Skip to content

[ciqlts9_6] Multiple patches tested (4 commits) - #1625

Open
ciq-kernel-automation[bot] wants to merge 4 commits into
ciqlts9_6from
{maple}_ciqlts9_6
Open

[ciqlts9_6] Multiple patches tested (4 commits)#1625
ciq-kernel-automation[bot] wants to merge 4 commits into
ciqlts9_6from
{maple}_ciqlts9_6

Conversation

@ciq-kernel-automation

@ciq-kernel-automation ciq-kernel-automation Bot commented Sep 18, 2026

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

xfrm: ah6: validate routing header segments_left

jira VULN-211046
cve CVE-2026-80844
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 7bad4bda74dc4713f398d3b7624ff05478e3a568

net: tun: bound receive headroom

jira VULN-209972
cve CVE-2026-81000
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 447c9303942c439a117d9b76ce6d6e2116b38ee7

pppoe: reload header pointer after dev_hard_header()

jira VULN-197184
cve CVE-2026-68121
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit e9c238f6fe42fb1b4dba3a578277de32cb487937

sctp: prevent peer transport count overflow

jira VULN-207734
cve CVE-2026-74469
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit bd0e9289e2642f6a5c54faad304ce0f41e926d22

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 31m 6s 32m 2s
aarch64 18m 46s 19m 28s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 205 44 ciqlts9_6 ✅ No regressions
aarch64 153 46 ciqlts9_6 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1453 82 ciqlts9_6 ✅ No regressions
aarch64 1421 88 ciqlts9_6 ❌ 5 regressions

aarch64 regressions:

  • af_alg04 (PASS -> FAIL)
  • fcntl14 (PASS -> FAIL)
  • fcntl14_64 (PASS -> FAIL)
  • fork14 (PASS -> FAIL)
  • mmap16 (PASS -> FAIL)

🤖 This PR was automatically generated by GitHub Actions
Run ID: 35283769572

@PlaidCat
xfrm: ah6: validate routing header segments_left
773404f 
jira VULN-211046
cve CVE-2026-80844
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 7bad4bd

AH6 rearranges routing-header addresses before computing or verifying the
ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than
the number of addresses described by the routing header's hdrlen field.

That assumption does not hold for raw IPv6 HDRINCL packets. A packet with
hdrlen equal to 2 describes one address, but can carry an arbitrary
segments_left value. With segments_left equal to 255, the function moves
its address pointer 4,064 bytes backwards and passes a 4,064-byte length to
memmove(), resulting in an out-of-bounds access.

Validate the invariant locally before modifying the routing header or
performing any address-pointer arithmetic, and propagate malformed-header
errors to the existing AH6 input and output error paths.

Fixes: 1da177e ("Linux-2.6.12-rc2")
	Cc: stable@vger.kernel.org
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
	Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
	Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 7bad4bd)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat
net: tun: bound receive headroom
5bff367 
jira VULN-209972
cve CVE-2026-81000
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 447c930

tun_get_user() uses tun->align both as skb headroom and when choosing how
much packet data to keep linear. OVS can propagate an oversized headroom
request from another port to TUN or TAP.

When align is larger than the usable space in a one-page skb head,
SKB_MAX_HEAD(align) underflows and the result becomes negative when stored
in good_linear. That value later wraps when assigned to the size_t linear
variable, and tun_alloc_skb() can place skb->data outside the allocated
head.

Bound the headroom stored by TUN to the one-page skb-head budget and the
largest non-sentinel 16-bit skb header offset. Leave one linear byte for
raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.

Also pull the raw-TUN protocol byte and the TAP Ethernet header before
accessing them, so these checks remain safe for nonlinear skbs supplied by
other allocation paths.

Fixes: eaea34b ("net/tun: implement ndo_set_rx_headroom")
	Cc: stable@vger.kernel.org
	Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260812012139.2134643-1-manizada@pm.me
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 447c930)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat
pppoe: reload header pointer after dev_hard_header()
54725cf 
jira VULN-197184
cve CVE-2026-68121
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit e9c238f

pppoe_sendmsg() saves a pointer to the PPPoE header before calling
dev_hard_header(). Device header callbacks are allowed to reallocate the
skb head, invalidating pointers into it.

This can happen when a send is blocked in copy_from_user() while the first
non-Ethernet port is added to an empty team device. The team's delegated
GRE header callback then expands the skb head. PPPoE subsequently writes
six bytes through the stale pointer into the freed head.

Reload the PPPoE header through the skb's network-header offset after
device header creation. pskb_expand_head() updates that offset when it
relocates the head.

Fixes: 1da177e ("Linux-2.6.12-rc2")
	Cc: stable@vger.kernel.org
	Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
	Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
	Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260722093814.3017176-1-manizada@pm.me
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit e9c238f)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat
sctp: prevent peer transport count overflow
cc6f856 
jira VULN-207734
cve CVE-2026-74469
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit bd0e928

sctp_assoc_add_peer() increments the association's 16-bit transport_count
for every new unique peer. Adding the 65,536th transport wraps the count to
zero.

SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,
then copies one sockaddr_storage for every entry in transport_addr_list.
After the wrap, a diagnostic dump reserves an empty payload and writes
8 MiB of peer addresses past the skb tail.

Reject a new unique peer when transport_count has reached U16_MAX. Perform
the check after the existing-peer lookup so a duplicate address continues
to return its existing transport at the limit.

Fixes: 8f840e4 ("sctp: add the sctp_diag.c file")
	Cc: stable@vger.kernel.org
	Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
	Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20260725032053.521705-1-manizada@pm.me
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit bd0e928)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Sep 18, 2026
@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/35304809699

@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/35304809699

@shreeya-patel98
shreeya-patel98 requested review from a team September 18, 2026 11:02
bmastbergen
bmastbergen approved these changes Sep 18, 2026
View reviewed changes

@bmastbergen bmastbergen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@PlaidCat PlaidCat self-assigned this Sep 18, 2026
kerneltoast
kerneltoast approved these changes Sep 19, 2026
View reviewed changes

@kerneltoast kerneltoast left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚢

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kerneltoast kerneltoast kerneltoast approved these changes
@bmastbergen bmastbergen bmastbergen approved these changes
@shreeya-patel98 shreeya-patel98 shreeya-patel98 approved these changes

Assignees

@PlaidCat PlaidCat

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@kerneltoast @bmastbergen @shreeya-patel98 @PlaidCat