Skip to content

Commit dfdc470

Browse files
aboutcode-automationaboutcode-automation
committed
Sync Collecting Fix Commits: Tue Sep 1 23:38:09 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent f80cf4a commit dfdc470

9 files changed

Lines changed: 383 additions & 128 deletions

‎data/fix-commits/advisory-database-b78f1d41.json‎

Lines changed: 331 additions & 103 deletions
Large diffs are not rendered by default.

‎data/fix-commits/common-dd5d765c.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616
"f066882293b5ad359e44c4ed24ab1811ffb0b354": "media: mtk-vcodec: potential null pointer deference in SCP\n\n[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]\n\nThe return value of devm_kzalloc() needs to be checked to avoid\nNULL pointer deference. This is similar to CVE-2022-3113.\n\nLink: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com\nSigned-off-by: Fullway Wang <fullwaywang@outlook.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>",
1717
"53dbe08504442dc7ba4865c09b3bbf5fe849681b": "media: mtk-vcodec: potential null pointer deference in SCP\n\nThe return value of devm_kzalloc() needs to be checked to avoid\nNULL pointer deference. This is similar to CVE-2022-3113.\n\nLink: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com\nSigned-off-by: Fullway Wang <fullwaywang@outlook.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>"
1818
},
19+
"CVE-2023-3439": {
20+
"408da1df18116c971c3392e21e50586688cd3fbf": "net: mctp: hold a reference to the route device in mctp_route_lookup()\n\nmctp_route_lookup() uses rt->dev without holding a reference on it.\nmctp_route_lookup_single() returns the route under RCU only, so the\nroute's device can be torn down concurrently: mctp_dev_put() drops the\nlast reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr()\nthen reads rt->dev->addrs[0], giving a use-after-free reachable by an\nunprivileged local AF_MCTP user on the receive/forwarding path (no\nCAP_NET_RAW required):\n\n BUG: KASAN: slab-use-after-free in mctp_route_lookup\n Read of size 1 at addr ... by task mctp_uaf/...\n mctp_route_lookup\n mctp_pkttype_receive\n Freed by task ...:\n kfree\n mctp_dev_put\n mctp_dev_notify\n\nIn the same window mctp_dst_from_route() -> mctp_dev_hold() also\nincrements a refcount that has already reached zero\n(\"refcount_t: addition on 0 ... mctp_dev_hold\").\n\nThis reintroduces the use-after-free class of CVE-2023-3439: the source\naddress lookup was moved ahead of the point where the destination takes\nits device reference.\n\nTake a reference with refcount_inc_not_zero() before touching rt->dev,\nskip a device that is already dead, and drop the reference once the\ndestination has taken its own.\n\nFixes: 22cb45afd221 (\"net: mctp: perform source address lookups when we populate our dst\")\nCc: stable@vger.kernel.org\nSigned-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>\nLink: https://patch.msgid.link/20260813022102.2792032-1-qwe.aldo@gmail.com\nSigned-off-by: Jakub Kicinski <kuba@kernel.org>"
21+
},
1922
"CVE-2026-45945": {
2023
"28c3f1b36a66af4fbbe78d367e9be5cbbdc88147": "BACKPORT: iommu/vt-d: Fix race condition during PASID entry replacement\n\nThe Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing\nan active PASID entry (e.g., during domain replacement), the current\nimplementation calculates a new entry on the stack and copies it to the\ntable using a single structure assignment.\n\n struct pasid_entry *pte, new_pte;\n\n pte = intel_pasid_get_entry(dev, pasid);\n pasid_pte_config_first_level(iommu, &new_pte, ...);\n *pte = new_pte;\n\nBecause the hardware may fetch the 512-bit PASID entry in multiple\n128-bit chunks, updating the entire entry while it is active (Present\nbit set) risks a \"torn\" read. In this scenario, the IOMMU hardware\ncould observe an inconsistent state \u2014 partially new data and partially\nold data \u2014 leading to unpredictable behavior or spurious faults.