APPLIED/Cmnt: [SRU][J/N/P][PATCH 0/1] CVE-2025-38617

[Stefan Bader]

On 26/08/2025 22:55, Tim Whisonant wrote:
> SRU Justification:
> 
> [Impact]
> 
> net/packet: fix a race in packet_set_ring() and packet_notifier()
> 
> When packet_set_ring() releases po->bind_lock, another thread can
> run packet_notifier() and process an NETDEV_UP event.
> 
> This race and the fix are both similar to that of commit 15fe076edea7
> ("net/packet: fix a race in packet_bind() and packet_notifier()").
> 
> There too the packet_notifier NETDEV_UP event managed to run while a
> po->bind_lock critical section had to be temporarily released. And
> the fix was similarly to temporarily set po->num to zero to keep
> the socket unhooked until the lock is retaken.
> 
> The po->bind_lock in packet_set_ring and packet_notifier precede the
> introduction of git history.
> 
> [Fix]
> 
> Plucky:   applied Noble patch
> Noble:    cherry picked from upstream
> Jammy:    cherry picked from upstream
> Focal:    patch sent to ESM ML
> Bionic:   patch sent to ESM ML
> Xenial:   patch sent to ESM ML
> Trusty:   out of scope (medium CVE)
> 
> [Test Plan]
> 
> Compile and boot tested.
> 
> [Where problems could occur]
> 
> The changes affect the raw packet sockets implementation. Issues
> might manifest as mishandled packets.
> 
> Quang Le (1):
>    net/packet: fix a race in packet_set_ring() and packet_notifier()
> 
>   net/packet/af_packet.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
> 
Changed jammy into backport noting the context adjustment in hunk#1.

Applied to plucky,noble,jammy:linux/master-next. Thanks.

-Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20250911/3886f313/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20250911/3886f313/attachment-0001.sig>