Upstream linux-hardened tag v7.1.2-hardened1 available #21

New issue

Closed

opened 2026-07-01 11:00:39 +00:00 by unredacted_bot · 1 comment

unredacted_bot commented

2026-07-01 11:00:39 +00:00

Owner

Upstream tag: v7.1.2-hardened1
Local latest: v7.1.1-hardened1

CVEs reported fixed in 7.1.2 since 7.1.1 (source: kernel.org CVE project).

Severity = Red Hat's rating (best-effort; the kernel CNA publishes no CVSS), not the project's own. List as of 2026-07-01T11:00Z — the feed can lag, so re-check vulns.git before building.

CVE-2026-53325 — Low (CVSS 5.5) — agp/amd64: Fix broken error propagation in agp_amd64_probe()

A NULL pointer dereference was observed in the AMD64 AGP driver when
running in a virtualized environment (e.g. qemu/kvm) without a physical
AMD northbridge. The crash occurs in amd64_fetch_size() when attempting
to dereference the pointer returned by node_to_amd_nb(0).

The root cause of this crash is broken error propagation in
agp_amd64_probe(): When no AMD northbridges are found, cache_nbs()
correctly returns -ENODEV. However, the probe function erroneously
checks the return value against exactly -1, rather than < 0.

As a result, the hardware absence error is masked, allowing the driver
to improperly proceed with initialization. It eventually calls
agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware
does not exist, node_to_amd_nb(0) returns NULL, leading to a General
Protection Fault (GPF) when accessing its ->misc member.

Fix the issue by correcting the error check in agp_amd64_probe() to
abort properly when cache_nbs() returns any negative error code. This
prevents the driver from erroneously proceeding without hardware, thereby
avoiding the subsequent NULL pointer dereference at its source.

Action: review the upstream signature, then push a matching
local tag (git tag v7.1.2-hardened1 && git push origin v7.1.2-hardened1)
which triggers build-kernel.yml.

See docs/users/cve-policy.md for the SLA.

Upstream tag: v7.1.2-hardened1 Local latest: v7.1.1-hardened1 **CVEs reported fixed in `7.1.2` since `7.1.1`** (source: kernel.org CVE project). _Severity = Red Hat's rating (best-effort; the kernel CNA publishes no CVSS), not the project's own. List as of 2026-07-01T11:00Z — the feed can lag, so re-check vulns.git before building._ <details><summary><strong>CVE-2026-53325</strong> — Low (CVSS 5.5) — agp/amd64: Fix broken error propagation in agp_amd64_probe()</summary> ```text A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source. ``` </details> Action: review the upstream signature, then push a matching local tag (`git tag v7.1.2-hardened1 && git push origin v7.1.2-hardened1`) which triggers build-kernel.yml. See docs/users/cve-policy.md for the SLA.

zach commented

2026-07-02 03:01:34 +00:00

Owner

Released

zach closed this issue

2026-07-02 03:01:34 +00:00

No labels

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

unredacted/linux-hardened-unredacted#21

No description provided.

Rows
Columns