\n\nFix this by removing the unsafe \"replace\" helpers and following the\n\"clear-then-update\" flow, which ensures the Present bit is cleared and\nthe required invalidation handshake is completed before the new\nconfiguration is applied.\n\nFixes: 7543ee63e811 (\"iommu/vt-d: Add pasid replace helpers\")\nSigned-off-by: Lu Baolu <baolu.lu@linux.intel.com>\nReviewed-by: Samiullah Khawaja <skhawaja@google.com>\nReviewed-by: Kevin Tian <kevin.tian@intel.com>\nLink: https://lore.kernel.org/r/20260120061816.2132558-4-baolu.lu@linux.intel.com\nSigned-off-by: Joerg Roedel <joerg.roedel@amd.com>\nBug: 517578243,517579977\nBug: 541039453\nCVE: CVE-2026-45945\nChange-Id: If6a66bcf2ad67f59d79d6267608cd5907a32a584\n(cherry picked from commit c3b1edea3791fa91ab7032faa90355913ad9451b)\n[vineethrp: Adapted for pKVM-IA: remove the dual-mode (host + hypervisor)\n variants of the replace helpers along with their pKVM hypercall\n forwarding branches. With pKVM enabled, the generic host setup paths\n tear down an active entry through the pKVM teardown hypercall before\n issuing the setup hypercall. The hypervisor derives the old entry's DID\n and PGD from the live entry; its deferred entry clear is handled by\n intel_pasid_clear_entry_safe().]\nSigned-off-by: Vineeth Pillai <vineethrp@google.com>\n(cherry picked from commit 3be13f85015cfe863eae0838464dbf0e2c742e90)\nSigned-off-by: Hubert Mazur <hmazur@google.com>",
2124
"3be13f85015cfe863eae0838464dbf0e2c742e90": "BACKPORT: iommu/vt-d: Fix race condition during PASID entry replacement\n\nThe Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing\nan active PASID entry (e.g., during domain replacement), the current\nimplementation calculates a new entry on the stack and copies it to the\ntable using a single structure assignment.\n\n struct pasid_entry *pte, new_pte;\n\n pte = intel_pasid_get_entry(dev, pasid);\n pasid_pte_config_first_level(iommu, &new_pte, ...);\n *pte = new_pte;\n\nBecause the hardware may fetch the 512-bit PASID entry in multiple\n128-bit chunks, updating the entire entry while it is active (Present\nbit set) risks a \"torn\" read. In this scenario, the IOMMU hardware\ncould observe an inconsistent state \u2014 partially new data and partially\nold data \u2014 leading to unpredictable behavior or spurious faults.\n\nFix this by removing the unsafe \"replace\" helpers and following the\n\"clear-then-update\" flow, which ensures the Present bit is cleared and\nthe required invalidation handshake is completed before the new\nconfiguration is applied.\n\nFixes: 7543ee63e811 (\"iommu/vt-d: Add pasid replace helpers\")\nSigned-off-by: Lu Baolu <baolu.lu@linux.intel.com>\nReviewed-by: Samiullah Khawaja <skhawaja@google.com>\nReviewed-by: Kevin Tian <kevin.tian@intel.com>\nLink: https://lore.kernel.org/r/20260120061816.2132558-4-baolu.lu@linux.intel.com\nSigned-off-by: Joerg Roedel <joerg.roedel@amd.com>\nBug: 517578243,517579977\nCVE: CVE-2026-45945\nChange-Id: If6a66bcf2ad67f59d79d6267608cd5907a32a584\n(cherry picked from commit c3b1edea3791fa91ab7032faa90355913ad9451b)\n[vineethrp: Adapted for pKVM-IA: remove the dual-mode (host + hypervisor)\n variants of the replace helpers along with their pKVM hypercall\n forwarding branches. With pKVM enabled, the generic host setup paths\n tear down an active entry through the pKVM teardown hypercall before\n issuing the setup hypercall. The hypervisor derives the old entry's DID\n and PGD from the live entry; its deferred entry clear is handled by\n intel_pasid_clear_entry_safe().]\nSigned-off-by: Vineeth Pillai <vineethrp@google.com>"

