On Sun, 2026-08-02 at 07:34 -0700, Junjie Cao wrote:
> Triage results for seven of the CVEs listed in the "linux-yocto CVEs
> in need of triage" request [1]. All of these predate the kernel.org
> CNA, so no upstream fix version will ever be backfilled automatically;
> each verdict was established from distro security trackers, mailing
> list history and inspection of current mainline source (linux-next
> 20260727).
>
> * CVE-2019-14899: VPN tunnel TCP inference. No kernel fix exists or is
> planned; mitigations are firewall configuration only. Ubuntu has
> deferred it since 2019-12-13; Debian does not track it against the
> kernel; Red Hat tracks it against openvpn.
>
> * CVE-2021-3714: KSM dedup side channel. Red Hat closed it WONTFIX
> (bz#1931327); Debian marks it "Inherent design limitation". Only
> reachable when ksmd is started and the workload opts in via
> MADV_MERGEABLE / PR_SET_MEMORY_MERGE.
>
> * CVE-2021-3864: setuid coredump privilege escalation. Both proposed
> fixes were rejected or abandoned (links in the file); the flagged
> fs/exec.c logic is unchanged in current mainline. Exploitation
> requires a relative kernel.core_pattern, which piped/absolute
> patterns (e.g. systemd-coredump) prevent.
>
> * CVE-2022-0400: net/smc out-of-bounds read. Closed NOTABUG by Red Hat
> (bz#2044575), INVALID by SUSE (bsc#1195329), "non issue" by Debian;
> no affected version or upstream commit was ever identified.
>
> * CVE-2022-1247: rose_connect() refcount race. Fixed in v6.17 by
> d860d1faa6b2 + da9c9c877597 ("net: rose: convert 'use' field to
> refcount_t"), whose commit message matches the CVE description and
> which removes the exact rose->neighbour->use++ increment the CVE
> describes; backported to 6.1.y/6.6.y/6.12.y/6.16.y. The rose/
> hamradio subsystem was subsequently removed in v7.1 (dd8d4bc28ad7).
> Distro trackers have not yet connected the fix to this CVE.
>
> * CVE-2022-4543: "EntryBleed" KASLR bypass. No fix; upstream position
> is that KASLR does not defend against local attackers. Explicitly
> not fixed by 97e3d26b5e5f, which randomizes the separate
> cpu_entry_area (that is CVE-2023-3640).
>
> * CVE-2023-4010: the function named by the CVE, usb_giveback_urb(),
> does not exist in the kernel; the reporter's PoC exercises the
> unthrottled URB resubmit loop in drivers/media/rc/imon.c, stopped by
> eecd203ada43 ("media: imon: make send_packet() more robust") in
> v6.18. The commit carries no CVE reference, so this tie is inferred
> from the commit content and the reporter's PoC output - flagging for
> review.
>
> Of the remaining CVEs in [1], CVE-2023-3397 (JFS txEnd UAF, still
> reproduced by syzbot in 2026-06), CVE-2023-6238 (NVMe passthrough
> metadata DMA overflow, fix was merged to nvme-6.6 then backed out and
> never re-landed; kernels < v6.2 unaffected) and CVE-2023-6240 (Marvin
> RSA timing oracle, fixed only in RHEL downstream) are genuinely
> unfixed upstream and are deliberately not excluded here; detailed
> analysis posted in the thread.
>
> [1]
> https://lore.kernel.org/all/[email protected]/
>
> Signed-off-by: Junjie Cao <[email protected]>Hi, Thanks for looking into these! This is a good start but we need a little more before we can accept the additions to cve-exclusion.inc. Please send these as separate patches for each CVE, and including links to relevant sources in the commit messages. We need enough information on each for users to be confident that the conclusion in CVE_STATUS is correct. Please also include the three unpatched CVEs, you can use CVE_STATUS "unpatched: ..." - that will help anyone else looking at these in the future to avoid duplication of effort. Please also make sure any use of AI is disclosed in line with our contribution guide [1]. [1]: https://docs.yoctoproject.org/contributor-guide/submit-changes.html#acceptance-of-ai-generated-code Thanks, -- Paul Barker
signature.asc
Description: This is a digitally signed message part
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242563): https://lists.openembedded.org/g/openembedded-core/message/242563 Mute This Topic: https://lists.openembedded.org/mt/120563203/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
