[rocky8_10] History Rebuild through kernel-4.18.0-553.141.1.el8_10#1428
Open
PlaidCat wants to merge 24 commits into
Open
[rocky8_10] History Rebuild through kernel-4.18.0-553.141.1.el8_10#1428PlaidCat wants to merge 24 commits into
PlaidCat wants to merge 24 commits into
Conversation
…le() jira KERNEL-1291 cve CVE-2026-43450 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Hyunwoo Kim <imv4bel@gmail.com> commit 6dcee84 nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0 Fixes: 12f7a50 ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> (cherry picked from commit 6dcee84) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…DALL jira KERNEL-1291 cve CVE-2026-46227 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Ben Morris <bmorris@anthropic.com> commit abb5f36 The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf(). While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the association cached in @tmp, migrating it to a new endpoint via sctp_sock_migrate() (list_del_init() + list_add_tail() to newep->asocs), and optionally close the new socket which frees the association via kfree_rcu(). The cached @tmp can also be freed by a network ABORT for that association, processed in softirq while the lock is dropped. sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing revalidates @tmp. After a successful return, the iterator advances to the stale @tmp, yielding either a use-after-free (if the peeled socket was closed) or a list-walk onto the new endpoint's list head (type confusion of &newep->asocs as a struct sctp_association *). Both are reachable from CapEff=0; the type-confusion path gives controlled indirect call via the outqueue.sched->init_sid pointer. Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc() returns. @asoc is known to still be on ep->asocs at that point: the only callers that list_del an association from ep->asocs are sctp_association_free() (which sets asoc->base.dead) and sctp_assoc_migrate() (which changes asoc->base.sk), and sctp_wait_for_sndbuf() checks both under the lock before any successful return; a tripped check propagates as err < 0 and the loop bails before the re-derive. The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so the @tmp cached by list_for_each_entry_safe() still covers the lock-held free that ba59fb0 ("sctp: walk the list of asoc safely") was added for. Fixes: 4910280 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") Cc: stable@vger.kernel.org Signed-off-by: Ben Morris <bmorris@anthropic.com> Acked-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/20260508001455.3137-1-joycathacker@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit abb5f36) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…nit_with_funcs() jira KERNEL-1291 cve CVE-2026-46209 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Ashutosh Desai <ashutoshdesai993@gmail.com> commit 3d4c226 drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mode_cmd->width / (i ? info->hsub : 1); unsigned int height = mode_cmd->height / (i ? info->vsub : 1); However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses drm_format_info_plane_width/height() which round up dimensions via DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object size check for certain pixel format and dimension combinations. For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the GEM size validation path sees height=0 instead of height=1. The expression (height - 1) then wraps to UINT_MAX as an unsigned int, causing min_size to overflow and wrap back to a small value. A tiny GEM object therefore passes the size guard, yet when the GPU accesses the chroma plane it will read or write memory beyond the object's bounds. Fix by replacing the open-coded divisions with drm_format_info_plane_width() and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match the calculation already used in framebuffer_check(). Fixes: 4c3dbb2 ("drm: Add GEM backed framebuffer library") Cc: stable@vger.kernel.org # v4.14+ Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260420013637.457751-1-ashutoshdesai993@gmail.com (cherry picked from commit 3d4c226) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…k_stat() jira KERNEL-1291 cve CVE-2026-46259 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Jinliang Zheng <alexjlzheng@tencent.com> commit 76149d5 When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng <alexjlzheng@tencent.com> Acked-by: Oleg Nesterov <oleg@redhat.com> Cc: David Hildenbrand <david@kernel.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Cc: Mateusz Guzik <mjguzik@gmail.com> Cc: ruippan <ruippan@tencent.com> Cc: Usama Arif <usamaarif642@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 76149d5) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1291 cve CVE-2026-43198 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Eric Dumazet <edumazet@google.com> commit 858d2a4 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context. Fixes: 1da177e ("Linux-2.6.12-rc2") Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/ Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 858d2a4) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/ipv6/tcp_ipv6.c
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Besar Wicaksono <bwicaksono@nvidia.com> commit f4d9d9d Add the part number and MIDR for Neoverse-V2 Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Reviewed-by: James Clark <james.clark@arm.com> Link: https://lore.kernel.org/r/20240109192310.16234-2-bwicaksono@nvidia.com Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit f4d9d9d) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland <mark.rutland@arm.com> commit 02a0a04 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed Add cputype definitions for Cortex-X4. These will be used for errata detection in subsequent patches. These values can be found in Table B-249 ("MIDR_EL1 bit descriptions") in issue 0002-05 of the Cortex-X4 TRM, which can be found at: https://developer.arm.com/documentation/102484/0002/?lang=en Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20240508081400.235362-3-mark.rutland@arm.com Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit 02a0a04) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/include/asm/cputype.h
