); the bugzilla is still NEW. Ubuntu records "appears unfixed in upstream as of 2024.08.24" and Debian lists src:linux vulnerable in all suites: https://access.redhat.com/security/cve/CVE-2023-6240 https://ubuntu.com/security/CVE-2023-6240 https://security-tracker.debian.org/tracker/CVE-2023-6240 CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v4: - drop the practical-exposure paragraph; use the review's comment and status wording - quote Ubuntu's note verbatim v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 4729191a..8714173c 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -250,3 +250,13 @@ CVE_STATUS[CVE-2023-3397] = "unpatched: Proposed fix was withdrawn" # https://ubuntu.com/security/CVE-2023-6238 # https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/ CVE_STATUS[CVE-2023-6238] = "unpatched: Proposed fix was not merged" + +# Triaged August 2026 - "Marvin" attack, Red Hat reports this fixed but the +# exact patch is unidentified (see RHSA-2024:2758, RHSA-2024:3618 & others). +# Unfixed in Debian, "Needs evaluation" in Ubuntu. +# https://people.redhat.com/~hkario/marvin/ +# https://access.redhat.com/security/cve/cve-2023-6240 +# https://security-tracker.debian.org/tracker/CVE-2023-6240 +# https://ubuntu.com/security/CVE-2023-6240 +CVE_STATUS[CVE-2023-6240] = "unpatched: Fixed in RHEL but patch not identified \ +publicly"