From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9AA1139E6C9 for ; Sat, 22 Aug 2026 15:35:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787412952; cv=none; b=T66LYkL+ycPn1Fv2KwL+ag4KpwcshJtF0DbPr0CJaRfDAWNwvoaQFpit0RdscRAj59jApD5oJF7UnNsRR+roH+lbrthZpfMbsPrfJQAI5dXzhD0h8pleKHXyiqt6dNbpTUtdPwl4GYfZOoUNA93WNDOCEyR/7XAdHA3feoiz+E8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787412952; c=relaxed/simple; bh=Nn5pQocY+uKO2j7RZxUvqkmRntS5+gpI+j2rQev3AHM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SWjtFKEzd3218QQga1jOP9zKokNwEZECNi0y5BTBJbCg44CyaqPK4CD+I40UkqrhAgELArlKZXFZJ/VuUhIRTjHEs7C6Xsc//0+Nj08EDc3P8rZgsmZ2v/ZQ4F5g3cw6HLiG86VADUyaUTlth6y7OVoP6yMrVftR5J/R/zYB3FM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GPLSfFo2; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="GPLSfFo2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BA17E1F000E9; Sat, 22 Aug 2026 15:35:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787412951; bh=wsUIwzNCbAXfrmbFDPTSbp7dIAUW1ZjG1Mh1adQf9cQ=; h=From:To:Cc:Subject:Date:Reply-To; b=GPLSfFo2QpvKfjY8RraDR2toz2i/ambEykBp14zq3Zpv1o4ix9Uy41TPQRmUO19xU F1Mj4nVJ+kP+A6S1pYlbXBDVj6boZ55HTBQ62QIiUAIyiuQf0VJnHpU/9zPOmoi2eZ lsxxqH4TPVx/wCTILqcAmIfQ0r3WvKYeLxMSndZA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74617: dibs: initialise dibs->lock in dibs_dev_alloc() Date: Sat, 22 Aug 2026 17:31:41 +0200 Message-ID: <2026082218-CVE-2026-74617-52a0@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2562; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=5Elm5TzMnDiOptI4q8JWxNXfHbZw6TCKeUV6tWAE8wM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmdB479Ktrhw9gt9/r1BvnOxDVtAs71yi+YhJ4adp3J+ ma+Qm5DRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEwk9hHDPG0zh4rQySJSrefl QifPNVP2XdMwiWFBS7X6qZIFETsY1f4uWu471/qT8f5tAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), and hence request_irq(), before it calls dibs_dev_add(). No client can have registered a dmb at that point, so no dmb interrupt can occur, but a GID event interrupt can, and ism_handle_irq() takes dibs->lock unconditionally on entry, before it inspects anything else. Initialise the lock in dibs_dev_alloc() instead, so that it is valid as soon as a driver can publish the device to its interrupt handler. The Linux kernel CVE team has assigned CVE-2026-74617 to this issue. Affected and fixed versions =========================== Issue introduced in 6.18 with commit cc21191b584c6f7836b0f10774f8278b7cbfba10 and fixed in 6.18.45 with commit fe79571f40434b257d68cbfb7b3ae93a794d8a11 Issue introduced in 6.18 with commit cc21191b584c6f7836b0f10774f8278b7cbfba10 and fixed in 7.1.9 with commit 2926031acba100d0c18fcfaa7a2ed29609318848 Issue introduced in 6.18 with commit cc21191b584c6f7836b0f10774f8278b7cbfba10 and fixed in 7.2 with commit c27e360545373b7aee9862a5beef3b9fb3df0c25 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74617 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/dibs/dibs_main.c include/linux/dibs.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/fe79571f40434b257d68cbfb7b3ae93a794d8a11 https://git.kernel.org/stable/c/2926031acba100d0c18fcfaa7a2ed29609318848 https://git.kernel.org/stable/c/c27e360545373b7aee9862a5beef3b9fb3df0c25