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland <mark.rutland@arm.com> commit 0ce85db Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed Add cputype definitions for Neoverse-V3. These will be used for errata detection in subsequent patches. These values can be found in Table B-249 ("MIDR_EL1 bit descriptions") in issue 0001-04 of the Neoverse-V3 TRM, which can be found at: https://developer.arm.com/documentation/107734/0001/?lang=en Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20240508081400.235362-4-mark.rutland@arm.com Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit 0ce85db) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/include/asm/cputype.h
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland <mark.rutland@arm.com> commit be5a6f2 Add cputype definitions for Cortex-X3. These will be used for errata detection in subsequent patches. These values can be found in Table A-263 ("MIDR_EL1 bit descriptions") in issue 07 of the Cortex-X3 TRM, which can be found at: https://developer.arm.com/documentation/101593/0102/?lang=en Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20240603111812.1514101-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit be5a6f2) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland <mark.rutland@arm.com> commit fd2ff5f Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed Add cputype definitions for Cortex-X925. These will be used for errata detection in subsequent patches. These values can be found in Table A-285 ("MIDR_EL1 bit descriptions") in issue 0001-05 of the Cortex-X925 TRM, which can be found at: https://developer.arm.com/documentation/102807/0001/?lang=en Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20240603111812.1514101-4-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit fd2ff5f) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/include/asm/cputype.h
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland <mark.rutland@arm.com> commit 58d245e Add cputype definitions for Cortex-X1C. These will be used for errata detection in subsequent patches. These values can be found in the Cortex-X1C TRM: https://developer.arm.com/documentation/101968/0002/ ... in section B2.107 ("MIDR_EL1, Main ID Register, EL1"). Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will@kernel.org> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Link: https://lore.kernel.org/r/20240801101803.1982459-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit 58d245e) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Douglas Anderson <dianders@chromium.org> commit a9b5bd8 >From the TRM, MIDR_CORTEX_A76AE has a partnum of 0xDOE and an implementor of 0x41 (ARM). Add the values. Cc: stable@vger.kernel.org # dependency of the next fix in the series Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://lore.kernel.org/r/20250107120555.v4.4.I151f3b7ee323bcc3082179b8c60c3cd03308aa94@changeid Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit a9b5bd8) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland <mark.rutland@arm.com> commit 3bbf004 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed Add cputype definitions for Neoverse-V3AE. These will be used for errata detection in subsequent patches. These values can be found in the Neoverse-V3AE TRM: https://developer.arm.com/documentation/SDEN-2615521/9-0/ ... in section A.6.1 ("MIDR_EL1, Main ID Register"). Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit 3bbf004) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/include/asm/cputype.h
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Anshuman Khandual <anshuman.khandual@arm.com> commit 07e39e6 Add the CPU Partnumbers for the new Arm designs. Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will@kernel.org> Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: James Morse <james.morse@arm.com> Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com> Link: https://lore.kernel.org/r/20221116140915.356601-2-anshuman.khandual@arm.com Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit 07e39e6) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland <mark.rutland@arm.com> commit add332c Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed Add cputype definitions for Cortex-A720. These will be used for errata detection in subsequent patches. These values can be found in Table A-186 ("MIDR_EL1 bit descriptions") in issue 0002-05 of the Cortex-A720 TRM, which can be found at: https://developer.arm.com/documentation/102530/0002/?lang=en Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20240603111812.1514101-3-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit add332c) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/include/asm/cputype.h
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland <mark.rutland@arm.com> commit 9ef54a3 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed Add cputype definitions for Cortex-A725. These will be used for errata detection in subsequent patches. These values can be found in the Cortex-A725 TRM: https://developer.arm.com/documentation/107652/0001/ ... in table A-247 ("MIDR_EL1 bit descriptions"). Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will@kernel.org> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Link: https://lore.kernel.org/r/20240801101803.1982459-3-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit 9ef54a3) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/include/asm/cputype.h
