[LTS 8.6] CVE-2025-38022, CVE-2025-38129

[pvts-mat]

[LTS 8.6]

CVE-2025-38022	VULN-71148
CVE-2025-38129	VULN-71833

CVE-2025-38022

RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

jira VULN-71148
cve CVE-2025-38022
commit-author Zhu Yanjun <yanjun.zhu@linux.dev>
commit d0706bfd3ee40923c001c6827b786a309e2a8713
upstream-diff Used linux-5.15.y backport
  5629064f92f0de6d6b3572055cd35361c3ad953c for the clean pick. In LTS 8.6
  the `ib_device_notify_register()' function, where the `kobject_uevent()'
  call was moved in the upstream fix, doesn't exist. It was introduced in
  9cbed5aab5aeea420d0aa945733bf608449d44fb ("RDMA/nldev: Add support for
  RDMA monitoring"), with locks put in place in
  1d6a9e7449e2a0c1e2934eee7880ba8bd1e464cd ("RDMA/core: Fix use-after-free
  when rename device name"). Wrapping the `kobject_uevent()' call in
  `down_read(&devices_rwsem)' and `up_read(&devices_rwsem)' results in the
  same protection.

For details see the explanation of the solution to LTS 9.2 (same situation)

CVE-2025-38129

page_pool: Fix use-after-free in page_pool_recycle_in_ring

jira VULN-71833
cve CVE-2025-38129
commit-author Dong Chenchen <dongchenchen2@huawei.com>
commit 271683bb2cf32e5126c592b5d5e6a756fa374fd9
upstream-diff Used linux-5.15.y backport
  d69f28ef7cdafdcf37ee310f38b1399e7d05f9a8 for a clean pick. It accounts
  for the similarly non-backported commit
  4dec64c52e24c2c9a15f81c115f1be5ea35121cb ("page_pool: convert to use
  netmem") and deals with the same context conflicts in
  `page_pool_release()', as well as with the multiple context conflicts
  before the `page_pool_producer_lock()' definition (mostly non-
  backported stats functionality).

page_pool: fix inconsistency for page_pool_ring_[un]lock()

jira VULN-71833
cve-pre CVE-2025-38129
commit-author Yunsheng Lin <linyunsheng@huawei.com>
commit 368d3cb406cdd074d1df2ad9ec06d1bfcb664882
upstream-diff Context conflicts resolved, no actual diffs from the
  upstream

net: page_pool: use in_softirq() instead

jira VULN-71833
cve-pre CVE-2025-38129
commit-author Qingfang DENG <qingfang.deng@siflower.com.cn>
commit 542bcea4be866b14b3a5c8e90773329066656c43

For details see the explanation of the solution to LTS 9.2 (similar situation)

kABI check: passed

[0/1] kabi_check_kernel	Check ABI of kernel [ciqlts8_6-CVE-batch-39]	_kabi_check_kernel__x86_64--test--ciqlts8_6-CVE-batch-39
ninja explain: output state/kernels/ciqlts8_6-CVE-batch-39/x86_64/kabi_checked doesn't exist
ninja explain: state/kernels/ciqlts8_6-CVE-batch-39/x86_64/kabi_checked is dirty
+ dist_git_version=el-8.6
+ local_version=ciqlts8_6-CVE-batch-39
+ arch=x86_64
+ user=pvts
+ buildmachine=x86_64--build--ciqlts8_6
+ virsh_timeout=600
+ ssh_daemon_wait=20
+ src_dir=/mnt/code/kernel-dist-git-el-8.6
+ build_dir=/mnt/build_files/kernel-src-tree-ciqlts8_6-CVE-batch-39
+ sudo chmod +x /data/src/ctrliq-github-haskell/kernel-dist-git-el-8.6/SOURCES/check-kabi
+ ninja-back/virssh.xsh --max 8 --shutdown-on-success --shutdown-on-failure --timeout 600 --ssh-daemon-wait 20 pvts x86_64--build--ciqlts8_6 ''\''/mnt/code/kernel-dist-git-el-8.6/SOURCES/check-kabi'\'' -k '\''/mnt/code/kernel-dist-git-el-8.6/SOURCES/Module.kabi_x86_64'\'' -s '\''/mnt/build_files/kernel-src-tree-ciqlts8_6-CVE-batch-39/Module.symvers'\'''
kABI check passed
+ touch state/kernels/ciqlts8_6-CVE-batch-39/x86_64/kabi_checked

Boot test: passed

boot-test.log

Kselftests: passed rleative

Reference

kselftests–ciqlts8_6–run1.log

Patch

kselftests–ciqlts8_6-CVE-batch-39–run1.log

Comparison

The tests results for the reference and the patch are the same.

$ ktests.xsh diff -d kselftests*.log

Column    File
--------  --------------------------------------------
Status0   kselftests--ciqlts8_6--run1.log
Status1   kselftests--ciqlts8_6-CVE-batch-39--run1.log

full-test-results-comparison.log