Skip to content

[ciqlts9_2] Multiple patches tested (9 commits)#1388

Merged
bmastbergen merged 9 commits into
ciqlts9_2from
{ciq_kernel_automation}_ciqlts9_2
Jun 29, 2026
Merged

[ciqlts9_2] Multiple patches tested (9 commits)#1388
bmastbergen merged 9 commits into
ciqlts9_2from
{ciq_kernel_automation}_ciqlts9_2

Conversation

@ciq-kernel-automation

@ciq-kernel-automation ciq-kernel-automation Bot commented Jun 29, 2026

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

fs: sysfs: Fix reference leak in sysfs_break_active_protection()

jira VULN-980
cve CVE-2024-26993
commit-author Alan Stern <stern@rowland.harvard.edu>
commit a90bca2228c0646fc29a72689d308e5fe03e6d78
cpufreq: exit() callback is optional

jira VULN-5516
cve CVE-2024-38615
commit-author Viresh Kumar <viresh.kumar@linaro.org>
commit b8f85833c05730d631576008daaa34096bc7f3ce
nouveau: fix instmem race condition around ptr stores

jira VULN-37531
cve CVE-2024-26984
commit-author Dave Airlie <airlied@redhat.com>
commit fff1386cc889d8fb4089d285f883f8cba62d82ce
cppc_cpufreq: Fix possible null pointer dereference

jira VULN-5484
cve CVE-2024-38573
commit-author Aleksandr Mishin <amishin@t-argos.ru>
commit cf7de25878a1f4508c69dc9f6819c21ba177dbfe
cpufreq: cppc: Fix invalid return value in .get() callback

jira VULN-5484
cve-bf CVE-2024-38573
commit-author Marc Zyngier <maz@kernel.org>
commit 2b8e6b58889c672e1ae3601d9b2b070be4dc2fbc
upstream-diff Also fix hisi_cppc_cpufreq_get_rate() which still
              exists in this kernel but was removed upstream before
              this fix was written (removed by ea1829d4d413b).
wifi: nl80211: don't free NULL coalescing rule

jira VULN-5407
cve CVE-2024-36941
commit-author Johannes Berg <johannes.berg@intel.com>
commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7
icmp: prevent possible NULL dereferences from icmp_build_probe()

jira VULN-43056
cve CVE-2024-35857
commit-author Eric Dumazet <edumazet@google.com>
commit c58e88d49097bd12dfcfef4f075b43f5d5830941
scsi: qedi: Fix crash while reading debugfs attribute

jira VULN-43643
cve CVE-2024-40978
commit-author Manish Rangankar <mrangankar@marvell.com>
commit 28027ec8e32ecbadcd67623edb290dad61e735b5
mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work

jira VULN-43023
cve CVE-2024-35852
commit-author Ido Schimmel <idosch@nvidia.com>
commit fb4e2b70a7194b209fc7320bbf33b375f7114bd5

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 24m 48s 25m 51s
aarch64 12m 24s 12m 56s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 174 24 ciqlts9_2 ✅ No regressions
aarch64 140 28 ciqlts9_2 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1439 81 ciqlts9_2 ✅ No regressions
aarch64 1409 83 ciqlts9_2 ✅ No regressions

🤖 This PR was automatically generated by GitHub Actions
Run ID: 28399106774

@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Jun 29, 2026
@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/28372852526

@github-actions

Copy link
Copy Markdown

Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/28372852526

PlaidCat
PlaidCat previously approved these changes Jun 29, 2026

@PlaidCat PlaidCat left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@PlaidCat PlaidCat requested review from a team and PlaidCat June 29, 2026 19:36
@bmastbergen bmastbergen force-pushed the {ciq_kernel_automation}_ciqlts9_2 branch from a222e69 to f35d860 Compare June 29, 2026 19:55
CIQ Kernel Automation added 9 commits June 29, 2026 16:00
jira VULN-980
cve CVE-2024-26993
commit-author Alan Stern <stern@rowland.harvard.edu>
commit a90bca2

The sysfs_break_active_protection() routine has an obvious reference
leak in its error path.  If the call to kernfs_find_and_get() fails then
kn will be NULL, so the companion sysfs_unbreak_active_protection()
routine won't get called (and would only cause an access violation by
trying to dereference kn->parent if it was called).  As a result, the
reference to kobj acquired at the start of the function will never be
released.

