Skip to content

[LTS 9.6] CVE-2026-31402, CVE-2026-23066, CVE-2026-23097, CVE-2026-23171 #1248

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pvts-mat wants to merge 4 commits into
base: ciqlts9_6
Choose a base branch
from
Open

[LTS 9.6] CVE-2026-31402, CVE-2026-23066, CVE-2026-23097, CVE-2026-23171 #1248

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
55d4230
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
pvts-mat Feb 24, 2026
101cbf4
rxrpc: Fix recvmsg() unconditional requeue
pvts-mat Feb 26, 2026
f0c0e2c
migrate: correct lock ordering for hugetlb file folios
pvts-mat Jan 9, 2026
7a58277
bonding: fix use-after-free due to enslave fail after slave array update
pvts-mat Jan 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions drivers/net/bonding/bond_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2361,10 +2361,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
unblock_netpoll_tx();
}

if (bond_mode_can_use_xmit_hash(bond))
bond_update_slave_arr(bond, NULL);


if (!slave_dev->netdev_ops->ndo_bpf ||
!slave_dev->netdev_ops->ndo_xdp_xmit) {
if (bond->xdp_prog) {
Expand Down Expand Up @@ -2398,6 +2394,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
bpf_prog_inc(bond->xdp_prog);
}

if (bond_mode_can_use_xmit_hash(bond))
bond_update_slave_arr(bond, NULL);

bond_xdp_set_features(bond_dev);

slave_info(bond_dev, slave_dev, "Enslaving as %s interface with %s link\n",
Expand Down
9 changes: 7 additions & 2 deletions fs/nfsd/nfs4xdr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5785,9 +5785,14 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
int len = xdr->buf->len - post_err_offset;

so->so_replay.rp_status = op->status;
so->so_replay.rp_buflen = len;
read_bytes_from_xdr_buf(xdr->buf, post_err_offset,
if (len <= NFSD4_REPLAY_ISIZE) {
so->so_replay.rp_buflen = len;
read_bytes_from_xdr_buf(xdr->buf,
post_err_offset,
so->so_replay.rp_buf, len);
} else {
so->so_replay.rp_buflen = 0;
}
}
status:
*p = op->status;
Expand Down
17 changes: 12 additions & 5 deletions fs/nfsd/state.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -472,11 +472,18 @@ struct nfs4_client_reclaim {
struct xdr_netobj cr_princhash;
};

/* A reasonable value for REPLAY_ISIZE was estimated as follows:
* The OPEN response, typically the largest, requires
* 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) + 8(verifier) +
* 4(deleg. type) + 8(deleg. stateid) + 4(deleg. recall flag) +
* 20(deleg. space limit) + ~32(deleg. ace) = 112 bytes
/*
* REPLAY_ISIZE is sized for an OPEN response with delegation:
* 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) +
* 8(verifier) + 4(deleg. type) + 8(deleg. stateid) +
* 4(deleg. recall flag) + 20(deleg. space limit) +
* ~32(deleg. ace) = 112 bytes
*
* Some responses can exceed this. A LOCK denial includes the conflicting
* lock owner, which can be up to 1024 bytes (NFS4_OPAQUE_LIMIT). Responses
* larger than REPLAY_ISIZE are not cached in rp_ibuf; only rp_status is
* saved. Enlarging this constant increases the size of every
* nfs4_stateowner.
*/