‎data/fix-commits/imagemagick-b15feb65.json‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,21 @@
11
{
22
"vcs_url": "https://github.com/imagemagick/imagemagick",
33
"vulnerabilities": {
4+
"GHSA-5RG6-J44Q-Q892": {
5+
"2ba2edfd04a1ab3d45af4a0dc1e640dde7020192": "More fixes for GHSA-5rg6-j44q-q892.",
6+
"78378cd623468760bee82a5930cb3011725916f8": "Escape the labels to prevent code injection (GHSA-5rg6-j44q-q892)"
7+
},
8+
"GHSA-89WQ-F8F6-2J2V": {
9+
"b5da5eac006bae77c587a7c238e346c90ea52acd": "More fixes for GHSA-89wq-f8f6-2j2v",
10+
"d779ac52f92c3045ced59362b483bee25a3fc784": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v"
11+
},
412
"GHSA-3RJR-534C-8V67": {
513
"4fe31106f41fa114945ceaf93226fb151ada0d19": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67",
614
"282f455de5c80a7a0d1a713087db9c8fce344141": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67"
715
},
816
"GHSA-92RW-C5MW-27V4": {
917
"c4b3c9039a1509e3e7869331773865b521a62f93": "Added missing null check to avoid a null pointer dereference (GHSA-92rw-c5mw-27v4)"
1018
},
11-
"GHSA-89WQ-F8F6-2J2V": {
12-
"d779ac52f92c3045ced59362b483bee25a3fc784": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v"
13-
},
1419
"GHSA-V45J-X8P4-3MH4": {
1520
"f491576297141ff685dc4460d811986f5b6b6cec": "Use a better algorithm to determine the numerator and denominator (GHSA-v45j-x8p4-3mh4)"
1621
},
@@ -23,9 +28,6 @@
2328
"GHSA-4FQ9-VRX7-GV92": {
2429
"c69f54e1c8660e45f2ff83c354bf924a946d9356": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4fq9-vrx7-gv92"
2530
},
26-
"GHSA-5RG6-J44Q-Q892": {
27-
"78378cd623468760bee82a5930cb3011725916f8": "Escape the labels to prevent code injection (GHSA-5rg6-j44q-q892)"
28-
},
2931
"GHSA-6XF5-C3JX-RP39": {
3032
"5d29c094020612dc8fb471b10fc1d1cc6e9e4378": "Corrected the call to CheckPrimitiveExtent to fix the use of uninitialized heap memory (GHSA-6xf5-c3jx-rp39)"
3133
},

‎data/fix-commits/imagemagick6-19533b67.json‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,24 @@
11
{
22
"vcs_url": "https://github.com/imagemagick/imagemagick6",
33
"vulnerabilities": {
4+
"GHSA-5RG6-J44Q-Q892": {
5+
"d5750d7309ef5a8cd561430d932a183e4168f484": "More fixes for https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892.",
6+
"879489740daa44dd72e9405b26c845e8aa3d2f53": "Escape the labels to prevent code injection (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892)"
7+
},
8+
"GHSA-89WQ-F8F6-2J2V": {
9+
"0d768346a13b63e4d791be4b798482abd1e050d5": "More fixes for https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v",
10+
"4332e26659c849bf126aecb215482de1eed73308": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v"
11+
},
412
"GHSA-3RJR-534C-8V67": {
513
"742ee222f6df8e7512755a8939b16b90a034a9a7": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67",
614
"3e0ff6b63c37844732a4f79700bc58ac5370fa25": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67"
715
},
816
"GHSA-92RW-C5MW-27V4": {
917
"3b124bb81d3c53ec7d2b46f5ea04c00c4b07b9b3": "Added missing null check to avoid a null pointer dereference (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-92rw-c5mw-27v4)"
1018
},
11-
"GHSA-89WQ-F8F6-2J2V": {
12-
"4332e26659c849bf126aecb215482de1eed73308": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v"
13-
},
1419
"GHSA-QR53-HC3P-FC62": {
1520
"49560a1641f72a127e413b9861eca0997fde2b96": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62"
1621
},
17-
"GHSA-5RG6-J44Q-Q892": {
18-
"879489740daa44dd72e9405b26c845e8aa3d2f53": "Escape the labels to prevent code injection (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892)"
19-
},
2022
"GHSA-6XF5-C3JX-RP39": {
2123
"bfe0117fd9742b3970383e000978d64e5e04372d": "Corrected the call to CheckPrimitiveExtent to fix the use of uninitialized heap memory (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39)"
2224
},

0 commit comments

Comments
 (0)