Fix the leak by adding an explicit kobject_put() call when kn is NULL.

	Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 2afc916 ("scsi: sysfs: Introduce sysfs_{un,}break_active_protection()")
	Cc: Bart Van Assche <bvanassche@acm.org>
	Cc: stable@vger.kernel.org
	Reviewed-by: Bart Van Assche <bvanassche@acm.org>
	Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/8a4d3f0f-c5e3-4b70-a188-0ca433f9e6f9@rowland.harvard.edu
	Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a90bca2)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
jira VULN-5516
cve CVE-2024-38615
commit-author Viresh Kumar <viresh.kumar@linaro.org>
commit b8f8583

The exit() callback is optional and shouldn't be called without checking
a valid pointer first.

Also, we must clear freq_table pointer even if the exit() callback isn't
present.

	Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Fixes: 91a12e9 ("cpufreq: Allow light-weight tear down and bring up of CPUs")
Fixes: f339f35 ("cpufreq: Rearrange locking in cpufreq_remove_dev()")
	Reported-by: Lizhe <sensor1010@163.com>
	Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
(cherry picked from commit b8f8583)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
jira VULN-37531
cve CVE-2024-26984
commit-author Dave Airlie <airlied@redhat.com>
commit fff1386

Running a lot of VK CTS in parallel against nouveau, once every
few hours you might see something like this crash.

BUG: kernel NULL pointer dereference, address: 0000000000000008
PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27
Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021
RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau]
Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1
RSP: 0000:ffffac20c5857838 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001
RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180
RBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10
R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c
R13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c
FS:  00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

...

 ? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau]
 ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau]
 nvkm_vmm_iter+0x351/0xa20 [nouveau]
 ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau]
 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]
 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]
 ? __lock_acquire+0x3ed/0x2170
 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]
 nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau]
 ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau]
 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]
 nvkm_vmm_map_locked+0x224/0x3a0 [nouveau]

Adding any sort of useful debug usually makes it go away, so I hand
wrote the function in a line, and debugged the asm.

Every so often pt->memory->ptrs is NULL. This ptrs ptr is set in
the nv50_instobj_acquire called from nvkm_kmap.

If Thread A and Thread B both get to nv50_instobj_acquire around
the same time, and Thread A hits the refcount_set line, and in
lockstep thread B succeeds at refcount_inc_not_zero, there is a
chance the ptrs value won't have been stored since refcount_set
is unordered. Force a memory barrier here, I picked smp_mb, since
we want it on all CPUs and it's write followed by a read.

v2: use paired smp_rmb/smp_wmb.

	Cc: <stable@vger.kernel.org>
Fixes: be55287 ("drm/nouveau/imem/nv50: embed nvkm_instobj directly into nv04_instobj")
	Signed-off-by: Dave Airlie <airlied@redhat.com>
	Signed-off-by: Danilo Krummrich <dakr@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240411011510.2546857-1-airlied@gmail.com
(cherry picked from commit fff1386)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
jira VULN-5484
cve CVE-2024-38573
commit-author Aleksandr Mishin <amishin@t-argos.ru>
commit cf7de25

cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from
different places with various parameters. So cpufreq_cpu_get() can return
null as 'policy' in some circumstances.
Fix this bug by adding null return check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a28b2bf ("cppc_cpufreq: replace per-cpu data array with a list")
	Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
	Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
(cherry picked from commit cf7de25)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
jira VULN-5484
cve-bf CVE-2024-38573
commit-author Marc Zyngier <maz@kernel.org>
commit 2b8e6b5
upstream-diff Also fix hisi_cppc_cpufreq_get_rate() which still
              exists in this kernel but was removed upstream before
              this fix was written (removed by ea1829d).

Returning a negative error code in a function with an unsigned
return type is a pretty bad idea. It is probably worse when the
justification for the change is "our static analisys tool found it".

