[ciqcbr7_9] Multiple patches tested (4 commits) by ciq-kernel-automation[bot] · Pull Request #1626 · ctrliq/kernel-src-tree

ciq-kernel-automation · 2026-09-18T16:14:32Z

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

jira VULN-204563
cve CVE-2026-74597
commit-author Zhiling Zou <zhilinz@nebusec.ai>
commit f803c086399da277b5d0ff36a107d0f162751800

sctp: fix auth_hmacs array size in struct sctp_cookie

jira VULN-198551
cve CVE-2026-68376
commit-author Xin Long <lucien.xin@gmail.com>
commit e0b5252a59383b77d1b8dbeda00b7184dd95f4d3
upstream-diff This tree predates the sctp_paramhdr_t -> struct
  sctp_paramhdr conversion, so auth_random/auth_chunks keep the
  typedef form and only auth_hmacs is resized. The fix is the same:
  size the array as sizeof(paramhdr) + SCTP_AUTH_NUM_HMACS *
  sizeof(__u16) instead of the undersized ... + 2.

openvswitch: defer tunnel netdev_put to RCU release

jira VULN-182993
cve CVE-2026-31678
commit-author Yang Yang <n05ec@lzu.edu.cn>
commit 6931d21f87bc6d657f145798fad0bf077b82486c
upstream-diff This tree uses the single-argument rtnl_delete_link()
  and plain dev_put() instead of upstream's three-argument form and
  netdev_put() with dev_tracker. The fix is the same: drop the
  dev_put(vport->dev) and vport->dev = NULL from
  ovs_netdev_tunnel_destroy() so the reference is released in
  vport_netdev_free() after the RCU grace period.

net: bridge: stop fast-leave after deleting a port group

jira VULN-203046
cve CVE-2026-74480
commit-author Zhiling Zou <zhilinz@nebusec.ai>
commit a39789f211b8a4125f0c70e05b30cf715f4f187d
upstream-diff This tree open-codes the port-group deletion in the
  fast-leave path instead of calling br_multicast_del_pg(), and has
  no MDB_PG_FLAGS_FAST_LEAVE flag to set. The fix is the same: break
  out of the loop after the matching port group is removed, so the
  iteration does not continue through the freed entry's next pointer.

Test Results

✅ Build Stage

Status: Passed (x86_64)
Build Time: 9m 53s
Total Time: 10m 54s
View build logs

✅ Boot Verification

Status: Passed (x86_64)
View boot logs

🤖 This PR was automatically generated by GitHub Actions
Run ID: 35365000269

jira VULN-204563 cve CVE-2026-74597 commit-author Zhiling Zou <zhilinz@nebusec.ai> commit f803c08 ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack. Fixes: e490d1d ("[IPV6] IP6TUNNEL: Split out generic routine in ip6ip6_err().") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/fe1a5e765fbca88d69391887f0ed26a19e3e4d39.1785736562.git.zhilinz@nebusec.ai Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit f803c08) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-198551 cve CVE-2026-68376 commit-author Xin Long <lucien.xin@gmail.com> commit e0b5252 upstream-diff This tree predates the sctp_paramhdr_t -> struct sctp_paramhdr conversion, so auth_random/auth_chunks keep the typedef form and only auth_hmacs is resized. The fix is the same: size the array as sizeof(paramhdr) + SCTP_AUTH_NUM_HMACS * sizeof(__u16) instead of the undersized ... + 2. The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie. As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac(). Fix the array size calculation by including the full SCTP parameter header size. Fixes: 1f48564 ("[SCTP]: Implement SCTP-AUTH internals") Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Xin Liu <dstsmallbird@foxmail.com> Reported-by: Zihan Xi <xizh2024@lzu.edu.cn> Reported-by: Ren Wei <enjou1224z@gmail.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/634a0de0d5de29532915e6d47c92a0cbc206e03f.1783707155.git.lucien.xin@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit e0b5252) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-182993 cve CVE-2026-31678 commit-author Yang Yang <n05ec@lzu.edu.cn> commit 6931d21 upstream-diff This tree uses the single-argument rtnl_delete_link() and plain dev_put() instead of upstream's three-argument form and netdev_put() with dev_tracker. The fix is the same: drop the dev_put(vport->dev) and vport->dev = NULL from ovs_netdev_tunnel_destroy() so the reference is released in vport_netdev_free() after the RCU grace period. ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev. Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL. Fixes: a9020fd ("openvswitch: Move tunnel destroy function to oppenvswitch module.") Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Tested-by: Ao Zhou <n05ec@lzu.edu.cn> Co-developed-by: Yuan Tan <tanyuan98@outlook.com> Signed-off-by: Yuan Tan <tanyuan98@outlook.com> Suggested-by: Xin Liu <bird@lzu.edu.cn> Signed-off-by: Yang Yang <n05ec@lzu.edu.cn> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260319074241.3405262-1-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 6931d21) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-203046 cve CVE-2026-74480 commit-author Zhiling Zou <zhilinz@nebusec.ai> commit a39789f upstream-diff This tree open-codes the port-group deletion in the fast-leave path instead of calling br_multicast_del_pg(), and has no MDB_PG_FLAGS_FAST_LEAVE flag to set. The fix is the same: break out of the loop after the matching port group is removed, so the iteration does not continue through the freed entry's next pointer. br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry. Fixes: 6db6f0e ("bridge: multicast to unicast") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai> Signed-off-by: Ren Wei <enjou1224z@gmail.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/1cf0898872ef7c72d5f4c0304414a192c6dac591.1784707712.git.zhilinz@nebusec.ai Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit a39789f) Signed-off-by: Shreeya Patel <spatel@ciq.com>

