CVE-2025-38718

In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs caused by this: BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline] and BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] This patch fixes it by linearizing cloned gso packets in sctp_rcv().

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error

After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released.

However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message:

remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c

To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq().

kwilczynski: commit log

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: csa unmap use uninterruptible lock

After process exit to unmap csa and free GPU vm, if signal is accepted and then waiting to take vm lock is interrupted and return, it causes memory leaking and below warning backtrace.

Change to use uninterruptible wait lock fix the issue.

WARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525 amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu] Call Trace: <TASK> drm_file_free.part.0+0x1da/0x230 [drm] drm_close_helper.isra.0+0x65/0x70 [drm] drm_release+0x6a/0x120 [drm] amdgpu_drm_release+0x51/0x60 [amdgpu] __fput+0x9f/0x280 ____fput+0xe/0x20 task_work_run+0x67/0xa0 do_exit+0x217/0x3c0 do_group_exit+0x3b/0xb0 get_signal+0x14a/0x8d0 arch_do_signal_or_restart+0xde/0x100 exit_to_user_mode_loop+0xc1/0x1a0 exit_to_user_mode_prepare+0xf4/0x100 syscall_exit_to_user_mode+0x17/0x40 do_syscall_64+0x69/0xc0

(cherry picked from commit 7dbbfb3c171a6f63b01165958629c9c26abf38ab)(CVE-2025-38011)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: avoid NULL pointer dereference if no valid csum tree

[BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace:

BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csums_bitmap+0x49/0x480 [btrfs] Call Trace: <TASK> scrub_find_fill_first_stripe+0x35b/0x3d0 [btrfs] scrub_simple_mirror+0x175/0x290 [btrfs] scrub_stripe+0x5f7/0x6f0 [btrfs] scrub_chunk+0x9a/0x150 [btrfs] scrub_enumerate_chunks+0x333/0x660 [btrfs] btrfs_scrub_dev+0x23e/0x600 [btrfs] btrfs_ioctl+0x1dcf/0x2f80 [btrfs] __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[CAUSE] Mount option "rescue=idatacsums" will completely skip loading the csum tree, so that any data read will not find any data csum thus we will ignore data checksum verification.

Normally call sites utilizing csum tree will check the fs state flag NO_DATA_CSUMS bit, but unfortunately scrub does not check that bit at all.

This results in scrub to call btrfs_search_slot() on a NULL pointer and triggered above crash.

[FIX] Check both extent and csum tree root before doing any tree search.(CVE-2025-38059)

In the Linux kernel, the following vulnerability has been resolved:

coresight: holding cscfg_csdev_lock while removing cscfg from csdev

There'll be possible race scenario for coresight config:

CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error

After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released.

However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message:

remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c

To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq().

kwilczynski: commit log

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: csa unmap use uninterruptible lock

After process exit to unmap csa and free GPU vm, if signal is accepted and then waiting to take vm lock is interrupted and return, it causes memory leaking and below warning backtrace.

Change to use uninterruptible wait lock fix the issue.

WARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525 amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu] Call Trace: <TASK> drm_file_free.part.0+0x1da/0x230 [drm] drm_close_helper.isra.0+0x65/0x70 [drm] drm_release+0x6a/0x120 [drm] amdgpu_drm_release+0x51/0x60 [amdgpu] __fput+0x9f/0x280 ____fput+0xe/0x20 task_work_run+0x67/0xa0 do_exit+0x217/0x3c0 do_group_exit+0x3b/0xb0 get_signal+0x14a/0x8d0 arch_do_signal_or_restart+0xde/0x100 exit_to_user_mode_loop+0xc1/0x1a0 exit_to_user_mode_prepare+0xf4/0x100 syscall_exit_to_user_mode+0x17/0x40 do_syscall_64+0x69/0xc0

(cherry picked from commit 7dbbfb3c171a6f63b01165958629c9c26abf38ab)(CVE-2025-38011)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: avoid NULL pointer dereference if no valid csum tree

[BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace:

BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csums_bitmap+0x49/0x480 [btrfs] Call Trace: <TASK> scrub_find_fill_first_stripe+0x35b/0x3d0 [btrfs] scrub_simple_mirror+0x175/0x290 [btrfs] scrub_stripe+0x5f7/0x6f0 [btrfs] scrub_chunk+0x9a/0x150 [btrfs] scrub_enumerate_chunks+0x333/0x660 [btrfs] btrfs_scrub_dev+0x23e/0x600 [btrfs] btrfs_ioctl+0x1dcf/0x2f80 [btrfs] __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[CAUSE] Mount option "rescue=idatacsums" will completely skip loading the csum tree, so that any data read will not find any data csum thus we will ignore data checksum verification.