Fixes: cf7de25 ("cppc_cpufreq: Fix possible null pointer dereference")
	Signed-off-by: Marc Zyngier <maz@kernel.org>
	Cc: "Rafael J. Wysocki" <rafael@kernel.org>
	Cc: Viresh Kumar <viresh.kumar@linaro.org>
	Reviewed-by: Lifeng Zheng <zhenglifeng1@huawei.com>
	Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
(cherry picked from commit 2b8e6b5)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
jira VULN-5407
cve CVE-2024-36941
commit-author Johannes Berg <johannes.berg@intel.com>
commit 801ea33

If the parsing fails, we can dereference a NULL pointer here.

	Cc: stable@vger.kernel.org
Fixes: be29b99 ("cfg80211/nl80211: Add packet coalesce support")
	Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240418105220.b328f80406e7.Id75d961050deb05b3e4e354e024866f350c68103@changeid
	Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 801ea33)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
jira VULN-43056
cve CVE-2024-35857
commit-author Eric Dumazet <edumazet@google.com>
commit c58e88d

First problem is a double call to __in_dev_get_rcu(), because
the second one could return NULL.

if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list)

Second problem is a read from dev->ip6_ptr with no NULL check:

if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list))

Use the correct RCU API to fix these.

v2: add missing include <net/addrconf.h>

Fixes: d329ea5 ("icmp: add response to RFC 8335 PROBE messages")
	Signed-off-by: Eric Dumazet <edumazet@google.com>
	Cc: Andreas Roeseler <andreas.a.roeseler@gmail.com>
	Reviewed-by: David Ahern <dsahern@kernel.org>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit c58e88d)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
jira VULN-43643
cve CVE-2024-40978
commit-author Manish Rangankar <mrangankar@marvell.com>
commit 28027ec

The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly
on a __user pointer, which results into the crash.

To fix this issue, use a small local stack buffer for sprintf() and then
call simple_read_from_buffer(), which in turns make the copy_to_user()
call.

BUG: unable to handle page fault for address: 00007f4801111000
PGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0
Oops: 0002 [#1] PREEMPT SMP PTI
Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023
RIP: 0010:memcpy_orig+0xcd/0x130
RSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202
RAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f
RDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000
RBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572
R10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff
R13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af
FS:  00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 ? __die_body+0x1a/0x60
 ? page_fault_oops+0x183/0x510
 ? exc_page_fault+0x69/0x150
 ? asm_exc_page_fault+0x22/0x30
 ? memcpy_orig+0xcd/0x130
 vsnprintf+0x102/0x4c0
 sprintf+0x51/0x80
 qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324]
 full_proxy_read+0x50/0x80
 vfs_read+0xa5/0x2e0
 ? folio_add_new_anon_rmap+0x44/0xa0
 ? set_pte_at+0x15/0x30
 ? do_pte_missing+0x426/0x7f0
 ksys_read+0xa5/0xe0
 do_syscall_64+0x58/0x80
 ? __count_memcg_events+0x46/0x90
 ? count_memcg_event_mm+0x3d/0x60
 ? handle_mm_fault+0x196/0x2f0
 ? do_user_addr_fault+0x267/0x890
 ? exc_page_fault+0x69/0x150
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f4800f20b4d

	Tested-by: Martin Hoyer <mhoyer@redhat.com>
	Reviewed-by: John Meneghini <jmeneghi@redhat.com>
	Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
Link: https://lore.kernel.org/r/20240415072155.30840-1-mrangankar@marvell.com
	Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 28027ec)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
jira VULN-43023
cve CVE-2024-35852
commit-author Ido Schimmel <idosch@nvidia.com>
commit fb4e2b7

The rehash delayed work is rescheduled with a delay if the number of
credits at end of the work is not negative as supposedly it means that
the migration ended. Otherwise, it is rescheduled immediately.

After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during
rehash" the above is no longer accurate as a non-negative number of
credits is no longer indicative of the migration being done. It can also
happen if the work encountered an error in which case the migration will
resume the next time the work is scheduled.

The significance of the above is that it is possible for the work to be
pending and associated with hints that were allocated when the migration
started. This leads to the hints being leaked [1] when the work is
canceled while pending as part of ACL region dismantle.

Fix by freeing the hints if hints are associated with a work that was
canceled while pending.

