[ciqlts9_6] Multiple patches tested (3 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

ipc: limit next_id allocation to the valid ID range

jira VULN-189042
cve CVE-2026-52923
commit-author Linpu Yu <linpu5433@gmail.com>
commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139

net: bridge: stop fast-leave after deleting a port group

jira VULN-203054
cve CVE-2026-74480
commit-author Zhiling Zou <zhilinz@nebusec.ai>
commit a39789f211b8a4125f0c70e05b30cf715f4f187d

ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

jira VULN-204570
cve CVE-2026-74597
commit-author Zhiling Zou <zhilinz@nebusec.ai>
commit f803c086399da277b5d0ff36a107d0f162751800

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	31m 9s	32m 6s
aarch64	26m 2s	26m 56s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	206	43	ciqlts9_6	✅ No regressions
aarch64	153	46	ciqlts9_6	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1453	82	ciqlts9_6	✅ No regressions
aarch64	1426	83	ciqlts9_6	✅ No regressions

• View LTP logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 34249035522

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/34277944022

[github-actions]

JIRA PR Check Results

2 commit(s) with issues found:

Commit 35c8f8d39d1d

Summary: ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

❌ Errors:

• VULN-204570: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-204570: No time logged - please log time manually

Commit 89d487f96365

Summary: net: bridge: stop fast-leave after deleting a port group

❌ Errors:

• VULN-203054: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-203054: No time logged - please log time manually

---

Summary: Checked 3 commit(s) total.

[github-actions]

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/34277944022

[kerneltoast]

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/34361643567

[github-actions]

JIRA PR Check Results

88 commit(s) with issues found:

Commit b5f9574c3947

Summary: net: ipv6: clear suppressed fib6 rule result

❌ Errors:

• VULN-204226: Status is 'Publish CSAF', expected 'In Progress'

Commit b140b3031ced

Summary: net: clear the dst when changing skb protocol

❌ Errors:

• VULN-162930: Status is 'Done', expected 'In Progress'

Commit 0d96791da9c2

Summary: crypto: ccp - copy IV using skcipher ivsize

❌ Errors:

• VULN-189524: Status is 'Done', expected 'In Progress'

Commit 2fa04340272a

Summary: dm-log: fix a bitset_size overflow on 32bit machines

❌ Errors:

• VULN-200619: Status is 'Done', expected 'In Progress'

Commit 09b5d3f763a1

Summary: dm log: fix out-of-bounds write due to region_count overflow

❌ Errors:

• VULN-189560: Status is 'Done', expected 'In Progress'

Commit 48994a641c14

Summary: net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

❌ Errors:

• VULN-181086: Status is 'Done', expected 'In Progress'

Commit ab047195ebda

Summary: scsi: core: Wake up the error handler when final completions race against each other

❌ Errors:

• VULN-175727: Status is 'Done', expected 'In Progress'

Commit e0d87ace5e65

Summary: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

❌ Errors:

• VULN-184331: Status is 'Done', expected 'In Progress'

Commit 4e6408658472

Summary: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt

❌ Errors:

• VULN-174232: Status is 'Done', expected 'In Progress'

Commit 10d418025314

Summary: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

❌ Errors:

• VULN-189406: Status is 'Done', expected 'In Progress'

Commit 0df72fa942dc

Summary: KVM: x86: Check for invalid/obsolete root after making MMU pages available

❌ Errors:

• VULN-195551: Status is 'Done', expected 'In Progress'

Commit 1f5f158abd72

Summary: nfsd: fix UAF when access ex_uuid or ex_stats

❌ Errors:

• VULN-167075: Status is 'Done', expected 'In Progress'

Commit 7db570881f93

Summary: SUNRPC: no need get cache ref when protected by rcu

❌ Errors:

• VULN-167075: Status is 'Done', expected 'In Progress'

Commit a314e113f6e6

Summary: nfsd: no need get cache ref when protected by rcu

❌ Errors:

• VULN-167075: Status is 'Done', expected 'In Progress'

Commit af3bc5586dd3

Summary: SUNRPC: introduce cache_check_rcu to help check in rcu context

❌ Errors:

• VULN-167075: Status is 'Done', expected 'In Progress'

Commit 7314cf743778

Summary: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

❌ Errors:

• VULN-187131: Status is 'Done', expected 'In Progress'