Normally call sites utilizing csum tree will check the fs state flag NO_DATA_CSUMS bit, but unfortunately scrub does not check that bit at all.

This results in scrub to call btrfs_search_slot() on a NULL pointer and triggered above crash.

[FIX] Check both extent and csum tree root before doing any tree search.(CVE-2025-38059)

In the Linux kernel, the following vulnerability has been resolved:

coresight: holding cscfg_csdev_lock while removing cscfg from csdev

There'll be possible race scenario for coresight config:

CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error

After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released.

However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message:

remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c

To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq().

kwilczynski: commit log

In the Linux kernel, the following vulnerability has been resolved:

btrfs: avoid NULL pointer dereference if no valid csum tree

[BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace:

BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csums_bitmap+0x49/0x480 [btrfs] Call Trace: <TASK> scrub_find_fill_first_stripe+0x35b/0x3d0 [btrfs] scrub_simple_mirror+0x175/0x290 [btrfs] scrub_stripe+0x5f7/0x6f0 [btrfs] scrub_chunk+0x9a/0x150 [btrfs] scrub_enumerate_chunks+0x333/0x660 [btrfs] btrfs_scrub_dev+0x23e/0x600 [btrfs] btrfs_ioctl+0x1dcf/0x2f80 [btrfs] __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[CAUSE] Mount option "rescue=idatacsums" will completely skip loading the csum tree, so that any data read will not find any data csum thus we will ignore data checksum verification.

Normally call sites utilizing csum tree will check the fs state flag NO_DATA_CSUMS bit, but unfortunately scrub does not check that bit at all.

This results in scrub to call btrfs_search_slot() on a NULL pointer and triggered above crash.

[FIX] Check both extent and csum tree root before doing any tree search.(CVE-2025-38059)

In the Linux kernel, the following vulnerability has been resolved:

coresight: holding cscfg_csdev_lock while removing cscfg from csdev

There'll be possible race scenario for coresight config:

CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() <iterating config_csdev_list> cscfg_remove_owned_csdev_configs() // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock)

iterating config_csdev_list could be raced with config_csdev_list's entry delete.

To resolve this race , hold csdev->cscfg_csdev_lock() while cscfg_remove_owned_csdev_configs()(CVE-2025-38132)

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()

devm_ioremap() returns NULL on error. Currently, mt7915_mmio_wed_init() does not check for this case, which results in a NULL pointer…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)

• kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)

• kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

• kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)

• kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)

• kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

• kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

• kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)

• kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

• kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

• kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-38718 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-38718 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-38718 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-38718 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs caused by this: BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline] and BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] This patch fixes it by linearizing cloned gso packets in sctp_rcv().

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)
• kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
• kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)
• kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)
• kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)
• kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)
• kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)
• kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)
• kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)
• kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)
• kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)
• kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

sctp: linearize cloned gso packets in sctp_rcv

A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs.

syzbot reported two use-of-uninitialized-memory bugs caused by this:

BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline]

and

BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline]

This patch fixes it by linearizing cloned gso packets in sctp_rcv().

In the Linux kernel, the following vulnerability has been resolved:

sctp: linearize cloned gso packets in sctp_rcv

A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs.

syzbot reported two use-of-uninitialized-memory bugs caused by this:

BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline]

and

BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline]

This patch fixes it by linearizing cloned gso packets in sctp_rcv().

• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
• netfilter: ipset: Fix suspicious rcu_dereference_protected() {CVE-2024-40993}
• netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type {CVE-2024-39503}
• netfilter: ipset: Missing gc cancellations fixed {CVE-2024-39503}
• netfilter: ipset: Add list flush to cancel_gc {CVE-2024-39503}
• netfilter: ipset: fix performance regression in swap operation {CVE-2024-26910}
• netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test {CVE-2024-26910}
• scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• scsi: mpt3sas: Fix a memory leak {CVE-2023-53512}
• scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() {CVE-2023-53464}
• wifi: ath11k: fix deinitialization of firmware resources {CVE-2023-53532}
• mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() {CVE-2022-50464}
• ionic: catch failure from devlink_alloc {CVE-2023-53470}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
• gpiolib: cdev: fix uninitialised kfifo {CVE-2024-36898}
• Bluetooth: hci_conn: Fix crash on hci_create_cis_sync {CVE-2022-50447}
• net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP {CVE-2024-36974}
• ext4: Fix function prototype mismatch for ext4_feat_ktype {CVE-2023-53224}
• ipv6: Add lwtunnel encap size of all siblings in nexthop calculation {CVE-2023-53477}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• netfilter: nf_conntrack: fix crash due to removal of uninitialised entry {CVE-2025-38472}
• Bluetooth: qca: add missing firmware sanity checks {CVE-2024-36880}
• Bluetooth: qca: fix info leak when fetching fw build id {CVE-2024-36032}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
• drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876}
• drm/vc4: don't check if plane->state->fb == state->fb {CVE-2024-35932}
• drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create {CVE-2023-53263}
• cifs: fix oops during encryption {CVE-2022-50341}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
• smb: client: fix race with concurrent opens in rename(2) {CVE-2025-39825}
• ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL {CVE-2023-52697}
• blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none {CVE-2023-53292}
• mlx5: fix possible ptp queue fifo use-after-free {CVE-2023-53398}
• sctp: check send stream number after wait_for_sndbuf {CVE-2023-53296}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• scsi: mpi3mr: Use number of bits to manage bitmap sizes {CVE-2023-53376}
• scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue {CVE-2023-53280}
• mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data {CVE-2023-53232}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
• fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value {CVE-2022-50327}
• media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() {CVE-2023-53220}
• media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() {CVE-2022-50272}

• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• wifi: mac80211: check S1G action frame size {CVE-2023-53257} {CVE-2023-53257}
• wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864} {CVE-2025-39864}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796} {CVE-2025-37796}
• dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939} {CVE-2024-35939}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386} {CVE-2022-50386}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937} {CVE-2024-35937}
• nfs: fix UAF in direct writes {CVE-2024-26958} {CVE-2024-26958}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921} {CVE-2024-36921}
• net/smc: avoid data corruption caused by decline {CVE-2023-52775} {CVE-2023-52775}
• bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487} {CVE-2024-39487}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978} {CVE-2024-40978}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961} {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864} {CVE-2023-52864}
• net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739} {CVE-2024-26739}
• drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876} {CVE-2024-57876}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556} {CVE-2024-38556}
• of: Fix double free in of_parse_phandle_with_args_map {CVE-2023-52679} {CVE-2023-52679}
• xhci: Handle TD clearing for multiple streams case {CVE-2024-40927} {CVE-2024-40927}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530} {CVE-2023-52530}
• net: openvswitch: Fix Use-After-Free in ovs_ct_exit {CVE-2024-27395} {CVE-2024-27395}
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586} {CVE-2024-38586}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764} {CVE-2023-52764}
• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556} {CVE-2025-38556}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713} {CVE-2024-46713}
• net_sched: hfsc: Fix a UAF vulnerability in class handling {CVE-2025-37797} {CVE-2025-37797}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused dualmac control leftovers {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused timer and related code {CVE-2024-58072} {CVE-2024-58072}
• ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121} {CVE-2025-22121}
• ext4: move where set the MAY_INLINE_DATA flag is set {CVE-2025-22121} {CVE-2025-22121}
• ext4: introduce ITAIL helper {CVE-2025-22121} {CVE-2025-22121}
• ext4: improve xattr consistency checking and error reporting {CVE-2025-22121} {CVE-2025-22121}
• mm: fix zswap writeback race condition {CVE-2023-53178} {CVE-2023-53178}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367} {CVE-2022-50367}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527} {CVE-2025-38527} -…

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087} {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836} {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621} {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519} {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738} {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292} {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704} {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214} {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659} {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929} {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407} {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759} {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985} {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001} {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185} {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044} {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867} {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073} {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804} {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581} {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868} {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145} {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332} {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498} {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119} {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408} {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229} {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570} {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125} {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592} {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373} {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718} {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace…

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 {CVE-2022-50228}
• soundwire: cadence: fix invalid PDI offset {CVE-2024-38635}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans {CVE-2023-53034}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
• NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• scsi:…

