[OE-core][PATCH v4 0/8] cve-exclusions: triage eight kernel CVEs lacking upstream fix data

[Junjie Cao <junjie.cao@linux.dev>]

This is v4 of the kernel CVE triage from Paul Barker's "linux-yocto
CVEs in need of triage" request, reworked according to his review of
v3 [1].

Changes since v3:

- Seven entries adopt the comment and CVE_STATUS wordings suggested in
  [1], including triage dates and distribution tracker links in the
  .inc comments; the CVE-2022-1247 entry was approved as-is and is
  unchanged. Commit message detail flagged as unnecessary or
  time-consuming to validate is dropped. One deviation: the
  CVE-2023-6238 status reads "Proposed fix was not merged" rather than
  "withdrawn" - the fix was backed out by the nvme maintainer, not
  withdrawn by its author - matching the comment above the entry.

- CVE-2022-0400 stays out of this series as agreed. Red Hat PSIRT has
  since answered the request for details (ticket PSIRTSUPT-22046) and
  named the affected code; it is the issue fixed in v6.13 that
  upstream tracks as CVE-2024-49568, with the details recorded on the
  public bug [2]. A separate patch records the fixed-version status.

Summary of the eight verdicts:

  fixed-version   CVE-2022-1247   6.17, rose_neigh refcount conversion
  unpatched       CVE-2019-14899  weak host model, no upstream fix
                  CVE-2021-3714   inherent to KSM deduplication
                  CVE-2021-3864   proposed fixes not merged
                  CVE-2022-4543   EntryBleed, no fix proposed
                  CVE-2023-3397   JFS UAF, proposed fix withdrawn
                  CVE-2023-6238   NVMe passthrough, fix not merged
                  CVE-2023-6240   Marvin oracle, fixed only in RHEL

AI assistance is disclosed with the AI-Generated trailer on each patch.

Once these are settled I can prepare the wrynose and scarthgap
backports.

[1] https://lore.kernel.org/openembedded-core/7b18fd3a5e6b660b9c605671da2b188b5abbf4ba.camel@pbarker.dev/
[2] https://bugzilla.redhat.com/show_bug.cgi?id=2044575

v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/
v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/

Junjie Cao (8):
  cve-exclusions: set status for CVE-2019-14899
  cve-exclusions: set status for CVE-2021-3714
  cve-exclusions: set status for CVE-2021-3864
  cve-exclusions: set status for CVE-2022-1247
  cve-exclusions: set status for CVE-2022-4543
  cve-exclusions: set status for CVE-2023-3397
  cve-exclusions: set status for CVE-2023-6238
  cve-exclusions: set status for CVE-2023-6240

 meta/recipes-kernel/linux/cve-exclusion.inc | 68 +++++++++++++++++++++
 1 file changed, 68 insertions(+)

-- 
2.43.0