#define NFSD4_REPLAY_ISIZE 112
Expand Down
4 changes: 4 additions & 0 deletions include/trace/events/rxrpc.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,6 +273,7 @@
EM(rxrpc_call_put_kernel, "PUT kernel ") \
EM(rxrpc_call_put_poke, "PUT poke ") \
EM(rxrpc_call_put_recvmsg, "PUT recvmsg ") \
EM(rxrpc_call_put_recvmsg_peek_nowait, "PUT peek-nwt") \
EM(rxrpc_call_put_release_sock, "PUT rls-sock") \
EM(rxrpc_call_put_release_sock_tba, "PUT rls-sk-a") \
EM(rxrpc_call_put_sendmsg, "PUT sendmsg ") \
Expand All @@ -287,6 +288,9 @@
EM(rxrpc_call_see_disconnected, "SEE disconn ") \
EM(rxrpc_call_see_distribute_error, "SEE dist-err") \
EM(rxrpc_call_see_input, "SEE input ") \
EM(rxrpc_call_see_recvmsg_requeue, "SEE recv-rqu") \
EM(rxrpc_call_see_recvmsg_requeue_first, "SEE recv-rqF") \
EM(rxrpc_call_see_recvmsg_requeue_move, "SEE recv-rqM") \
EM(rxrpc_call_see_release, "SEE release ") \
EM(rxrpc_call_see_userid_exists, "SEE u-exists") \
E_(rxrpc_call_see_zap, "SEE zap ")
Expand Down
12 changes: 6 additions & 6 deletions mm/migrate.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1385,6 +1385,7 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio,
int page_was_mapped = 0;
struct anon_vma *anon_vma = NULL;
struct address_space *mapping = NULL;
enum ttu_flags ttu = 0;

if (folio_ref_count(src) == 1) {
/* page was freed from under us. So we are done. */
Expand Down Expand Up @@ -1426,8 +1427,6 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio,
goto put_anon;

if (folio_mapped(src)) {
enum ttu_flags ttu = 0;

if (!folio_test_anon(src)) {
/*
* In shared mappings, try_to_unmap could potentially
Expand All @@ -1444,17 +1443,18 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio,

try_to_migrate(src, ttu);
page_was_mapped = 1;

if (ttu & TTU_RMAP_LOCKED)
i_mmap_unlock_write(mapping);
}

if (!folio_mapped(src))
rc = move_to_new_folio(dst, src, mode);

if (page_was_mapped)
remove_migration_ptes(src,
rc == MIGRATEPAGE_SUCCESS ? dst : src, false);
rc == MIGRATEPAGE_SUCCESS ? dst : src,
ttu ? true : false);

if (ttu & TTU_RMAP_LOCKED)
i_mmap_unlock_write(mapping);

unlock_put_anon:
folio_unlock(dst);
Expand Down
19 changes: 15 additions & 4 deletions net/rxrpc/recvmsg.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -415,7 +415,8 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
if (rxrpc_call_has_failed(call))
goto call_failed;

if (!skb_queue_empty(&call->recvmsg_queue))
if (!(flags & MSG_PEEK) &&
!skb_queue_empty(&call->recvmsg_queue))
rxrpc_notify_socket(call);
goto not_yet_complete;

Expand Down Expand Up @@ -446,11 +447,21 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
error_requeue_call:
if (!(flags & MSG_PEEK)) {
spin_lock(&rx->recvmsg_lock);
list_add(&call->recvmsg_link, &rx->recvmsg_q);
spin_unlock(&rx->recvmsg_lock);
if (list_empty(&call->recvmsg_link)) {
list_add(&call->recvmsg_link, &rx->recvmsg_q);
rxrpc_see_call(call, rxrpc_call_see_recvmsg_requeue);
spin_unlock(&rx->recvmsg_lock);
} else if (list_is_first(&call->recvmsg_link, &rx->recvmsg_q)) {
spin_unlock(&rx->recvmsg_lock);
rxrpc_put_call(call, rxrpc_call_see_recvmsg_requeue_first);
} else {
list_move(&call->recvmsg_link, &rx->recvmsg_q);
spin_unlock(&rx->recvmsg_lock);
rxrpc_put_call(call, rxrpc_call_see_recvmsg_requeue_move);
}
trace_rxrpc_recvmsg(call_debug_id, rxrpc_recvmsg_requeue, 0);
} else {
rxrpc_put_call(call, rxrpc_call_put_recvmsg);
rxrpc_put_call(call, rxrpc_call_put_recvmsg_peek_nowait);
}
error_no_call:
release_sock(&rx->sk);
Expand Down
Loading