github-actions · 2026-09-18T16:30:14Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/35368838787

github-actions · 2026-09-18T16:30:15Z

🔍 Upstream Linux Kernel Commit Check

⚠️ PR commit ea486c5944a1 (openvswitch: defer tunnel netdev_put to RCU release) references upstream commit
6931d21f87bc which has been referenced by a Fixes: tag in the upstream
Linux kernel:

    aa69918bd418 openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) (CVE-2026-46165)

This is an automated message from the kernel commit checker workflow.

github-actions · 2026-09-18T16:30:16Z

🔍 Interdiff Analysis

⚠️ PR commit 489f76603e19 (sctp: fix auth_hmacs array size in struct sctp_cookie) → upstream e0b5252a5938
Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -318,8 +318,7 @@
 	__u32 adaptation_ind;
 
 	__u8 auth_random[sizeof(sctp_paramhdr_t) + SCTP_AUTH_RANDOM_LENGTH];
-	__u8 auth_hmacs[sizeof(sctp_paramhdr_t) +
-			SCTP_AUTH_NUM_HMACS * sizeof(__u16)];
+	__u8 auth_hmacs[SCTP_AUTH_NUM_HMACS * sizeof(__u16) + 2];
 	__u8 auth_chunks[sizeof(sctp_paramhdr_t) + SCTP_AUTH_MAX_CHUNKS];
 
 	/* This is a shim for my peer's INIT packet, followed by

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -312,7 +312,8 @@
 
 	__u8 auth_random[sizeof(struct sctp_paramhdr) +
 			 SCTP_AUTH_RANDOM_LENGTH];
-	__u8 auth_hmacs[SCTP_AUTH_NUM_HMACS * sizeof(__u16) + 2];
+	__u8 auth_hmacs[sizeof(struct sctp_paramhdr) +
+			SCTP_AUTH_NUM_HMACS * sizeof(__u16)];
 	__u8 auth_chunks[sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS];
 
 	/* This is a shim for my peer's INIT packet, followed by

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -310,6 +309,7 @@
 
-	__u8 auth_random[sizeof(sctp_paramhdr_t) + SCTP_AUTH_RANDOM_LENGTH];
+	__u8 auth_random[sizeof(struct sctp_paramhdr) +
+			 SCTP_AUTH_RANDOM_LENGTH];
 	__u8 auth_hmacs[SCTP_AUTH_NUM_HMACS * sizeof(__u16) + 2];
-	__u8 auth_chunks[sizeof(sctp_paramhdr_t) + SCTP_AUTH_MAX_CHUNKS];
+	__u8 auth_chunks[sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS];
 
