A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large gzip header extra field. This flaw is only applicable in the call inflateGetHeader.

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: require a full expif record in PDRINTERFACELIST

The PDRINTERFACELIST loop only checks that the record start is within the entry before reading an entire struct expif from it. A truncated trailing record makes the ifid/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak.

Advance only while a full record still fits in the entry.

In the Linux kernel, the following vulnerability has been resolved:

media: atomisp: gc2235: fix UAF and memory leak

gc2235probe() handles its error paths incorrectly.

If mediaentitypadsinit() fails, gc2235remove() is called, which tears down the subdev and frees dev, but then still falls through to atomispregisteri2cmodule(). This results in use-after-free.

If atomispregisteri2cmodule() fails, the media entity and control handler are left initialized and dev is leaked.

gc2235remove() unconditionally calls mediaentitycleanup() and v4l2ctrlhandlerfree(), but these are not initialized at every error path in gc2235probe().

Replace gc2235remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: publish GC-visible tuple last

nfflowtableiterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.

KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rhtdeferredworker, jhash, flowoffloaddel, flowoffloadlookup, etc.).

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device nodes but may lead to access heap memory behind perms->adm when an administrative CPRB is sent. Add correct limit (APDOMAINS = 256) checking to fix this.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: fix refcount bug in iwpmgetnlmsgrequest()

iwpmgetnlmsgrequest() initializes refcount after listaddtail() making it accessible to global list where another CPU can krefget() on nlmsgrequest causing a refcount "addition on 0" bug. Fix this by initializing kref before listaddtail() so refcount for nlmsgrequest can be incremented/decremented normally. In addition, also initialize every field before listaddtail().

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix tpm2loadcmd() boundary check

tpm2loadcmd() does boundary checks against the ASN.1 size i.e., payload->bloblen. Address this by passing the decoded blob size to tpm2loadcmd(), and use it for the boundary checks.

In the Linux kernel, the following vulnerability has been resolved:

wifi: virtwifi: free skb when disconnected

When the simulated link is disconnected, virtwifistartxmit() returns NETXMITDROP without freeing the skb. devhardstartxmit() treats this return value as consumed, so every packet sent while disconnected leaks its skb.

Free the skb before returning the drop status.

dmaengine: idxd: fix double free of wq, engine, and group structs

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix rlist race and missing initialization

TCPServerInfo.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making listempty() always return false and listadd() dereference a NULL ->prev pointer.

Also, cifssignalcifsdforreconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.

ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig->type

In the Linux kernel, the following vulnerability has been resolved:

wifi: virtwifi: don't transfer operstate before register

virtwifinewlink() calls netifstackedtransferoperstate() before registernetdevice(). If the lower device is dormant, that queues the new netdev on lweventlist while it is still uninitialized. If registration fails after that, for example because of an invalid name such as "bad/name", freenetdev() immediately frees the object. A later linkwatchfireevent() then use-after-frees the list entry.

Move the transfer to after netdevupperdevlink(), as macvlan and ipvlan already do.

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: check IP header size in cfg80211classify8021d()

A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly:

BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0 net/wireless/util.c:1027 cfg80211classify8021d+0x99d/0x12b0 net/wireless/util.c:1027 ieee80211selectqueue+0x37a/0x9e0 net/mac80211/wme.c:180 ieee80211subifstartxmit+0x60f/0x1d90 net/mac80211/tx.c:4304 ieee80211subifstartxmit+0xa8/0x6d0 net/mac80211/tx.c:4538 ... packetsendmsg+0x9173/0xa2a0 net/packet/afpacket.c:3108

Use skbheaderpointer() like the MPLS case.

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent lock owner use-after-free during client teardown

destroyclient() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on clownerstrhashtbl. clienthasstate() does not count a bare owner, so DESTROYCLIENTID can reach destroyclient() with such owners present.

destroyclient() then walks the table, calling removeblockedlocks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flcowner. The per-net laundromat reaps blocked locks from nn->blockedlockslru independently of client state. The two paths share blockedlockslock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as destroyclient() dereferences it, a NULL dereference in removeblockedlocks().

nfsd4releaselockowner() holds a reference across the same call; destroyclient() does not. Hold cllock across the walk, taking a reference and unhashing each owner, then drop it before removeblockedlocks() and nfs4putstateowner(), which take blockedlockslock and cllock.

btrfs: do not trim a device which is not writeable

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix endpoint/socket association handling

Disassociating a socket from an endpoint via siwsocketdisassoc() may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer after calling that function, but within.

