[ANNOUNCE] Release v4.19.325-cip135

[ANNOUNCE] Release v4.19.325-cip135

[Ulrich Hecht]

Hi,

the CIP kernel team has released Linux kernel v4.19.325-cip135. The linux-4.19.y-cip tree's base version has been updated to v4.19-st19. The trees are up-to-date with kernel 5.10.260.

You can get this release via the git tree or as a tarball from https://mirrors.edge.kernel.org/pub/linux/kernel/projects/cip/4.19/

  v4.19.325-cip135:
    repository:
      https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git
    branch:
      linux-4.19.y-cip
    commit hash:
      ba1643922563de1987b5cb0ed4a4b869ae1c3147
    Fixed CVEs:
      CVE-2021-47211: ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
      CVE-2022-50114: net: 9p: fix refcount leak in p9_read_work() error handling
      CVE-2025-40164: usbnet: Fix using smp_processor_id() in preemptible code warnings
      CVE-2025-68340: team: Move team device type change at the end of team_port_add
      CVE-2025-10263: TLBI errata in some Arm-based CPUs may allow writes to resources owned by a higher exception level, potentially allowing privilege escalation
      CVE-2025-23131: dlm: prevent NPD when writing a positive value to event_done
      CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache corruption
      CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device.
      CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period.
      CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling
      CVE-2026-52929: sctp: stream: fully roll back denied add-stream state
      CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates
      CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
      CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
      CVE-2026-52948: i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
      CVE-2026-53138: drm/amd/display: Bound VBIOS record-chain walk loops
      CVE-2026-53146: thunderbolt: Limit XDomain response copy to actual frame size
      CVE-2026-53148: thunderbolt: Clamp XDomain response data copy to allocation size
      CVE-2026-53149: thunderbolt: Bound root directory content to block size
      CVE-2026-53150: thunderbolt: Reject zero-length property entries in validator
      CVE-2026-53157: net: phonet: free phonet_device after RCU grace period
      CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
      CVE-2026-53177: bnxt_en: Fix NULL pointer dereference
      CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake
      CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length
      CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put()
      CVE-2026-53194: USB: serial: kl5kusb105: fix bulk-out buffer overflow
      CVE-2026-53195: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
      CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info()
      CVE-2026-53208: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
      CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy
      CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
      CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers
      CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
      CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs
      CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
      CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR
      CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads
      CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
      CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
      CVE-2026-53255: Bluetooth: MGMT: validate advertising TLV before type checks
      CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
      CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression
      CVE-2026-53265: dm cache policy smq: check allocation under invalidate lock
      CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable
      CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read
      CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit
      CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant
      CVE-2026-53325: agp/amd64: Fix broken error propagation in agp_amd64_probe()
      CVE-2026-53329: drm/amd/display: Use krealloc_array() in dal_vector_reserve()
      CVE-2026-53352: signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
      CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
      CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure
      CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
      CVE-2026-63796: ocfs2: reject oversized group bitmap descriptors
      CVE-2026-63814: f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
      CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto
      CVE-2026-63834: batman-adv: tp_meter: restrict number of unacked list entries
      CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
      CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
      CVE-2026-63870: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
      CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
      CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length
      CVE-2026-64249: fpga: region: fix use-after-free in child_regions_with_firmware()
      CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes
      CVE-2026-31451: ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
      CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
      CVE-2026-31715: f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
      CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
      CVE-2026-45991: udf: fix partition descriptor append bookkeeping
      CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues
      CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed
      CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
      CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
      CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers
      CVE-2026-46091: media: rc: igorplugusb: heed coherency rules
      CVE-2026-46103: can: ucan: fix devres lifetime
      CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
      CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory
      CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
      CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails
      CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
      CVE-2026-46208: batman-adv: stop tp_meter sessions during mesh teardown
      CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd
      CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user
      CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets
      CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers
      CVE-2026-53080: net/sched: cls_fw: fix NULL dereference of "old" filters before change()
      CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
      CVE-2026-53358: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
      CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
      CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
      CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
      CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
      CVE-2026-63892: thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
      CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
      CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
      CVE-2026-63898: USB: serial: mct_u232: fix memory corruption with small endpoint
      CVE-2026-63899: USB: serial: mxuport: fix memory corruption with small endpoint
      CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check
      CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints
      CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers
      CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length
      CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications
      CVE-2026-63908: Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
      CVE-2026-63912: xfrm: esp: restore combined single-frag length gate
      CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
      CVE-2026-63914: xfrm: route MIGRATE notifications to caller's netns
      CVE-2026-63915: nfc: hci: fix out-of-bounds read in HCP header parsing
      CVE-2026-63916: HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
      CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink().
      CVE-2026-63920: ipv6: validate extension header length before copying to cmsg
      CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
      CVE-2026-63924: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
      CVE-2026-63927: usb: dwc2: Fix use after free in debug code
      CVE-2026-63928: USB: serial: omninet: fix memory corruption with small endpoint
      CVE-2026-63930: iio: buffer: hw-consumer: fix use-after-free in error path
      CVE-2026-63933: iio: gyro: adis16260: fix division by zero in write_raw
      CVE-2026-63934: iio: gyro: itg3200: fix i2c read into the wrong stack location
      CVE-2026-63942: parport: Fix race between port and client registration
      CVE-2026-63948: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
      CVE-2026-63954: hpfs: fix a crash if hpfs_map_dnode_bitmap fails
      CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint
      CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint
      CVE-2026-63960: usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
      CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO
      CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff
      CVE-2026-63991: Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
      CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
      CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
      CVE-2026-64004: net/iucv: fix locking in .getsockopt
      CVE-2026-64005: net/smc: Do not re-initialize smc hashtables
      CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable
      CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
      CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release()
      CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
      CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
      CVE-2026-64090: batman-adv: tt: avoid empty VLAN responses
      CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans
      CVE-2026-64094: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
      CVE-2026-64095: batman-adv: bla: avoid double decrement of bla.num_requests
      CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc()
      CVE-2026-64234: tty: serial: pch_uart: add check for dma_alloc_coherent()
      CVE-2026-64237: Input: elan_i2c - validate firmware size before use
      CVE-2026-64240: media: rc: igorplugusb: fix control request setup packet
      CVE-2026-64242: usb: gadget: net2280: Fix double free in probe error path
      CVE-2025-38250: Bluetooth: hci_core: Fix use-after-free in vhci_flush()
      CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful()
      CVE-2026-31489: spi: meson-spicc: Fix double-put in remove path
      CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper
      CVE-2026-46006: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
      CVE-2026-46107: dm-thin: fix metadata refcount underflow
      CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued
      CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
      CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle
      CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs

