Repository navigation
[ciqlts9_6] Multiple patches tested (4 commits) - #1686
Merged
Merged
Conversation
ciq-kernel-automation
Bot
added
the
created-by-kernelci
|
🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/38235490946 |
🔍 Diffofdiffs: 1 of 8 backports differs from upstreamOpen to anyone signed in to GitHub. Report expires 2027-01-10 10:09 UTC.
Checked PR revision |
|
✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/38235490946 |
added 4 commits
October 14, 2026 06:52
jira VULN-195914 cve CVE-2026-64385 commit-author Henrique Carvalho <[email protected]> commit f9bbadb A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. Fixes: 4f1fffa ("cifs: commands that are retried should have replay flag set") Cc: [email protected] Signed-off-by: Henrique Carvalho <[email protected]> Signed-off-by: Steve French <[email protected]> (cherry picked from commit f9bbadb) Signed-off-by: CIQ Kernel Automation <[email protected]>
jira VULN-195326 cve CVE-2026-64386 commit-author Henrique Carvalho <[email protected]> commit 2a88561 A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. Fixes: 4f1fffa ("cifs: commands that are retried should have replay flag set") Cc: [email protected] Signed-off-by: Henrique Carvalho <[email protected]> Signed-off-by: Steve French <[email protected]> (cherry picked from commit 2a88561) Signed-off-by: CIQ Kernel Automation <[email protected]>
jira VULN-205116 cve CVE-2026-74705 commit-author Xuanqiang Luo <[email protected]> commit d0f86fb __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid. Get the UDP header after the pull to avoid a potential use-after-free. Fixes: dbef491 ("udp: Use uh->len instead of skb->len to compute checksum in segmentation") Signed-off-by: Xuanqiang Luo <[email protected]> Reviewed-by: Antoine Tenart <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit d0f86fb) Signed-off-by: CIQ Kernel Automation <[email protected]>
jira VULN-216873 cve CVE-2026-80792 commit-author Luxiao Xu <[email protected]> commit d0d48d9 ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system. Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory. Fixes: e415ed3 ("ipv6: use skb_expand_head in ip6_finish_output2") Cc: [email protected] Reported-by: Vega <[email protected]> Signed-off-by: Luxiao Xu <[email protected]> Signed-off-by: Ren Wei <[email protected]> Reviewed-by: Vadim Fedorenko <[email protected]> Reviewed-by: Ido Schimmel <[email protected]> Link: https://patch.msgid.link/4aa3f53bc44e79572c6dd2340ec7b68ef1a3d87d.1786516730.git.rakukuip@gmail.com Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit d0d48d9) Signed-off-by: CIQ Kernel Automation <[email protected]>
ciq-kernel-automation
Bot
dismissed stale reviews from kerneltoast and bmastbergen
via
October 14, 2026 06:56
867941b
ciq-kernel-automation
Bot
force-pushed
the
{ciq_kernel_automation}_ciqlts9_6
branch
from
October 14, 2026 06:56
191f036 to
867941b
Compare
|
🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/38525894861 |
✅ Diffofdiffs: No differences foundCompared 4 backports with upstream. Checked PR revision |
|
✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/38525894861 |
ciq-kernel-automation
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR has been automatically created after successful completion of all CI stages.
Commit Message(s)
Test Results
✅ Build Stage
✅ Boot Verification
✅ Kernel Selftests
✅ LTP Results
🤖 This PR was automatically generated by GitHub Actions
Run ID: 38525354735