 	/* This is a shim for my peer's INIT packet, followed by

⚠️ PR commit ea486c5944a1 (openvswitch: defer tunnel netdev_put to RCU release) → upstream 6931d21f87bc
Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -188,6 +188,8 @@
 	 */
 	if (vport->dev->reg_state == NETREG_REGISTERED)
 		rtnl_delete_link(vport->dev);
+	dev_put(vport->dev);
+	vport->dev = NULL;
 	rtnl_unlock();
 
 	call_rcu(&vport->rcu, vport_netdev_free);

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -196,8 +196,6 @@
 	 */
 	if (vport->dev->reg_state == NETREG_REGISTERED)
 		rtnl_delete_link(vport->dev, 0, NULL);
-	netdev_put(vport->dev, &vport->dev_tracker);
-	vport->dev = NULL;
 	rtnl_unlock();
 
 	call_rcu(&vport->rcu, vport_netdev_free);

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -185,7 +185,7 @@
 	 */
 	if (vport->dev->reg_state == NETREG_REGISTERED)
-		rtnl_delete_link(vport->dev);
-	dev_put(vport->dev);
+		rtnl_delete_link(vport->dev, 0, NULL);
+	netdev_put(vport->dev, &vport->dev_tracker);
 	vport->dev = NULL;
 	rtnl_unlock();

⚠️ PR commit e39b201f234c (net: bridge: stop fast-leave after deleting a port group) → upstream a39789f211b8
Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -3687,6 +3687,7 @@
 
 			p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
 			br_multicast_del_pg(mp, p, pp);
+			break;
 		}
 		goto out;
 	}

This is an automated interdiff check for backported commits.

github-actions · 2026-09-18T16:31:05Z

JIRA PR Check Results

4 commit(s) with issues found:

Commit `e39b201f234c`

Summary: net: bridge: stop fast-leave after deleting a port group

❌ Errors:

VULN-203046: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-203046: No time logged - please log time manually

Commit `ea486c5944a1`

Summary: openvswitch: defer tunnel netdev_put to RCU release

❌ Errors:

VULN-182993: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-182993: No time logged - please log time manually

Commit `489f76603e19`

Summary: sctp: fix auth_hmacs array size in struct sctp_cookie

❌ Errors:

VULN-198551: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-198551: No time logged - please log time manually

Commit `617d652ee1e7`

Summary: ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

❌ Errors:

VULN-204563: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-204563: No time logged - please log time manually

Summary: Checked 4 commit(s) total.

github-actions · 2026-09-18T16:31:06Z

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/35368838787

bmastbergen · 2026-09-18T20:44:56Z

🔍 Upstream Linux Kernel Commit Check

⚠️ PR commit ea486c5944a1 (openvswitch: defer tunnel netdev_put to RCU release) references upstream commit
6931d21f87bc which has been referenced by a Fixes: tag in the upstream
Linux kernel:
    aa69918bd418 openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) (CVE-2026-46165)
This is an automated message from the kernel commit checker workflow.

Yea, we picked this up in all the other branches. Should pick it up here too.

shreeya-patel98 added 4 commits September 18, 2026 15:44

ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Sep 18, 2026

shreeya-patel98 requested review from a team September 18, 2026 16:39

PlaidCat assigned shreeya-patel98 Sep 18, 2026

Navigation Menu

[ciqcbr7_9] Multiple patches tested (4 commits) - #1626

[ciqcbr7_9] Multiple patches tested (4 commits)#1626
ciq-kernel-automation[bot] wants to merge 4 commits into
ciqcbr7_9from
{shreeya_nebusec}_ciqcbr7_9

ciq-kernel-automation Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

bmastbergen commented Sep 18, 2026

🔍 Upstream Linux Kernel Commit Check

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

ciq-kernel-automation Bot commented Sep 18, 2026

Summary

Commit Message(s)

Test Results

✅ Build Stage

✅ Boot Verification

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

🔍 Upstream Linux Kernel Commit Check

Uh oh!

github-actions Bot commented Sep 18, 2026

🔍 Interdiff Analysis

Uh oh!

github-actions Bot commented Sep 18, 2026

JIRA PR Check Results

Commit e39b201f234c

Commit ea486c5944a1

Commit 489f76603e19

Commit 617d652ee1e7

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

bmastbergen commented Sep 18, 2026

🔍 Upstream Linux Kernel Commit Check

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Commit `e39b201f234c`

Commit `ea486c5944a1`

Commit `489f76603e19`

Commit `617d652ee1e7`