This fixes a:

BUG: KASAN: slab-use-after-free in siwcmworkhandler (drivers/infiniband/sw/siw/siwcm.c:1053 drivers/infiniband/sw/siw/siwcm.c:1075)

which occurred after processing a malformed MPA request during connection establishment, causing the new endpoint to be closed.

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: validate curve data length in the calibration curve converters

p54convertrev0() and p54convertrev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54convertoutputlimits() and p54convertdb() already validate their counts against the entry length; this path was missed.

Reject the entry when the counts do not fit in the entry data.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Bound fragmented header copies by the remaining length

siwgethdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MINDDPHDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdupartrcvd. A later callback can then use a negative fpdupartrcvd value as a copy offset, which creates an OOB write.

Use the number of header bytes already received when calculating the next copy length.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: bound Read Response placement to the RREAD length

In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. siwchecksge() resolves and validates the sink memory only on the first fragment (the if (!mem) branch), and siwrrespcheckntoh() compares the cumulative length against wqe->bytes only on the final segment (the !frx->moreddpsegs guard).

A connected siw peer that answers an outstanding RREAD with Read Response segments that keep the DDP Last flag clear, carrying more total payload than the RREAD requested, drives wqe->processed past the validated sink buffer; the next siwrxdata() call writes out of bounds at sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP, so the peer is the remote end of an established RDMA connection and needs no local privilege.

Bound every segment before placement, exactly as siwprocsend() and siwprocwrite() already do for their tagged and untagged paths, and terminate the connection with a base-or-bounds DDP error when the Read Response would overrun the sink buffer.

This is the second receive-path length fix for this file. A separate change rejects an MPA FPDU length that underflows the per-fragment remainder in the header decode; that guard does not cover this case, because here each individual segment length is self-consistent and only the accumulated placement offset overruns the buffer.

ftrace: Add global mutex to serialize traceparser access

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Bound the early ACPI HID map

The ivrsacpihid command-line parser appends entries to a fixed four-element earlyacpihidmap array. Unlike the sibling IOAPIC and HPET parsers, it does not reject a fifth entry before incrementing the map size.

Check the capacity at the common found label before parsing the HID and UID or writing the entry.

arm64: hibernate: pass HVCSETVECTORS args to the resume hvc

In the Linux kernel, the following vulnerability has been resolved:

media: saa7134: Fix a possible memory leak in saa7134videoinit1

In saa7134videoinit1(), the return value of the first saa7134pgtablealloc() is not checked. If it fails, the function continues as if successful, leaving the driver with an invalid page table. Additionally, if vb2queueinit() for the VBI queue fails after the video queue page table has been allocated, the allocated memory is not freed before returning. The second saa7134pgtablealloc() also lacks a return value check. Errors occur during device probing before the device is fully registered, the normal cleanup path in saa7134finidev() is not executed, leading to memory leaks and potential use of uninitialized DMA resources.

Check the return value of both saa7134pgtablealloc() calls and propagate errors. On failure of any later step, free allocated page tables to avoid memory leaks. Ensure control handlers are also released on error to prevent further resource leakage.

Found by code review.

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: Fix potential UAF when ddgst mismatch

Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data transfer, the digest error handler in nvmettcptryrecvddgst() calls nvmetrequninit() — which performs percpurefput() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytesdone, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmettcpuninitdataincmds() iterates all commands, checks nvmettcpneeddatain() for each one, and finds that the already-uninited command still appears to need data (because rbytesdone < transferlen and cqe->status == 0). It therefore calls nvmetrequninit() a second time on the same command — a double percpurefput against a single percpurefget.

block: stop the timeout timer when releasing a never added disk

In the Linux kernel, the following vulnerability has been resolved:

mmc: hsq: Fix use-after-free in retry work

mmchsqpumprequests() queues retrywork when requestatomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements requestatomic(). The work is embedded in a devm-allocated mmchsq, but is never cancelled during driver removal. Work still pending at unbind can therefore run after the devm allocation has been released and dereference hsq->mmc and hsq->mrq.

Use devmworkautocancel() to cancel and drain retrywork before the devm allocation is released. By the time devres cleanup begins, mmcremovehost() has already stopped the host, so no new requests can arm the work.

This issue was found by an in-house static analysis tool.