Best regards,
Ulrich Hecht

Re: [ANNOUNCE] Release v4.19.325-cip135

[whyshall]

[-- Attachment #1: Type: text/plain, Size: 604 bytes --]

Hi,

I understand that the CIP project addresses vulnerabilities in the Linux 4.19.325 base kernel and releases updated versions such as 4.19.325-cipX, with the latest release currently being 4.19.325-cip135.

Could you please let me know:

How many CVEs relevant to the 4.19.325 kernel are still unresolved?
How many of these CVEs are expected to be addressed in future CIP releases?
Is there an estimated CIP release number (cipX) by which all relevant CVEs will have been addressed?
Does CIP only focus on critical vulnerabilities or it would solve all reported vulnerabilities ?

Thanks.

[-- Attachment #2: Type: text/html, Size: 659 bytes --]

Re: [cip-dev] [ANNOUNCE] Release v4.19.325-cip135

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 672 bytes --]

Hi!

> 
> I understand that the CIP project addresses vulnerabilities in the Linux 4.19.325 base kernel and releases updated versions such as 4.19.325-cipX, with the latest release currently being 4.19.325-cip135.
> 
> Could you please let me know:

We don't really have answers to these questions. Due to low quality of
recent CVE entries, we don't track them closely.

> How many CVEs relevant to the 4.19.325 kernel are still unresolved?
> How many of these CVEs are expected to be addressed in future CIP releases?
> Is there an estimated CIP release number (cipX) by which all relevant CVEs will have been addressed?


Best regards,
											Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [cip-dev] [ANNOUNCE] Release v4.19.325-cip135

[Jan Kiszka]

On 05.08.26 10:46, Pavel Machek wrote:
> Hi!
> 
>>
>> I understand that the CIP project addresses vulnerabilities in the Linux 4.19.325 base kernel and releases updated versions such as 4.19.325-cipX, with the latest release currently being 4.19.325-cip135.
>>
>> Could you please let me know:
> 
> We don't really have answers to these questions. Due to low quality of
> recent CVE entries, we don't track them closely.
> 
>> How many CVEs relevant to the 4.19.325 kernel are still unresolved?
>> How many of these CVEs are expected to be addressed in future CIP releases?
>> Is there an estimated CIP release number (cipX) by which all relevant CVEs will have been addressed?
> 
> 

Still, you can have a look at
https://gitlab.com/cip-project/cip-kernel/cip-kernel-sec for those CVEs
that are mappable on 4.19.

In addition, intentionally unresolved ones would be documented in
KNOWN-BUGS (see 4.4-cip [1], not existing for 4.19-cip so far).

If you identify anything that is apparently missing but critical, we are
all ears - or even open to review backport proposals. Just keep in mind
that the official CIP kernel support scope is limited to the
member-defined kernel configuration set [2].

Jan

[1]
https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/tree/KNOWN-BUGS?h=linux-4.4.y-cip
[2]
https://gitlab.com/cip-project/cip-kernel/cip-kernel-config/-/tree/master/4.19.y-cip?ref_type=heads

-- 
Siemens AG, Foundational Technologies
Linux Expert Center