Commit 75f718263f91

Summary: smb: client: fix OOB reads parsing symlink error response

❌ Errors:

• VULN-183093: Status is 'Done', expected 'In Progress'

Commit 9a5f7ce50478

Summary: net: sched: act_csum: validate nested VLAN headers

❌ Errors:

• VULN-183031: Status is 'Done', expected 'In Progress'

Commit 5b7c18ed6db8

Summary: drm/amd/display: Do not skip unrelated mode changes in DSC validation

❌ Errors:

• VULN-185855: Status is 'Done', expected 'In Progress'

Commit 3c2464ff5430

Summary: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync

❌ Errors:

• VULN-161961: Status is 'Done', expected 'In Progress'

Commit 9ac934e0d753

Summary: vt: prevent kernel-infoleak in con_font_get()

❌ Errors:

• VULN-168027: Status is 'Done', expected 'In Progress'

Commit b24265d95441

Summary: VMCI: Fix use-after-free when removing resource in vmci_resource_remove()

❌ Errors:

• VULN-168137: Status is 'Done', expected 'In Progress'

Commit 42796dd9cd76

Summary: net/sched: act_api: use RCU with deferred freeing for action lifecycle

❌ Errors:

• VULN-189813: Status is 'Done', expected 'In Progress'

Commit c40cc565e80b

Summary: net: use dst_dev_rcu() in sk_setup_caps()

❌ Errors:

• VULN-162719: Status is 'Done', expected 'In Progress'

Commit 29bd0b1b490d

Summary: ipv4: add RCU protection to ip4_dst_hoplimit()

❌ Errors:

• VULN-162719: Status is 'Done', expected 'In Progress'

Commit 05396c66823d

Summary: ipv4: use RCU protection in ip_dst_mtu_maybe_forward()

❌ Errors:

• VULN-162719: Status is 'Done', expected 'In Progress'

Commit 9cf0c981221f

Summary: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward

❌ Errors:

• VULN-162719: Status is 'Done', expected 'In Progress'

Commit fc8ffb99be96

Summary: ipv6: use RCU in ip6_xmit()

❌ Errors:

• VULN-162725: Status is 'Done', expected 'In Progress'

Commit 133fdbb69bc4

Summary: ipv6: use RCU in ip6_output()

❌ Errors:

• VULN-162723: Status is 'Done', expected 'In Progress'

Commit cb5e252cc94e

Summary: net: dst: introduce dst->dev_rcu

❌ Errors:

• VULN-162719: Status is 'Done', expected 'In Progress'

Commit d70a6a7003b0

Summary: ipv4: use RCU protection in __ip_rt_update_pmtu()

❌ Errors:

• VULN-162081: Status is 'Done', expected 'In Progress'

Commit 73e544b0195f

Summary: net: Add locking to protect skb->dev access in ip_output

❌ Errors:

• VULN-162725: Status is 'Done', expected 'In Progress'

Commit 830c1d2227d3

Summary: net: dst: add four helpers to annotate data-races around dst->dev

❌ Errors:

• VULN-162719: Status is 'Done', expected 'In Progress'

Commit 9f07e247a22d

Summary: bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6

❌ Errors:

• VULN-162723: Status is 'Done', expected 'In Progress'

Commit 3edd51dbc002

Summary: vrf: Fix lockdep splat in output path

❌ Errors:

• VULN-162723: Status is 'Done', expected 'In Progress'

Commit 64a2191b54f2

Summary: ipv6: remove nexthop_fib6_nh_bh()

❌ Errors:

• VULN-162723: Status is 'Done', expected 'In Progress'

Commit 7704f60bdef5

Summary: net: remove rcu_dereference_bh_rtnl()

❌ Errors:

• VULN-162723: Status is 'Done', expected 'In Progress'

Commit 613eb0564552

Summary: neighbour: switch to standard rcu, instead of rcu_bh

❌ Errors:

• VULN-162723: Status is 'Done', expected 'In Progress'

Commit 3c401db4adad

Summary: ipv6: flowlabel: do not disable BH where not needed

❌ Errors:

• VULN-162723: Status is 'Done', expected 'In Progress'

Commit dcef1509f251

Summary: ipv6: remove one read_lock()/read_unlock() pair in rt6_check_neigh()

❌ Errors:

