{"id":"OESA-2026-4359","summary":"kernel security update","details":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbus: fsl-mc: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1](CVE-2026-53115)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1](CVE-2026-53118)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsched/psi: Shut down rtpoll_timer in psi_cgroup_free()\n\npsi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath\nand can race psi_trigger_destroy() taking down the last rtpoll trigger under\nrtpoll_trigger_lock:\n\n  psi_schedule_rtpoll_work()        psi_trigger_destroy()\n\n  rcu_read_lock();\n  task = rcu_dereference(rtpoll_task);\n                                    rcu_assign_pointer(rtpoll_task, NULL);\n                                    timer_delete(&rtpoll_timer);\n  mod_timer(&rtpoll_timer, ...);\n  rcu_read_unlock();\n                                    synchronize_rcu();\n                                    kthread_stop(task_to_destroy);\n\nThe group can then be freed with the re-armed timer still pending, and\npoll_timer_fn() runs on freed memory.\n\n461daba06bdc ("psi: eliminate kthread_worker from psi trigger scheduling\nmechanism") deleted the timer synchronously after the synchronize_rcu(),\nwhich prevented this but raced trigger creation instead: the deletion could\ncancel the timer that a new trigger set armed during the grace period and,\nas creation also reinitialized the timer at the time, corrupt it.\n8f91efd870ea ("psi: Fix race between psi_trigger_create/destroy") moved the\ninitialization into group_init() and the deletion into the locked section,\ntrading the creation races for the window above.\n\nNeither placement in the destruction path works. A pending timer firing\nwhile the group is alive is harmless though. poll_timer_fn() just wakes the\nrtpoll waitqueue and doesn't re-arm itself. Bind the timer to the group's\nlifetime instead and shut it down in psi_cgroup_free(). Nothing can arm it\nby then. timer_shutdown_sync() because the timer is never armed again.(CVE-2026-74594)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: properly validate BIG TCP aggregation criteria\n\nWhen GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),\nBIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP\n(with sufficient MAC header room to insert the temporary HBH jumbo header).\n\nHowever, commit b1a78b9b9886 ("net: add support for ipv4 big tcp")\nloosened the check in skb_gro_receive(), leading to several issues:\n\n1. skb_gro_receive() checked skb_headroom(p) instead of the actual space\n   before the MAC header (p->mac_header). Because skb_headroom(p) includes\n   mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check\n   with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the\n   temporary HBH jumbo header, the memmove() starts before skb->head,\n   causing an out-of-bounds write and wrapping skb->mac_header.\n2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /\n   ETH_P_8021AD) to aggregate beyond 64KB because\n   p->protocol != ETH_P_IPV6 was true.\n3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark,\n   allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate\n   beyond 64KB.\n\nFix skb_gro_receive() to strictly enforce:\n- NAPI_GRO_CB(skb)->proto == IPPROTO_TCP\n- Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation)\n- Protocol must be either ETH_P_IP or ETH_P_IPV6\n- If ETH_P_IPV6, p->mac_header must be at least\n  sizeof(struct hop_jumbo_hdr)\n\nReturning -E2BIG from skb_gro_receive() ensures that packets which cannot\nbecome BIG TCP are cleanly flushed at <= 64KB and delivered intact without\ndropping.\n\nThis issue does not exist in mainline (7.0+) because the subsystem was\nrewritten in commit 81be30c1f5f2 ("net/ipv6: Drop HBH for BIG TCP on RX\nside"), making this fix relevant only for older stable branches like\n6.18.y.(CVE-2026-80725)","modified":"2026-10-16T12:15:14.443973421Z","published":"2026-10-16T11:59:45Z","upstream":["CVE-2026-53115","CVE-2026-53118","CVE-2026-74594","CVE-2026-80725"],"database_specific":{"severity":"High"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4359"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53115"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53118"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74594"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80725"}],"affected":[{"package":{"name":"kernel","ecosystem":"openEuler:24.03-LTS-SP3","purl":"pkg:rpm/openEuler/kernel&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.3.35.166.oe2403sp3"}]}],"ecosystem_specific":{"x86_64":["bpftool-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","bpftool-debuginfo-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-debuginfo-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-debugsource-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-devel-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-extra-modules-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-headers-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-source-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-tools-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-tools-debuginfo-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","kernel-tools-devel-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","perf-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","perf-debuginfo-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","python3-perf-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm","python3-perf-debuginfo-6.6.0-145.3.35.166.oe2403sp3.x86_64.rpm"],"aarch64":["bpftool-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","bpftool-debuginfo-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-debuginfo-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-debugsource-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-devel-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-extra-modules-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-headers-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-source-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-tools-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-tools-debuginfo-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","kernel-tools-devel-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","perf-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","perf-debuginfo-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","python3-perf-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm","python3-perf-debuginfo-6.6.0-145.3.35.166.oe2403sp3.aarch64.rpm"],"src":["kernel-6.6.0-145.3.35.166.oe2403sp3.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-4359.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}