[OE-core][PATCH] cve-exclusion: set status for 7 kernel CVEs lacking upstream fix data

[OE-core][PATCH] cve-exclusion: set status for 7 kernel CVEs lacking upstream fix data

[Junjie Cao]

Triage results for seven of the CVEs listed in the "linux-yocto CVEs
in need of triage" request [1]. All of these predate the kernel.org
CNA, so no upstream fix version will ever be backfilled automatically;
each verdict was established from distro security trackers, mailing
list history and inspection of current mainline source (linux-next
20260727).

* CVE-2019-14899: VPN tunnel TCP inference. No kernel fix exists or is
  planned; mitigations are firewall configuration only. Ubuntu has
  deferred it since 2019-12-13; Debian does not track it against the
  kernel; Red Hat tracks it against openvpn.

* CVE-2021-3714: KSM dedup side channel. Red Hat closed it WONTFIX
  (bz#1931327); Debian marks it "Inherent design limitation". Only
  reachable when ksmd is started and the workload opts in via
  MADV_MERGEABLE / PR_SET_MEMORY_MERGE.

* CVE-2021-3864: setuid coredump privilege escalation. Both proposed
  fixes were rejected or abandoned (links in the file); the flagged
  fs/exec.c logic is unchanged in current mainline. Exploitation
  requires a relative kernel.core_pattern, which piped/absolute
  patterns (e.g. systemd-coredump) prevent.

* CVE-2022-0400: net/smc out-of-bounds read. Closed NOTABUG by Red Hat
  (bz#2044575), INVALID by SUSE (bsc#1195329), "non issue" by Debian;
  no affected version or upstream commit was ever identified.

* CVE-2022-1247: rose_connect() refcount race. Fixed in v6.17 by
  d860d1faa6b2 + da9c9c877597 ("net: rose: convert 'use' field to
  refcount_t"), whose commit message matches the CVE description and
  which removes the exact rose->neighbour->use++ increment the CVE
  describes; backported to 6.1.y/6.6.y/6.12.y/6.16.y. The rose/
  hamradio subsystem was subsequently removed in v7.1 (dd8d4bc28ad7).
  Distro trackers have not yet connected the fix to this CVE.

* CVE-2022-4543: "EntryBleed" KASLR bypass. No fix; upstream position
  is that KASLR does not defend against local attackers. Explicitly
  not fixed by 97e3d26b5e5f, which randomizes the separate
  cpu_entry_area (that is CVE-2023-3640).

* CVE-2023-4010: the function named by the CVE, usb_giveback_urb(),
  does not exist in the kernel; the reporter's PoC exercises the
  unthrottled URB resubmit loop in drivers/media/rc/imon.c, stopped by
  eecd203ada43 ("media: imon: make send_packet() more robust") in
  v6.18. The commit carries no CVE reference, so this tie is inferred
  from the commit content and the reporter's PoC output - flagging for
  review.

Of the remaining CVEs in [1], CVE-2023-3397 (JFS txEnd UAF, still
reproduced by syzbot in 2026-06), CVE-2023-6238 (NVMe passthrough
metadata DMA overflow, fix was merged to nvme-6.6 then backed out and
never re-landed; kernels < v6.2 unaffected) and CVE-2023-6240 (Marvin
RSA timing oracle, fixed only in RHEL downstream) are genuinely
unfixed upstream and are deliberately not excluded here; detailed
analysis posted in the thread.

[1] https://lore.kernel.org/all/4ac849a706feb16688020d5bcc3e74aececd63cf.camel@pbarker.dev/

Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
 meta/recipes-kernel/linux/cve-exclusion.inc | 59 +++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index d27d764..8d98c61 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -192,3 +192,62 @@ CVE_STATUS[CVE-2025-68195] = "fixed-version: Fixed from 6.18"
 # Fix https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3
 # Backport https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906
 CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
+
+# No kernel fix exists or is planned; this is a consequence of Linux's
+# default weak host model. Mitigation is firewall configuration only
+# (e.g. the strong-host-model rule wg-quick(8) installs); IPv4 rp_filter
+# does not cover IPv6. Ubuntu: deferred since 2019-12-13; Red Hat tracks
+# it against openvpn; Debian does not track it against the kernel.
+CVE_STATUS[CVE-2019-14899] = "upstream-wontfix: no kernel fix exists or is \
+planned; weak host model design issue, mitigated by firewall configuration"
+
+# Inherent design property of KSM, not fixable without removing dedup.
+# Red Hat https://bugzilla.redhat.com/show_bug.cgi?id=1931327 CLOSED WONTFIX;
+# Debian: "Inherent design limitation, can be avoided by not using KSM".
+# Only exploitable when ksmd is enabled at runtime (default off) and the
+# workload opts in via MADV_MERGEABLE or PR_SET_MEMORY_MERGE.
+CVE_STATUS[CVE-2021-3714] = "upstream-wontfix: KSM memory deduplication \
+side channel is an inherent design limitation, Red Hat WONTFIX, no \
+upstream fix planned"
+
+# Proposed fixes were rejected or abandoned without a merge
+# (https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/,
+# https://lore.kernel.org/all/20211228170910.623156-1-wander@redhat.com/)
+# and the flagged fs/exec.c logic is unchanged as of linux-next 20260727.
+# Exploitation requires a relative kernel.core_pattern; a piped or
+# absolute core_pattern (e.g. systemd-coredump) prevents the issue.
+CVE_STATUS[CVE-2021-3864] = "upstream-wontfix: no accepted mainline fix \
+after several attempts; requires relative kernel.core_pattern to exploit"
+
+# Never substantiated: Red Hat
+# https://bugzilla.redhat.com/show_bug.cgi?id=2044575 CLOSED NOTABUG,
+# SUSE bugzilla #1195329 RESOLVED INVALID, Debian: "non issue, no
+# security impact". No affected version or upstream commit was ever
+# identified.
+CVE_STATUS[CVE-2022-0400] = "disputed: net/smc out-of-bounds read was \
+never substantiated and was closed as not-a-bug by Red Hat, SUSE and Debian"
+
+# Fix https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061
+# Fix https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45
+# rose->neighbour->use converted to refcount_t, removing the unlocked
+# use++ in rose_connect() that the CVE describes; backported to 6.1.y,
+# 6.6.y, 6.12.y and 6.16.y. The rose/hamradio subsystem was then removed
+# entirely in v7.1 (dd8d4bc28ad7).
+CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17"
+
+# EntryBleed (KASLR bypass via prefetch timing under KPTI, Intel x86
+# only). Entry text is still mapped _PAGE_GLOBAL into user page tables
+# (arch/x86/mm/pti.c). Upstream and Debian position is that KASLR is not
+# a boundary against local attackers. Note: v6.2 97e3d26b5e5f randomizes
+# the separate cpu_entry_area (that is CVE-2023-3640) and does not fix
+# this.
+CVE_STATUS[CVE-2022-4543] = "upstream-wontfix: no fix planned; KASLR is \
+not considered a defense against local attackers"
+
+# Fix https://git.kernel.org/linus/eecd203ada43a4693ce6fdd3a58ae10c7819252c
+# The CVE text names usb_giveback_urb() which does not exist in the
+# kernel; the reporter's PoC actually exercises the unthrottled URB
+# resubmit loop in drivers/media/rc/imon.c (printk flood on -EPROTO,
+# requires physical device access). The commit above stops the resubmit
+# loop. Ubuntu triage: "There is no system lockup happening."
+CVE_STATUS[CVE-2023-4010] = "fixed-version: Fixed from version 6.18"
-- 
2.43.0

Re: [OE-core][PATCH] cve-exclusion: set status for 7 kernel CVEs lacking upstream fix data

[Paul Barker]

[-- Attachment #1: Type: text/plain, Size: 4086 bytes --]