• drm/amd/display: Skip on writeback when it's not applicable {CVE-2024-36914}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
• net/rds: Fix rs_recv_pending counting issue
• LTS tag: v5.4.301
• net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
• media: s5p-mfc: remove an unused/uninitialized variable
• NFSD: Fix last write offset handling in layoutcommit
• NFSD: Minor cleanup in layoutcommit processing
• padata: Reset next CPU when reorder sequence wraps around
• KEYS: trusted_tpm1: Compare HMAC values in constant time
• NFSD: Define a proc_layoutcommit for the FlexFiles layout type {CVE-2025-40087}
• vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
• jbd2: ensure that all ongoing I/O complete before freeing blocks
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• drm/amdgpu: use atomic functions with memory barriers for vm fault info
• ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() {CVE-2025-40198}
• spi: cadence-quadspi: Flush posted register writes before DAC access
• spi: cadence-quadspi: Flush posted register writes before INDAC access
• memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
• memory: samsung: exynos-srom: Correct alignment
• arm64: errata: Apply workarounds for Neoverse-V3AE
• arm64: cputype: Add Neoverse-V3AE definitions
• comedi: fix divide-by-zero in comedi_buf_munge() {CVE-2025-40106}
• binder: remove "invalid inc weak" check
• xhci: dbc: enable back DbC in resume if it was enabled before suspend
• usb/core/quirks: Add Huawei ME906S to wakeup quirk
• USB: serial: option: add Telit FN920C04 ECM compositions
• USB: serial: option: add Quectel RG255C
• USB: serial: option: add UNISOC UIS7720
• net: ravb: Ensure memory write completes before ringing TX doorbell
• net: usb: rtl8150: Fix frame padding
• ocfs2: clear extent cache after moving/defragmenting extents
• MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
• Revert "cpuidle: menu: Avoid discarding useful information"
• net: bonding: fix possible peer notify event loss or dup issue
• sctp: avoid NULL dereference when chunk data buffer is missing
• arm64, mm: avoid always making PTE dirty in pte_mkwrite()
• net: enetc: correct the value of ENETC_RXB_TRUESIZE
• rtnetlink: Allow deleting FDB entries in user namespace
• net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
• net: add ndo_fdb_del_bulk
• net: rtnetlink: add bulk delete support flag
• net: netlink: add NLM_F_BULK delete request modifier
• net: rtnetlink: use BIT for flag values
• net: rtnetlink: add helper to extract msg type's kind
• net: rtnetlink: add msg kind names
• net: rtnetlink: remove redundant assignment to variable err
• m68k: bitops: Fix find_*_bit() signatures
• hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
• hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
• dlm: check for defined force value in dlm_lockspace_release
• hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
• hfs: validate record offset in hfsplus_bmap_alloc
• hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
• hfs: make proper initalization of struct hfs_find_data
• hfs: clear offset and space out of valid records in b-tree node
• exec: Fix incorrect type for ret
• hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() {CVE-2025-40088}
• ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
• sched/fair: Fix pelt lost idle time…

• xfrm: Duplicate SPI Handling {CVE-2025-39965}
• xfrm: state: use atomic_inc_not_zero to increment refcount
• padata: Fix pd UAF once and for all {CVE-2025-38584}
• padata: Remove broken queue flushing {CVE-2023-52854}
• padata: ensure padata_do_serial() runs on the correct CPU
• Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put {CVE-2022-3640}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• vt: Clear selection before changing the font {CVE-2022-49948}
• fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• dm raid: fix address sanitizer warning in raid_status {CVE-2022-50084}
• dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
• net_sched: hfsc: Fix a UAF vulnerability in class handling
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}

• xfrm: Duplicate SPI Handling {CVE-2025-39965}
• xfrm: state: use atomic_inc_not_zero to increment refcount
• padata: Fix pd UAF once and for all {CVE-2025-38584}
• padata: Remove broken queue flushing {CVE-2023-52854}
• padata: ensure padata_do_serial() runs on the correct CPU
• Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put {CVE-2022-3640}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• vt: Clear selection before changing the font {CVE-2022-49948}
• fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• dm raid: fix address sanitizer warning in raid_status {CVE-2022-50084}
• dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
• net_sched: hfsc: Fix a UAF vulnerability in class handling
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}

