Patch kernel: backport Bluetooth L2CAP UAF fix in l2cap_sock_cleanup_listen() (torvalds/linux@ab1513597c6c)#17423
Closed
omkhar wants to merge 1 commit into
Closed
Conversation
…listen() (torvalds/linux@ab1513597c6c) Custom 5.15 backport: upstream commit touches 5 files including net/bluetooth/iso.c which does not exist on 5.15 (ISO added v6.0). af_bluetooth.c hunk needed contextual rewrite because 5.15 already absorbed the CVE-2025-39860 base fix (47f6090bcf75) which introduced an early sock_hold(sk). Backport is 4 files +60/-7. Upstream Author Safa Karakuş; Reported-by/Reviewed-by Siwei Zhang; Signed-off-by chain Safa→Luiz Augusto von Dentz preserved in the .patch trailer. Signed-off-by: omkhar <omkhar@linkedin.com>
5 tasks
Author
|
Closing as duplicate of #17424, which targets |
Author
|
Correction on my earlier close-as-duplicate framing: this was actually the Mariner 2.0 version of the same CVE fix (head branch is |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport upstream Bluetooth L2CAP UAF fix from torvalds/linux@ab15135.
Upstream: Author Safa Karakuş; Reported-by/Reviewed-by Siwei Zhang; Signed-off-by chain Safa → Luiz Augusto von Dentz. Cc: stable@vger.kernel.org. Fixes: 15f02b910562.
Backport type: CUSTOM 5.15 backport. Upstream commit touches 5 files including net/bluetooth/iso.c (added v6.0, doesn't exist on 5.15). af_bluetooth.c hunk needed contextual rewrite because 5.15 already absorbed the CVE-2025-39860 base fix (47f6090bcf75) which introduced an early sock_hold(sk). Backport is 4 files +60/-7.
Code-correctness: l2cap_sock_cleanup_listen function grew 332→501 bytes (+51%). l2cap_chan_hold_unless_zero already exported; now called from cleanup_listen per patch design.
LTP regression: Mariner 2.0 LTP-net (net.features/net.ipv6/net.multicast/net.tcp_cmds/net_stress.interface; 118 tests). 0 patch-induced regressions.
Mariner 2.0 caveat: AKS EOL 2025-11-30; PR for non-AKS consumers.