In the Linux kernel, the following vulnerability has been resolved:

ipv6: seg6: clear IPv4 control block on IPIP decapsulation

End.DX4 and End.DT4 decapsulate an IPv4 packet through decapandvalidate() and send it directly to IPv4 routing. The inner packet therefore bypasses iprcvcore(), which normally clears IPCB before IPv4 interprets skb->cb.

The skb instead retains IP6CB data from the outer packet. IP6CB and IPCB use the same skb->cb storage, so IP6CB(skb)->lastopt overlaps IPCB(skb)->opt.optlen and srr, while IP6CB(skb)->nhoff overlaps rr and ts.

The sender can make the stale optlen byte nonzero with a valid outer extension-header chain. The reproducers put an eight-byte Destination Options header immediately after the 40-byte IPv6 header and before the Segment Routing Header. ipv6destoptrcv() records the sender-controlled Destination Options offset in both lastopt and nhoff, setting them to 40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees optlen = 40 and rr = 40.

Both tcpv4saveoptions() and ipoptionsecho() skip option copying when optlen is zero. Here optlen is 40, so the TCP SYN path allocates room for 40 bytes of option data and calls ipoptionsecho(). The stale rr value makes that function read inner packet byte 41 as the Record Route option length. The reproducers set that sender-controlled byte to 255, so ipoptionsecho() copies 255 bytes into the 40-byte option-data area.

Separate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5 kernel both produced:

BUG: KASAN: slab-out-of-bounds in ipoptionsecho() Write of size 255

The relevant End.DX4 call path is:

ipoptionsecho tcpv4routereq tcpconnrequest tcpv4connrequest tcprcvstateprocess tcpv4dorcv tcpv4rcv ipprotocoldeliverrcu iplocaldeliverfinish iplocaldeliver inputactionenddx4finish inputactionenddx4

The relevant End.DT4 call path is:

ipoptionsecho tcpv4routereq tcpconnrequest tcpv4connrequest tcprcvstateprocess tcpv4dorcv tcpv4rcv ipprotocoldeliverrcu iplocaldeliverfinish iplocaldeliver inputactionenddt4

tcpv4saveoptions() is inlined into the tcpv4routereq() path, so it does not appear as a separate frame.

When decapandvalidate() handles IPPROTOIPIP, save the ingress interface from IP6CB, clear IPCB, and restore the saved value. Doing this in the common decapsulation path covers End.DX4, End.DT4, and End.DT46's IPv4 arm.

Use IP6CB(skb)->iif rather than skb->skbiif. These actions run after l3mdev processing, which can replace skbiif with the L3 master; IP6CB iif still records the receiving interface set at IPv6 ingress.

In the Linux kernel, the following vulnerability has been resolved:

sctp: stop processing a packet once its association is deleted

sctpendpointbhrcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference.

A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and with the outqueue empty the SHUTDOWN ACK reaches sctpsfdo92final(), so the association and its transports are freed.

The endpoint loop has no counterpart to the asoc->base.dead check in sctpassocbhrcv(). The next chunk writes to lasttimeheard in the freed transport and is then passed to sctpdosm() with the freed association. The transport is freed through RCU, so this needs the packet to come off the socket backlog, where the loop runs in task context.

The endpoint loop cannot do the same check: it holds no reference on the association, so reading asoc->base.dead would itself be a use-after-free. Mark the packet for discard in the command interpreter, just before it deletes the association. That is also before sctpinqfree() releases the chunk on the association receive path.

sctpsfdo524dupcook() issues SCTPCMDDELETETCB for the temporary association, while the one the packet belongs to stays alive. A restarting peer can bundle DATA behind its COOKIE ECHO, so compare against chunk->asoc and leave that case alone.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix integer overflow in mrcheckrange() leading to OOB access

mrcheckrange() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic:

if (iova < mr->ibmr.iova || iova + length > mr->ibmr.iova + mr->ibmr.length)

A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxemriovatoindex() then computes a huge index (int idx, only guarded by WARNON) and rxemrcopyxarray() dereferences mr->pageinfo[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer.

Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow:

if (iova < mr->ibmr.iova || length > mr->ibmr.length || iova - mr->ibmr.iova > mr->ibmr.length - length)

With the fix, mrcheckrange() returns -EINVAL for the crafted iova and the responder reports REMOTEACCESSERROR instead of triggering the OOB.