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland <mark.rutland@arm.com> commit 9247257 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed Add cputype definitions for Neoverse-N3. These will be used for errata detection in subsequent patches. These values can be found in Table A-261 ("MIDR_EL1 bit descriptions") in issue 02 of the Neoverse-N3 TRM, which can be found at: https://developer.arm.com/documentation/107997/0000/?lang=en Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20240930111705.3352047-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit 9247257) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/include/asm/cputype.h
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> commit f38c2c3 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed Add cputype definitions for Cortex-A720AE. These will be used for errata detection in subsequent patches. These values can be found in the Cortex-A720AE TRM: https://developer.arm.com/documentation/102828/0001/ ... in Table A-187 Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit f38c2c3) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/include/asm/cputype.h
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Catalin Marinas <catalin.marinas@arm.com> commit 2c99561 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed Add cputype definitions for C1-Pro. These will be used for errata detection in subsequent patches. These values can be found in "Table A-303: MIDR_EL1 bit descriptions" in issue 07 of the C1-Pro TRM: https://documentation-service.arm.com/static/6930126730f8f55a656570af Acked-by: Mark Rutland <mark.rutland@arm.com> Cc: Will Deacon <will@kernel.org> Cc: James Morse <james.morse@arm.com> Reviewed-by: Will Deacon <will@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit 2c99561) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/include/asm/cputype.h
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Shanker Donthineni <sdonthineni@nvidia.com> commit e185c8a Add cpu part and model macro definitions for NVIDIA Olympus core. Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit e185c8a) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Easwar Hariharan <eahariha@linux.microsoft.com> commit fb091ff Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed Add the MIDR value of Microsoft Azure Cobalt 100, which is a Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and therefore suffers from all the same errata. CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Easwar Hariharan <eahariha@linux.microsoft.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Acked-by: Mark Rutland <mark.rutland@arm.com> Acked-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Oliver Upton <oliver.upton@linux.dev> Link: https://lore.kernel.org/r/20240214175522.2457857-1-eahariha@linux.microsoft.com Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit fb091ff) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # Documentation/arm64/silicon-errata.rst # arch/arm64/kernel/cpu_errata.c
jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Chanho Park <chanho61.park@samsung.com> commit 83bea32 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed Add the MIDR part number info for the Arm Cortex-A78AE[1] and add it to spectre-BHB affected list[2]. [1]: https://developer.arm.com/Processors/Cortex-A78AE [2]: https://developer.arm.com/Arm%20Security%20Center/Spectre-BHB Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Will Deacon <will@kernel.org> Cc: James Morse <james.morse@arm.com> Signed-off-by: Chanho Park <chanho61.park@samsung.com> Link: https://lore.kernel.org/r/20220407091128.8700-1-chanho61.park@samsung.com Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit 83bea32) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/arm64/kernel/proton-pack.c
jira KERNEL-1291 cve CVE-2026-43112 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Fredric Cover <FredTheDude@proton.me> commit 78ec5bf When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read. This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL. The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs. Signed-off-by: Fredric Cover <FredTheDude@proton.me> Reviewed-by: Henrique Carvalho <[2]henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com> (cherry picked from commit 78ec5bf) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
Rebuild_History BUILDABLE Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50% Number of commits in upstream range v4.18~1..kernel-mainline: 625874 Number of commits in rpm: 36 Number of commits matched with upstream: 25 (69.44%) Number of commits in upstream but not in rpm: 625851 Number of commits NOT found in upstream: 11 (30.56%) Rebuilding Kernel on Branch rocky8_10_rebuild_kernel-4.18.0-553.141.1.el8_10 for kernel-4.18.0-553.141.1.el8_10 Clean Cherry Picks: 11 (44.00%) Empty Cherry Picks: 12 (48.00%) _______________________________ Full Details Located here: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/rebuild.details.txt Includes: * git commit header above * Empty Commits with upstream SHA * RPM ChangeLog Entries that could not be matched Individual Empty Commit failures contained in the same containing directory. The git message for empty commits will have the path for the failed commit. File names are the first 8 characters of the upstream SHA
roxanan1996
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated kernel history rebuild using cron and internal tooling. It follows the same process used for previous history rebuilds:
src.rpmpackagessrc.rpm:4.18.0-553)git cherry-pickrpmbuild -bpfor the correspondingsrc.rpmJIRA Tickets
Rebuild Splat Inspection
kernel-4.18.0-553.141.1.el8_10
BUILD
KSelfTests