Blame the original commit since the reliance on not having a pending
work associated with hints is fragile.

[1]
unreferenced object 0xffff88810e7c3000 (size 256):
  comm "kworker/0:16", pid 176, jiffies 4295460353
  hex dump (first 32 bytes):
    00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80  .0......a.......
    00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00  ..a.@...........
  backtrace (crc 2544ddb9):
    [<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0
    [<000000004d9a1ad9>] objagg_hints_get+0x42/0x390
    [<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400
    [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160
    [<00000000e81fd734>] process_one_work+0x59c/0xf20
    [<00000000ceee9e81>] worker_thread+0x799/0x12c0
    [<00000000bda6fe39>] kthread+0x246/0x300
    [<0000000070056d23>] ret_from_fork+0x34/0x70
    [<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30

Fixes: c9c9af9 ("mlxsw: spectrum_acl: Allow to interrupt/continue rehash work")
	Signed-off-by: Ido Schimmel <idosch@nvidia.com>
	Tested-by: Alexander Zubkov <green@qrator.net>
	Signed-off-by: Petr Machata <petrm@nvidia.com>
	Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/0cc12ebb07c4d4c41a1265ee2c28b392ff997a86.1713797103.git.petrm@nvidia.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit fb4e2b7)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen bmastbergen force-pushed the {ciq_kernel_automation}_ciqlts9_2 branch from f35d860 to a2d6e00 Compare June 29, 2026 20:00

@PlaidCat PlaidCat left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/28399308622

@github-actions

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit b363441cb4e (cpufreq: cppc: Fix invalid return value in .get() callback) → upstream 2b8e6b58889c
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -933,7 +933,7 @@
 	int ret;
 
 	if (!policy)
-		return 0;
+		return -ENODEV;
 
 	cpu_data = policy->driver_data;
 

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -933,7 +933,7 @@
 	int ret;
 
 	if (!policy)
-		return -ENODEV;
+		return 0;
 
 	cpu_data = policy->driver_data;

This is an automated interdiff check for backported commits.

@github-actions

Copy link
Copy Markdown

JIRA PR Check Results

84 commit(s) with issues found:

Commit 17e4221ec8cd

Summary: xfs: fix freemap adjustments when adding xattrs to leaf blocks

❌ Errors:

  • VULN-184487: Status is 'Publish CSAF', expected 'In Progress'

Commit 56287881216b

Summary: netfilter: xt_tcpmss: check remaining length before reading optlen

❌ Errors:

  • VULN-184557: Status is 'Publish CSAF', expected 'In Progress'

Commit 7a369672ab5c

Summary: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

❌ Errors:

  • VULN-176436: Status is 'Publish CSAF', expected 'In Progress'

Commit 9700352f2e39

Summary: libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

❌ Errors:

  • VULN-174788: Status is 'Publish CSAF', expected 'In Progress'

Commit c352628d83a8

Summary: libceph: prevent potential out-of-bounds reads in handle_auth_done()

❌ Errors:

  • VULN-174768: Status is 'Publish CSAF', expected 'In Progress'

Commit 4101a9e94b7b

Summary: libceph: make decode_pool() more resilient against corrupted osdmaps

❌ Errors:

  • VULN-174158: Status is 'Publish CSAF', expected 'In Progress'

Commit ef62387f6327

Summary: nbd: defer config unlock in nbd_genl_connect

❌ Errors:

  • VULN-171934: Status is 'Publish CSAF', expected 'In Progress'

Commit a2cd3ad62472

Summary: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

❌ Errors:

  • VULN-171986: Status is 'Publish CSAF', expected 'In Progress'

Commit 40824e754172

Summary: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

❌ Errors:

  • VULN-180395: Status is 'Publish CSAF', expected 'In Progress'

Commit 4f58c44b1233

Summary: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()

❌ Errors:

  • VULN-80080: Status is 'Publish CSAF', expected 'In Progress'

Commit d1c86e1ab4c5

Summary: netfilter: flowtable: validate pppoe header

❌ Errors:

  • VULN-37637: Status is 'Publish CSAF', expected 'In Progress'

Commit a9e34de62a49

Summary: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

❌ Errors:

  • VULN-4970: Status is 'Publish CSAF', expected 'In Progress'