• xfrm: Duplicate SPI Handling {CVE-2025-39965}
• xfrm: state: use atomic_inc_not_zero to increment refcount
• padata: Fix pd UAF once and for all {CVE-2025-38584}
• padata: Remove broken queue flushing {CVE-2023-52854}
• padata: ensure padata_do_serial() runs on the correct CPU
• Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put {CVE-2022-3640}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• vt: Clear selection before changing the font {CVE-2022-49948}
• fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• dm raid: fix address sanitizer warning in raid_status {CVE-2022-50084}
• dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
• net_sched: hfsc: Fix a UAF vulnerability in class handling
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}

• CVE-2026-46113
  • KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50082
  • ext4: fix warning in ext4_iomap_begin as race between bmap and write {CVE-2022-50082}
• CVE-2026-43052
  • wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• CVE-2026-43386
  • staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386}
• CVE-2026-23281
  • wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• CVE-2026-43141
  • ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut {CVE-2026-43141}
• CVE-2026-23209
  • macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• CVE-2026-23001
  • macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
• CVE-2026-31532
  • can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• CVE-2026-31688
  • driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• CVE-2023-53680
  • NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• CVE-2025-38718
  • sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• CVE-2025-38102
  • VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• CVE-2024-42120
  • drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• CVE-2022-50093
  • iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• CVE-2022-50410
  • NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-50410}
• CVE-2026-23234
  • f2fs: fix to avoid UAF in f2fs_write_end_io() {CVE-2026-23234}
• CVE-2026-43203
  • atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203}
• CVE-2026-43373
  • net: ncsi: fix skb leak in error paths {CVE-2026-43373}
• CVE-2026-43450
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• CVE-2026-31399
  • nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• CVE-2026-43449
  • nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
• CVE-2026-43427
  • usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• CVE-2026-31452
  • ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• CVE-2026-23397
  • nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• CVE-2025-71082
  • Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• CVE-2025-39955
  • tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• CVE-2022-49770
  • ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• CVE-2026-43283
  • net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle {CVE-2026-43283}
• Bump ABI 4.15.0-261

• CVE-2026-46113
  • KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50082
  • ext4: fix warning in ext4_iomap_begin as race between bmap and write {CVE-2022-50082}
• CVE-2026-43052
  • wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• CVE-2026-43386
  • staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386}
• CVE-2026-23281
  • wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• CVE-2026-43141
  • ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut {CVE-2026-43141}
• CVE-2026-23209
  • macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• CVE-2026-23001
  • macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
• CVE-2026-31532
  • can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• CVE-2026-31688
  • driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• CVE-2023-53680
  • NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• CVE-2025-38718
  • sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• CVE-2025-38102
  • VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• CVE-2024-42120
  • drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• CVE-2022-50093
  • iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• CVE-2022-50410
  • NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-50410}
• CVE-2026-23234
  • f2fs: fix to avoid UAF in f2fs_write_end_io() {CVE-2026-23234}
• CVE-2026-43203
  • atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203}
• CVE-2026-43373
  • net: ncsi: fix skb leak in error paths {CVE-2026-43373}
• CVE-2026-43450
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• CVE-2026-31399
  • nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• CVE-2026-43449
  • nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
• CVE-2026-43427
  • usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• CVE-2026-31452
  • ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• CVE-2026-23397
  • nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• CVE-2025-71082
  • Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• CVE-2025-39955
  • tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• CVE-2022-49770
  • ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• CVE-2026-43283
  • net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle {CVE-2026-43283}
• Bump ABI 4.15.0-261

• Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
• CVE-2021-46984
  • kyber: fix out of bounds access when preempted {CVE-2021-46984}
• CVE-2021-47049
  • Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• CVE-2021-47101
  • asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• CVE-2021-47191
  • scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• CVE-2021-47352
  • virtio-net: Add validation for used length {CVE-2021-47352}
• CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
• CVE-2022-21546
  • scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• CVE-2022-39189
  • KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• CVE-2022-43945
  • SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
  • NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2022-49975
  • bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
  • bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2022-50103
  • sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• CVE-2022-50129
  • RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
  • RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50406
  • iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• CVE-2023-52434
  • smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• CVE-2023-52515
  • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• CVE-2023-52741
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• CVE-2023-53000
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• CVE-2023-53039
  • workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
  • devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
  • devm-helpers: Add resource managed version of work init {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
• CVE-2023-53111
  • loop: Fix use-after-free issues {CVE-2023-53111}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

Vanilla upstream kernel version 6.6.105 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.