• VULN-162723: Status is 'Done', expected 'In Progress'

Commit 469479167f8f

Summary: neigh: introduce neigh_confirm() helper function

❌ Errors:

• VULN-162723: Status is 'Done', expected 'In Progress'

Commit 2ce9d838bbc6

Summary: ALSA: usb-audio: Add sanity check for OOB writes at silencing

❌ Errors:

• VULN-184734: Status is 'Done', expected 'In Progress'

Commit 339c80fe48b9

Summary: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

❌ Errors:

• VULN-188156: Status is 'Done', expected 'In Progress'

Commit a12f511ac13d

Summary: wifi: mac80211: drop stray 'static' from fast-RX rx_result

❌ Errors:

• VULN-188475: Status is 'Done', expected 'In Progress'

Commit ff9cf2f1abae

Summary: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

❌ Errors:

• VULN-180257: Status is 'Done', expected 'In Progress'

Commit e7db9e263bc5

Summary: gfs2: Fix use-after-free in iomap inline data write path

❌ Errors:

• VULN-186356: Status is 'Done', expected 'In Progress'

Commit 2b8b0cf57727

Summary: gfs2: Add metapath_dibh helper

❌ Errors:

• VULN-186356: Status is 'Done', expected 'In Progress'

Commit 1ee76b378fd6

Summary: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

❌ Errors:

• VULN-169731: Status is 'Done', expected 'In Progress'

Commit c67364ec4a37

Summary: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

❌ Errors:

• VULN-190210: Status is 'Done', expected 'In Progress'

Commit db7462eca079

Summary: rtmutex: Use waiter::task instead of current in remove_waiter()

❌ Errors:

• VULN-191596: Status is 'Done', expected 'In Progress'

Commit 040a2bedac99

Summary: eventpoll: defer struct eventpoll free to RCU grace period

❌ Errors:

• VULN-184228: Status is 'Done', expected 'In Progress'

Commit 154f0a36a2e5

Summary: file: add fput() cleanup helper

❌ Errors:

• VULN-186882: Status is 'Done', expected 'In Progress'

Commit e55116c4baa2

Summary: eventpoll: fix ep_remove struct eventpoll / struct file UAF

❌ Errors:

• VULN-186882: Status is 'Done', expected 'In Progress'

Commit 384a43f4b424

Summary: eventpoll: move epi_fget() up

❌ Errors:

• VULN-186882: Status is 'Done', expected 'In Progress'

Commit 1646a2eb4ce7

Summary: eventpoll: rename ep_remove_safe() back to ep_remove()

❌ Errors:

• VULN-186882: Status is 'Done', expected 'In Progress'

Commit f8abf75f3d28

Summary: eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()

❌ Errors:

• VULN-186882: Status is 'Done', expected 'In Progress'

Commit 7c4d67c4df75

Summary: eventpoll: kill __ep_remove()

❌ Errors:

• VULN-186882: Status is 'Done', expected 'In Progress'

Commit f0174992a065

Summary: eventpoll: split __ep_remove()

❌ Errors:

• VULN-186882: Status is 'Done', expected 'In Progress'

Commit 6bc835e424ed

Summary: eventpoll: use hlist_is_singular_node() in __ep_remove()

❌ Errors:

• VULN-186882: Status is 'Done', expected 'In Progress'

Commit f33d4114d228

Summary: epoll: annotate racy check

❌ Errors:

• VULN-186882: Status is 'Done', expected 'In Progress'

Commit 5190d179be2b

Summary: netfilter: nft_inner: Fix IPv6 inner_thoff desync

❌ Errors:

• VULN-186973: Status is 'Done', expected 'In Progress'

Commit f1feeb968a2f

Summary: exit: prevent preemption of oopsing TASK_DEAD task

❌ Errors:

• VULN-187125: Status is 'Done', expected 'In Progress'

Commit 10076f649aab

Summary: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

❌ Errors:

• VULN-186969: Status is 'Done', expected 'In Progress'

Commit 8a12b89a5b9a

Summary: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

❌ Errors:

• VULN-187925: Status is 'Done', expected 'In Progress'

Commit b1e64b65df47

Summary: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

❌ Errors:

• VULN-190445: Status is 'Done', expected 'In Progress'

Commit b363687169ba

Summary: netfilter: nf_conntrack_helper: pass helper to expect cleanup

❌ Errors:

• VULN-183691: Status is 'Done', expected 'In Progress'

Commit d436779a9c68

Summary: netfilter: flowtable: strictly check for maximum number of actions

❌ Errors:

• VULN-185476: Status is 'Done', expected 'In Progress'

Commit 027772d04179

Summary: scsi: qla2xxx: Completely fix fcport double free

❌ Errors:

• VULN-185060: Status is 'Done', expected 'In Progress'

Commit 0595d2e8fa98

Summary: RDMA/umem: Fix double dma_buf_unpin in failure path

❌ Errors:

• VULN-184380: Status is 'Done', expected 'In Progress'

Commit 502236a32b27

Summary: ALSA: aloop: Fix racy access at PCM trigger

❌ Errors:

• VULN-176124: Status is 'Done', expected 'In Progress'

Commit 6f473ebce8ca

Summary: RDMA/rxe: Fix double free in rxe_srq_from_init

❌ Errors:

• VULN-186068: Status is 'Done', expected 'In Progress'

Commit 4a1a324c2878

Summary: netfilter: conntrack: clamp maximum hashtable size to INT_MAX

❌ Errors:

• VULN-161930: Status is 'Done', expected 'In Progress'

Commit 764beb7108bd

Summary: KVM: x86: Fix shadow paging use-after-free due to unexpected role

❌ Errors:

• VULN-191430: Status is 'Done', expected 'In Progress'

Commit 42139632fa64

Summary: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

❌ Errors:

• VULN-186746: Status is 'Done', expected 'In Progress'

Commit f4c7de84f4bf

Summary: net/sched: fix pedit partial COW leading to page cache corruption

❌ Errors:

• VULN-188482: Status is 'Done', expected 'In Progress'

Commit edec19b7bb5c

Summary: smb: client: validate dacloffset before building DACL pointers

❌ Errors:

• VULN-188330: Status is 'Done', expected 'In Progress'

Commit df551f07bee3

Summary: smb: client: use kzalloc to zero-initialize security descriptor buffer

❌ Errors:

• VULN-188852: Status is 'Done', expected 'In Progress'

Commit 32502ec14b2c

Summary: smb: client: require a full NFS mode SID before reading mode bits

❌ Errors:

• VULN-184959: Status is 'Done', expected 'In Progress'

Commit 24781f3b2410

Summary: smb: client: validate the whole DACL before rewriting it in cifsacl

❌ Errors:

• VULN-183470: Status is 'Done', expected 'In Progress'

Commit 906cef9d5511

Summary: cifs: add validation check for the fields in smb_aces

❌ Errors:

• VULN-183470: Status is 'Done', expected 'In Progress'

Commit 9c9073f2cbc1

Summary: cifs: fix incorrect validation for num_aces field of smb_acl

❌ Errors:

• VULN-183470: Status is 'Done', expected 'In Progress'

Commit 0fc7d1a2036d

Summary: net: bonding: fix use-after-free in bond_xmit_broadcast()

❌ Errors:

• VULN-181414: Status is 'Done', expected 'In Progress'

Commit f3ef68b945ee

Summary: wifi: mac80211: use safe list iteration in radar detect work

❌ Errors:

• VULN-188783: Status is 'Done', expected 'In Progress'

Commit b276bd2913a0

Summary: xfs: fix freemap adjustments when adding xattrs to leaf blocks

❌ Errors:

• VULN-184489: Status is 'Done', expected 'In Progress'

Commit e31d2b2d56bd

Summary: RDMA/iwcm: Fix workqueue list corruption by removing work_list

❌ Errors:

• VULN-186165: Status is 'Done', expected 'In Progress'

Commit 8a12e6e84686

Summary: libceph: reset sparse-read state in osd_fault()

❌ Errors:

• VULN-176226: Status is 'Done', expected 'In Progress'

Commit 603b23e7804a

Summary: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().

❌ Errors:

• VULN-162678: Status is 'Done', expected 'In Progress'

Commit 536c27790a93

Summary: smc: Fix use-after-free in __pnet_find_base_ndev().

❌ Errors:

• VULN-162132: Status is 'Done', expected 'In Progress'

---

Summary: Checked 100 commit(s) total.

[github-actions]

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/34361643567

[bmastbergen]

🥌