Commit 66f0b1cf5fde

Summary: net: ena: Fix incorrect descriptor free behavior

❌ Errors:

  • VULN-38028: Status is 'Publish CSAF', expected 'In Progress'

Commit 0885c2e931e0

Summary: net/mlx5: Properly link new fs rules into the tree

❌ Errors:

  • VULN-3105: Status is 'Publish CSAF', expected 'In Progress'

Commit 71a293491ce9

Summary: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

❌ Errors:

  • VULN-38062: Status is 'Publish CSAF', expected 'In Progress'

Commit b0afb2f12d5e

Summary: drm/client: Fully protect modes[] with dev->mode_config.mutex

❌ Errors:

  • VULN-38014: Status is 'Publish CSAF', expected 'In Progress'

Commit b8049dfbb51e

Summary: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()

❌ Errors:

  • VULN-5287: Status is 'Publish CSAF', expected 'In Progress'

Commit f31d0e9627a0

Summary: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

❌ Errors:

  • VULN-37860: Status is 'Publish CSAF', expected 'In Progress'

Commit cf9f720a1efd

Summary: mlxbf_gige: stop interface during shutdown

❌ Errors:

  • VULN-37795: Status is 'Publish CSAF', expected 'In Progress'

Commit 9aae3b357b6f

Summary: net: fix memory leak in skb_segment_list for GRO packets

❌ Errors:

  • VULN-174746: Status is 'Publish CSAF', expected 'In Progress'

Commit 0c11c3e1f7c5

Summary: gro: fix ownership transfer

❌ Errors:

  • VULN-37821: Status is 'Publish CSAF', expected 'In Progress'

Commit 2070c918f8d9

Summary: xen-netfront: Add missing skb_mark_for_recycle

❌ Errors:

  • VULN-3103: Status is 'Publish CSAF', expected 'In Progress'

Commit d94d699255cf

Summary: i40e: fix vf may be used uninitialized in this function warning

❌ Errors:

  • VULN-5279: Status is 'Publish CSAF', expected 'In Progress'

Commit 9852fe174c0c

Summary: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING

❌ Errors:

  • VULN-47431: Status is 'Publish CSAF', expected 'In Progress'

Commit 49a166fdbc5d

Summary: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

❌ Errors:

  • VULN-47154: Status is 'Publish CSAF', expected 'In Progress'

Commit 32c4e875cda8

Summary: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address

❌ Errors:

  • VULN-37443: Status is 'Publish CSAF', expected 'In Progress'

Commit d38622996959

Summary: arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit fb7b641c2421

Summary: arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 72fbbaf2fb1a

Summary: arm64: errata: Mitigate TLBI errata on various Arm CPUs

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit b9b315ad55fd

Summary: arm64: cputype: Add C1-Premium definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 61af6a9fbdb3

Summary: arm64: cputype: Add C1-Ultra definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit b08eac74804c

Summary: arm64: cputype: Add NVIDIA Olympus definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit dc80cb350d7b

Summary: arm64: cputype: Add C1-Pro definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit faa19e6bfb7d

Summary: arm64: cputype: Add Neoverse-V3AE definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 8544ec262d7a

Summary: arm64: cputype: Add Neoverse-N3 definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 05a06ade0aeb

Summary: arm64: cputype: Add Cortex-A720AE definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 30b48bb5f465

Summary: arm64: cputype: Add Cortex-A725 definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 60e8f4c54dbd

Summary: arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit f85162db395b

Summary: arm64: cputype: Add Cortex-X925 definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit c58354e931b5

Summary: arm64: cputype: Add Neoverse-V3 definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 87c99755c42b

Summary: arm64: cputype: Add Cortex-X4 definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 4fa650214be6

Summary: arm64: cputype: Add Cortex-A720 definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit c1cfc9b452e0

Summary: arm64: Add Neoverse-V2 part

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 4eb4a74799ce

Summary: arm64: cputype: Add Cortex-X3 definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 958889b256ba

Summary: arm64: cputype: Add Cortex-X1C definitions

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit f807da37bfba

Summary: arm64: cputype: Add MIDR_CORTEX_A76AE

❌ Errors:

  • VULN-187521: Status is 'Done', expected 'In Progress'

Commit 982a49d9ebf6

Summary: ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

❌ Errors:

  • VULN-183731: Status is 'Done', expected 'In Progress'

Commit f01206a4a971

Summary: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

❌ Errors:

  • VULN-183737: Status is 'Done', expected 'In Progress'

Commit 02aa6f4153fb

Summary: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

❌ Errors:

  • VULN-187517: Status is 'Done', expected 'In Progress'

Commit 195e5dc6b012

Summary: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit

❌ Errors:

  • VULN-152970: Status is 'Done', expected 'In Progress'

Commit 40080203cd45

Summary: net: sched: fix ordering of qlen adjustment

❌ Errors:

  • VULN-46603: Status is 'Done', expected 'In Progress'

Commit 697905776c09

Summary: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

❌ Errors:

  • VULN-176072: Status is 'Done', expected 'In Progress'

Commit 435af4f1f4b6

Summary: netfilter: nf_tables: do not compare internal table flags on updates

❌ Errors:

  • VULN-4986: Status is 'Done', expected 'In Progress'

Commit 2d2b563a476d

Summary: octeontx2-af: Use separate handlers for interrupts

❌ Errors:

  • VULN-37687: Status is 'Done', expected 'In Progress'

Commit 60e898ba4825

Summary: dm: call the resume method on internal suspend

❌ Errors:

  • VULN-37132: Status is 'Done', expected 'In Progress'

Commit e0047cb8c74d

Summary: nfp: flower: handle acti_netdevs allocation failure

❌ Errors:

  • VULN-37723: Status is 'Done', expected 'In Progress'

Commit 831028cb3487

Summary: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

❌ Errors:

  • VULN-47578: Status is 'Done', expected 'In Progress'

Commit 31bc7323ed64

Summary: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()

❌ Errors:

  • VULN-47487: Status is 'Done', expected 'In Progress'

Commit 15016e4ce174

Summary: scsi: qla2xxx: Fix command flush on cable pull

❌ Errors:

  • VULN-37382: Status is 'Done', expected 'In Progress'

Commit 034be15ae09f

Summary: netfilter: nf_tables: disallow anonymous set with timeout flag

❌ Errors:

  • VULN-828: Status is 'Done', expected 'In Progress'

Commit 84c48b17c96d

Summary: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

❌ Errors:

  • VULN-180163: Status is 'Done', expected 'In Progress'

Commit 15f65a192965

Summary: NFSD: Fix crash in nfsd4_read_release()

❌ Errors:

  • VULN-161290: Status is 'Done', expected 'In Progress'

Commit f2244de83ca4

Summary: nfsd: call op_release, even when op_func returns an error

❌ Errors:

  • VULN-154845: Status is 'Done', expected 'In Progress'

Commit 9a55104d838a

Summary: can: raw: fix ro->uniq use-after-free in raw_rcv()

❌ Errors:

  • VULN-182364: Status is 'Done', expected 'In Progress'

Commit 66fce69467df

Summary: RDMA/umad: Reject negative data_len in ib_umad_write

❌ Errors:

  • VULN-178540: Status is 'Done', expected 'In Progress'

Commit e3f5fbc0e1ae

Summary: blk-mq: fix IO hang from sbitmap wakeup race

❌ Errors:

  • VULN-860: Status is 'Done', expected 'In Progress'

Commit 753361483fd7

Summary: PM / devfreq: Synchronize devfreq_monitor_[start/stop]

❌ Errors:

  • VULN-35274: Status is 'Done', expected 'In Progress'

Commit d31ec9714663

Summary: wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()

❌ Errors:

  • VULN-35352: Status is 'Done', expected 'In Progress'

Commit 786a1793123e

Summary: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump

❌ Errors:

  • VULN-518: Status is 'Done', expected 'In Progress'

Commit 02140632878a

Summary: block: add check that partition length needs to be aligned with block size

❌ Errors:

  • VULN-34806: Status is 'Done', expected 'In Progress'

Commit ff3f81b1bbbc

Summary: pstore/ram: Fix crash when setting number of cpus to an odd number

❌ Errors:

  • VULN-4502: Status is 'Done', expected 'In Progress'

Commit 64c6f93dc2fe

Summary: tcp: do not accept ACK of bytes we never sent

❌ Errors:

  • VULN-36192: Status is 'Done', expected 'In Progress'

Commit 18156adc35ab

Summary: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()

❌ Errors:

  • VULN-34776: Status is 'Done', expected 'In Progress'

Commit a65f82f87dc3

Summary: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()

❌ Errors:

  • VULN-35889: Status is 'Done', expected 'In Progress'

Commit b64691d0cdfb

Summary: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool

❌ Errors:

  • VULN-4654: Status is 'Done', expected 'In Progress'

Commit 3a6db402aca2

Summary: Bluetooth: hci_codec: Fix leaking content of local_codecs

❌ Errors:

  • VULN-35032: Status is 'Done', expected 'In Progress'

Commit 0077ab073f15

Summary: Bluetooth: Fix support for Read Local Supported Codecs V2

❌ Errors:

  • VULN-35032: Status is 'Done', expected 'In Progress'

Commit 908bee4d3cdc

Summary: mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()

❌ Errors:

  • VULN-6753: Status is 'Done', expected 'In Progress'

Commit d8fcb9e02ece

Summary: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc

❌ Errors:

  • VULN-36184: Status is 'Done', expected 'In Progress'

Commit 52abe0c2e07a

Summary: vxlan: Fix nexthop hash size

❌ Errors:

  • VULN-154381: Status is 'Done', expected 'In Progress'

Commit fc7143c78b2e

Summary: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()

❌ Errors:

  • VULN-155913: Status is 'Done', expected 'In Progress'

Commit b91ef7fa5f5d

Summary: ptrace: slightly saner 'get_dumpable()' logic

❌ Errors:

  • VULN-185426: Status is 'Done', expected 'In Progress'

Commit 70b87459079b

Summary: net: skbuff: propagate shared-frag marker through frag-transfer helpers

❌ Errors:

  • VULN-185346: Status is 'Done', expected 'In Progress'

Commit b9ea22e0e20e

Summary: xfrm: esp: avoid in-place decrypt on shared skb frags

❌ Errors:

  • VULN-184830: Status is 'Done', expected 'In Progress'

Summary: Checked 100 commit(s) total.

@github-actions

Copy link
Copy Markdown

Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/28399308622

@bmastbergen

Copy link
Copy Markdown
Collaborator

🔍 Interdiff Analysis

  • ⚠️ PR commit b363441cb4e (cpufreq: cppc: Fix invalid return value in .get() callback) → upstream 2b8e6b58889c
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -933,7 +933,7 @@
 	int ret;
 
 	if (!policy)
-		return 0;
+		return -ENODEV;
 
 	cpu_data = policy->driver_data;
 

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -933,7 +933,7 @@
 	int ret;
 
 	if (!policy)
-		return -ENODEV;
+		return 0;
 
 	cpu_data = policy->driver_data;

This is an automated interdiff check for backported commits.

This is expected. We needed to patch up hisi_cppc_cpufreq_get_rate because it still exists in this kernel (but was removed from upstream).

@bmastbergen bmastbergen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/28399575892

@github-actions

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 563a6eeecfb (cpufreq: cppc: Fix invalid return value in .get() callback) → upstream 2b8e6b58889c
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -933,7 +933,7 @@
 	int ret;
 
 	if (!policy)
-		return 0;
+		return -ENODEV;
 
 	cpu_data = policy->driver_data;
 

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -933,7 +933,7 @@
 	int ret;
 
 	if (!policy)
-		return -ENODEV;
+		return 0;
 
 	cpu_data = policy->driver_data;

This is an automated interdiff check for backported commits.

@bmastbergen bmastbergen merged commit e54d1c8 into ciqlts9_2 Jun 29, 2026
4 of 5 checks passed
@bmastbergen bmastbergen deleted the {ciq_kernel_automation}_ciqlts9_2 branch June 29, 2026 20:10
@github-actions

Copy link
Copy Markdown

Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/28399575892

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Development

Successfully merging this pull request may close these issues.

2 participants