On Sun, 2026-08-02 at 07:34 -0700, Junjie Cao wrote:
> Triage results for seven of the CVEs listed in the "linux-yocto CVEs
> in need of triage" request [1]. All of these predate the kernel.org
> CNA, so no upstream fix version will ever be backfilled automatically;
> each verdict was established from distro security trackers, mailing
> list history and inspection of current mainline source (linux-next
> 20260727).
> 
> * CVE-2019-14899: VPN tunnel TCP inference. No kernel fix exists or is
>   planned; mitigations are firewall configuration only. Ubuntu has
>   deferred it since 2019-12-13; Debian does not track it against the
>   kernel; Red Hat tracks it against openvpn.
> 
> * CVE-2021-3714: KSM dedup side channel. Red Hat closed it WONTFIX
>   (bz#1931327); Debian marks it "Inherent design limitation". Only
>   reachable when ksmd is started and the workload opts in via
>   MADV_MERGEABLE / PR_SET_MEMORY_MERGE.
> 
> * CVE-2021-3864: setuid coredump privilege escalation. Both proposed
>   fixes were rejected or abandoned (links in the file); the flagged
>   fs/exec.c logic is unchanged in current mainline. Exploitation
>   requires a relative kernel.core_pattern, which piped/absolute
>   patterns (e.g. systemd-coredump) prevent.
> 
> * CVE-2022-0400: net/smc out-of-bounds read. Closed NOTABUG by Red Hat
>   (bz#2044575), INVALID by SUSE (bsc#1195329), "non issue" by Debian;
>   no affected version or upstream commit was ever identified.
> 
> * CVE-2022-1247: rose_connect() refcount race. Fixed in v6.17 by
>   d860d1faa6b2 + da9c9c877597 ("net: rose: convert 'use' field to
>   refcount_t"), whose commit message matches the CVE description and
>   which removes the exact rose->neighbour->use++ increment the CVE
>   describes; backported to 6.1.y/6.6.y/6.12.y/6.16.y. The rose/
>   hamradio subsystem was subsequently removed in v7.1 (dd8d4bc28ad7).
>   Distro trackers have not yet connected the fix to this CVE.
> 
> * CVE-2022-4543: "EntryBleed" KASLR bypass. No fix; upstream position
>   is that KASLR does not defend against local attackers. Explicitly
>   not fixed by 97e3d26b5e5f, which randomizes the separate
>   cpu_entry_area (that is CVE-2023-3640).
> 
> * CVE-2023-4010: the function named by the CVE, usb_giveback_urb(),
>   does not exist in the kernel; the reporter's PoC exercises the
>   unthrottled URB resubmit loop in drivers/media/rc/imon.c, stopped by
>   eecd203ada43 ("media: imon: make send_packet() more robust") in
>   v6.18. The commit carries no CVE reference, so this tie is inferred
>   from the commit content and the reporter's PoC output - flagging for
>   review.
> 
> Of the remaining CVEs in [1], CVE-2023-3397 (JFS txEnd UAF, still
> reproduced by syzbot in 2026-06), CVE-2023-6238 (NVMe passthrough
> metadata DMA overflow, fix was merged to nvme-6.6 then backed out and
> never re-landed; kernels < v6.2 unaffected) and CVE-2023-6240 (Marvin
> RSA timing oracle, fixed only in RHEL downstream) are genuinely
> unfixed upstream and are deliberately not excluded here; detailed
> analysis posted in the thread.
> 
> [1] https://lore.kernel.org/all/4ac849a706feb16688020d5bcc3e74aececd63cf.camel@pbarker.dev/
> 
> Signed-off-by: Junjie Cao <junjie.cao@linux.dev>

Hi,

Thanks for looking into these! This is a good start but we need a little
more before we can accept the additions to cve-exclusion.inc.

Please send these as separate patches for each CVE, and including links
to relevant sources in the commit messages. We need enough information
on each for users to be confident that the conclusion in CVE_STATUS is
correct.

Please also include the three unpatched CVEs, you can use CVE_STATUS
"unpatched: ..." - that will help anyone else looking at these in the
future to avoid duplication of effort.

Please also make sure any use of AI is disclosed in line with our
contribution guide [1].

[1]: https://docs.yoctoproject.org/contributor-guide/submit-changes.html#acceptance-of-ai-generated-code

Thanks,

-- 
Paul Barker


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]