🛡️ OESA-2026-1275 — kernel (CVE-2022-49157 +34 more)

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix premature hw access after PCI error

After a recoverable PCI error has been detected and recovered, qla driver

needs to check to see if the error condition still persist and/or wait

for the OS to give the resume signal.

Sep 8 22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440

qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx]

Sep 8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60

[qla2xxx]

Sep 8 22:26:03 localhost kernel: Call Trace:

Sep 8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0 [qla2xxx]

Sep 8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160

[qla2xxx]

Sep 8 22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx]

Sep 8 22:26:03 localhost kernel: ? qla2xxx_pci_mmio_enabled+0xfb/0x120

[qla2xxx]

Sep 8 22:26:03 localhost kernel: ? report_mmio_enabled+0x44/0x80

Sep 8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80

Sep 8 22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90

Sep 8 22:26:03 localhost kernel: ? aer_dev_correctable_show+0xc0/0xc0

Sep 8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240

Sep 8 22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0

Sep 8 22:26:03 localhost kernel: ? process_one_work+0x1a7/0x360

..

Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected PCI

disconnect.

Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22:

qla27xx_fwdt_entry_t262: dump ram MB failed. Area 5h start 198013h end 198013h

Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: Unable to

capture FW dump

Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-1015:22: cmd=0x0,

waited 5221 msecs

Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-680d:22: mmio

enabled returning.

Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-d04c:22: MBX

Command timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5

mb[0-3]=[0xffff 0xffff 0xffff 0xffff](CVE-2022-49157)

In the Linux kernel, the following vulnerability has been resolved:

md/raid0, raid10: Don't set discard sectors for request queue

It should use disk_stack_limits to get a proper max_discard_sectors

rather than setting a value by stack drivers.

And there is a bug. If all member disks are rotational devices,

raid0/raid10 set max_discard_sectors. So the member devices are

not ssd/nvme, but raid0/raid10 export the wrong value. It reports

warning messages in function __blkdev_issue_discard when mkfs.xfs

like this:

[ 4616.022599] ------------[ cut here ]------------

[ 4616.027779] WARNING: CPU: 4 PID: 99634 at block/blk-lib.c:50 __blkdev_issue_discard+0x16a/0x1a0

[ 4616.140663] RIP: 0010:__blkdev_issue_discard+0x16a/0x1a0

[ 4616.146601] Code: 24 4c 89 20 31 c0 e9 fe fe ff ff c1 e8 09 8d 48 ff 4c 89 f0 4c 09 e8 48 85 c1 0f 84 55 ff ff ff b8 ea ff ff ff e9 df fe ff ff <0f> 0b 48 8d 74 24 08 e8 ea d6 00 00 48 c7 c6 20 1e 89 ab 48 c7 c7

[ 4616.167567] RSP: 0018:ffffaab88cbffca8 EFLAGS: 00010246

[ 4616.173406] RAX: ffff9ba1f9e44678 RBX: 0000000000000000 RCX: ffff9ba1c9792080

[ 4616.181376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ba1c9792080

[ 4616.189345] RBP: 0000000000000cc0 R08: ffffaab88cbffd10 R09: 0000000000000000

[ 4616.197317] R10: 0000000000000012 R11: 0000000000000000 R12: 0000000000000000

[ 4616.205288] R13: 0000000000400000 R14: 0000000000000cc0 R15: ffff9ba1c9792080

[ 4616.213259] FS: 00007f9a5534e980(0000) GS:ffff9ba1b7c80000(0000) knlGS:0000000000000000

[ 4616.222298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

[ 4616.228719] CR2: 000055a390a4c518 CR3: 0000000123e40006 CR4: 00000000001706e0

[ 4616.236689] Call Trace:

[ 4616.239428] blkdev_issue_discard+0x52/0xb0

[ 4616.244108] blkdev_common_ioctl+0x43c/0xa00

[ 4616.248883] blkdev_ioctl+0x116/0x280

[ 4616.252977] __x64_sys_ioctl+0x8a/0xc0

[ 4616.257163] do_syscall_64+0x5c/0x90

[ 4616.261164] ? handle_mm_fault+0xc5/0x2a0

[ 4616.265652] ? do_user_addr_fault+0x1d8/0x690

[ 4616.270527] ? do_syscall_64+0x69/0x90

[ 4616.274717] ? exc_page_fault+0x62/0x150

[ 4616.279097] entry_SYSCALL_64_after_hwframe+0x63/0xcd

[ 4616.284748] RIP: 0033:0x7f9a55398c6b(CVE-2022-50583)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Validate index root when initialize NTFS security

This enhances the sanity check for $SDH and $SII while initializing NTFS

security, guarantees these index root are legit.

[ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320

[ 162.460176] Read of size 2 at addr ffff8880037bca99 by task mount/243

[ 162.460851]

[ 162.461252] CPU: 0 PID: 243 Comm: mount Not tainted 6.0.0-rc7 #42

[ 162.461744] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014

[ 162.462609] Call Trace:

[ 162.4629