🛡️ OESA-2025-1097 — kernel (CVE-2024-26952 +142 more)

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix potencial out-of-bounds when buffer offset is invalid

I found potencial out-of-bounds when buffer offset fields of a few requests

is invalid. This patch set the minimum value of buffer offset field to

->Buffer offset to validate buffer length.(CVE-2024-26952)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

If ->NameOffset of smb2_create_req is smaller than Buffer offset of

smb2_create_req, slab-out-of-bounds read can happen from smb2_open.

This patch set the minimum value of the name offset to the buffer offset

to validate name length of smb2_create_req().(CVE-2024-26954)

In the Linux kernel, the following vulnerability has been resolved:

fpga: bridge: add owner module and take its refcount

The current implementation of the fpga bridge assumes that the low-level

module registers a driver for the parent device and uses its owner pointer

to take the module's refcount. This approach is problematic since it can

lead to a null pointer dereference while attempting to get the bridge if

the parent device does not have a driver.

To address this problem, add a module owner pointer to the fpga_bridge

struct and use it to take the module's refcount. Modify the function for

registering a bridge to take an additional owner module parameter and

rename it to avoid conflicts. Use the old function name for a helper macro

that automatically sets the module that registers the bridge as the owner.

This ensures compatibility with existing low-level control modules and

reduces the chances of registering a bridge without setting the owner.

Also, update the documentation to keep it consistent with the new interface

for registering an fpga bridge.

Other changes: opportunistically move put_device() from __fpga_bridge_get()

to fpga_bridge_get() and of_fpga_bridge_get() to improve code clarity since

the bridge device is taken in these functions.(CVE-2024-36479)

In the Linux kernel, the following vulnerability has been resolved:

blk-iocost: avoid out of bounds shift

UBSAN catches undefined behavior in blk-iocost, where sometimes

iocg->delay is shifted right by a number that is too large,

resulting in undefined behavior on some architectures.

[ 186.556576] ------------[ cut here ]------------

UBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23

shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long')

CPU: 16 PID: 0 Comm: swapper/16 Tainted: G S E N 6.9.0-0_fbk700_debug_rc2_kbuilder_0_gc85af715cac0 #1

Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020

Call Trace:

<IRQ>

dump_stack_lvl+0x8f/0xe0

__ubsan_handle_shift_out_of_bounds+0x22c/0x280

iocg_kick_delay+0x30b/0x310

ioc_timer_fn+0x2fb/0x1f80

__run_timer_base+0x1b6/0x250

...

Avoid that undefined behavior by simply taking the

"delay = 0" branch if the shift is too large.

I am not sure what the symptoms of an undefined value

delay will be, but I suspect it could be more than a

little annoying to debug.(CVE-2024-36916)

In the Linux kernel, the following vulnerability has been resolved:

fpga: manager: add owner module and take its refcount

The current implementation of the fpga manager assumes that the low-level

module registers a driver for the parent device and uses its owner pointer

to take the module&apos;s refcount. This approach is problematic since it can

lead to a null pointer dereference while attempting to get the manager if

the parent device does not have a driver.

To address this problem, add a module owner pointer to the fpga_manager

struct and use it to take the module&apos;s refcount. Modify the functions for

registering the manager to take an additional owner module parameter and

rename them to avoid conflicts. Use the old function names for helper

macros that automatically set the module that registers the manager as the

owner. This ensures compatibility with existing low-level control modules

and reduces the chances of registering a manager without setting the owner.

Also, update the documentation to keep it consistent with the new interface

for registering an fpga manager.

Other changes: opportunistically move put_device() from __fpga_mgr_get() to

fpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the

manager device is taken in these functions.(CVE-2024-37021)

In the Linux kernel, the following vulnerability has been resolved:

thermal/drivers/tsens: Fix null pointer dereference

compute_intercept_slope() is called from calibrate_8960() (in tsens-8960.c)

as compute_intercept_slope(priv, p1, NULL, ONE_PT_CALIB) which lead to null

pointer dereference (if DEBUG or DYNAMIC_DEBUG set).

Fix this bug by adding null pointer check.

Found by Linux Verification C