Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-21898 State: PUBLISHED Published: 2025-04-01T15:26:50.211Z Last Updated: 2025-11-03T19:38:44.454Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in function_stat_show() Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5b3d32f607f0478b414b16516cf27
A ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5b3d32f607f0478b414b16516cf27f9170cf66c8 - https://git.kernel.org/stable/c/ca381f60a3bb7cfaa618d73ca411610bd7fc3149 - https://git.kernel.org/stable/c/3d738b53ed6cddb68e68c9874520a4bf846163b5 - https://git.kernel.org/stable/c/992775227843c9376773784b8b362add44592ad7 - https://git.kernel.org/stable/c/f58a3f8e284d0bdf94164a8e61cd4e70d337a1a3 - https://git.kernel.org/stable/c/746cc474a95473591853927b3a9792a2d671155b - https://git.kernel.org/stable/c/9cdac46fa7e854e587eb5f393fe491b6d7a9bdf6 - https://git.kernel.org/stable/c/a1a7eb89ca0b89dc1c326eeee2596f263291aca3
CVE ID: CVE-2025-21899 State: PUBLISHED Published: 2025-04-01T15:26:50.791Z Last Updated: 2025-11-03T19:38:45.924Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting named_triggers list The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=common_pid' > trigger Because the following occurs: event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_trigger_alloc(..); event_trigger
t_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_trigger_alloc(..); event_trigger_register(.., data) { cmd_ops->reg(.., data, ..) [hist_register_trigger()] { data->ops->init() [event_hist_trigger_init()] { save_named_trigger(name, data) { list_add(&data->named_list, &named_triggers); } } } } ret = create_actions(); (return -EINVAL) if (ret) goto out_unreg; [..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] out_unreg: event_hist_unregister(.., data) { cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers, list) { if (!hist
cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers, list) { if (!hist_trigger_match(data, iter, named_data, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL test->ops->free(test) [event_hist_trigger_free()] { [..] if (data->name) del_named_trigger(data) { list_del(&data->named_list); <<<<-- NEVER gets removed! } } } } [..] kfree(data); <<<-- frees item but it is still on list The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash. Move the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which
ove the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the list. A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be called just before hist_trigger_enable() keeping them together and allowing the file->triggers to be properly populated. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 - https://git.kernel.org/stable/c/43b254d46c740bf9dbe65709afa021dd726dfa99 - https://git.kernel.o
c03b6c15d7da0c1c6efa77 - https://git.kernel.org/stable/c/43b254d46c740bf9dbe65709afa021dd726dfa99 - https://git.kernel.org/stable/c/435d2964af815aae456db554c62963b4515f19d0 - https://git.kernel.org/stable/c/f1ae50cfb818ce1ac7a674406dfadb7653e2552d - https://git.kernel.org/stable/c/6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e
CVE ID: CVE-2025-21900 State: PUBLISHED Published: 2025-04-01T15:26:51.290Z Last Updated: 2025-10-01T17:18:05.662Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file If the file is sillyrenamed, and slated for delete on close, it is possible for a server reboot to triggeer an open reclaim, with can again race with the application call to close(). When that happens, the call to put_nfs_open_context() can trigger a synchronous delegreturn call which deadlocks because it is not marked as privileged. Instead, ensure that the call to nfs4_inode_return_delegation_on_close
deadlocks because it is not marked as privileged. Instead, ensure that the call to nfs4_inode_return_delegation_on_close() catches the delegreturn, and schedules it asynchronously. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4fe4ae6c2e01d028856b73b6328b12b8945df871 - https://git.kernel.org/stable/c/f41a60bc43e7abbc636fee78bed0d74c31e738b0 - https://git.kernel.org/stable/c/8f8df955f078e1a023ee55161935000a67651f38
CVE ID: CVE-2025-21901 State: PUBLISHED Published: 2025-04-01T15:26:51.807Z Last Updated: 2025-10-01T19:26:35.142Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add sanity checks on rdev validity There is a possibility that ulp_irq_stop and ulp_irq_start callbacks will be called when the device is in detached state. This can cause a crash due to NULL pointer dereference as the rdev is already freed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/aed1bc673907e3df372b317c10ff2f3582f8bf1a - https://git.kernel.org/stable/c/8cb0eef46d70a99c88c26a1addb7fd955242e0e6 - ht
aed1bc673907e3df372b317c10ff2f3582f8bf1a - https://git.kernel.org/stable/c/8cb0eef46d70a99c88c26a1addb7fd955242e0e6 - https://git.kernel.org/stable/c/f0df225d12fcb049429fb5bf5122afe143c2dd15
CVE ID: CVE-2025-21902 State: PUBLISHED Published: 2025-04-01T15:40:44.425Z Last Updated: 2025-05-04T07:23:51.470Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents are synced to the embedded controller and it ensures that the registers (in particular CCI) are synced back to the opregion on notifications. While there is an ACPI call that syncs the actual registers to the opregion there is rarely a need
on on notifications. While there is an ACPI call that syncs the actual registers to the opregion there is rarely a need to do this and on some ACPI implementations it actually breaks in various interesting ways. The only reason to force a sync from the embedded controller is to poll CCI while notifications are disabled. Only the ucsi core knows if this is the case and guessing based on the current command is suboptimal, i.e. leading to the following spurious assertion splat: WARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1 Hardware name: LENOVO 21D0/LNVNB161216,
] CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1 Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023 Workqueue: events_long ucsi_init_work [typec_ucsi] RIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] Call Trace: <TASK> ucsi_init_work+0x3c/0xac0 [typec_ucsi] process_one_work+0x179/0x330 worker_thread+0x252/0x390 kthread+0xd2/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Thus introduce a ->poll_cci() method that works like ->read_cci() with an additional forced sync and document that this should be used when polling with notifications disabled. For all other backends that presumably don't have this issue use the same implementa
olling with notifications disabled. For all other backends that presumably don't have this issue use the same implementation for both methods. References: - https://git.kernel.org/stable/c/012b98cdb54c7d47743ee7fc402fa23f2d90529a - https://git.kernel.org/stable/c/1aec5c9066965ac0984e385bbc31455ae31cbffc - https://git.kernel.org/stable/c/976e7e9bdc7719a023a4ecccd2e3daec9ab20a40
CVE ID: CVE-2025-21903 State: PUBLISHED Published: 2025-04-01T15:40:45.262Z Last Updated: 2025-05-04T07:23:52.726Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but check for NULL in case a packet is transmitted by a different protocol. References: - https://git.kernel.org/stable/c/d8be54c35aee29d96d1350b1b6f153be4da37c07 - https://git.kernel.org/stable/c/740bf9c9b715cc327d34b1e2d4ee79fcd4c47a56 - https://git.kernel.org/stable/c/cf7ee25e70c6ed
ttps://git.kernel.org/stable/c/740bf9c9b715cc327d34b1e2d4ee79fcd4c47a56 - https://git.kernel.org/stable/c/cf7ee25e70c6edfac4553d6b671e8b19db1d9573
CVE ID: CVE-2025-21904 State: PUBLISHED Published: 2025-04-01T15:40:45.881Z Last Updated: 2025-11-03T19:38:48.685Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: caif_virtio: fix wrong pointer check in cfv_probe() del_vqs() frees virtqueues, therefore cfv->vq_tx pointer should be checked for NULL before calling it, not cfv->vdev. Also the current implementation is redundant because the pointer cfv->vdev is dereferenced before it is checked for NULL. Fix this by checking cfv->vq_tx for NULL instead of cfv->vdev before calling del_vqs(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - htt
before calling del_vqs(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/990fff6980d0c1693d60a812f58dbf93eab0473f - https://git.kernel.org/stable/c/7b5fe58959822e6cfa884327cabba6be3b01883d - https://git.kernel.org/stable/c/8e4e08ca4cc634b337bb74bc9a70758fdeda0bcb - https://git.kernel.org/stable/c/29e0cd296c87240278e2f7ea4cf3f496b60c03af - https://git.kernel.org/stable/c/90d302619ee7ce5ed0c69c29c290bdccfde66418 - https://git.kernel.org/stable/c/56cddf71cce3b15b078e937fadab29962b6f6643 - https://git.kernel.org/stable/c/597c27e5f04cb50e56cc9aeda75d3e42b6b89c3e - https://git.kernel.org/stable/c/a466fd7e9fafd975949e5945e2
ernel.org/stable/c/597c27e5f04cb50e56cc9aeda75d3e42b6b89c3e - https://git.kernel.org/stable/c/a466fd7e9fafd975949e5945e2f70c33a94b1a70
CVE ID: CVE-2025-21905 State: PUBLISHED Published: 2025-04-01T15:40:46.465Z Last Updated: 2025-11-03T19:38:51.433Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's the last TLV in the file, it can perhaps even read beyond the end of the file buffer. Fix that by limiting the print format to the size of the buffer we have. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3
itional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/38f0d398b6d7640d223db69df022c4a232f24774 - https://git.kernel.org/stable/c/c0e626f2b2390472afac52dfe72b29daf9ed8e1d - https://git.kernel.org/stable/c/47616b82f2d42ea2060334746fed9a2988d845c9 - https://git.kernel.org/stable/c/88ed69f924638c7503644e1f8eed1e976f3ffa7a - https://git.kernel.org/stable/c/b02f8d5a71c8571ccf77f285737c566db73ef5e5 - https://git.kernel.org/stable/c/f265e6031d0bc4fc40c4619cb42466722b46eaa9 - https://git.kernel.org/stable/c/59cdda202829d1d6a095d233386870a59aff986f - https://git.kernel.org/stable/c/e0dc2c1bef722cbf16ae557690861e5f91208129
CVE ID: CVE-2025-21906 State: PUBLISHED Published: 2025-04-01T15:40:47.059Z Last Updated: 2025-05-04T07:23:56.656Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: clean up ROC on failure If the firmware fails to start the session protection, then we do call iwl_mvm_roc_finished() here, but that won't do anything at all because IWL_MVM_STATUS_ROC_P2P_RUNNING was never set. Set IWL_MVM_STATUS_ROC_P2P_RUNNING in the failure/stop path. If it started successfully before, it's already set, so that doesn't matter, and if it didn't start it needs to be set to clean up. Not doing so will lead to a WARN_ON() later on a
doesn't matter, and if it didn't start it needs to be set to clean up. Not doing so will lead to a WARN_ON() later on a fresh remain- on-channel, since the link is already active when activated as it was never deactivated. References: - https://git.kernel.org/stable/c/a88c18409b5d69f426d5acc583c053eac71756a3 - https://git.kernel.org/stable/c/d1a12fcb9051bbf38b2e5af310ffb102a0fab6f9 - https://git.kernel.org/stable/c/f9751163bffd3fe60794929829f810968c6de73d
CVE ID: CVE-2025-21907 State: PUBLISHED Published: 2025-04-01T15:40:47.576Z Last Updated: 2025-05-04T13:06:44.118Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: memory-failure: update ttu flag inside unmap_poisoned_folio Patch series "mm: memory_failure: unmap poisoned folio during migrate properly", v3. Fix two bugs during folio migration if the folio is poisoned. This patch (of 3): Commit 6da6b1d4a7df ("mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON") introduce TTU_HWPOISON to replace TTU_IGNORE_HWPOISON in order to stop send SIGBUS signal when accessing an error page after a memory error on a clean folio. Howe
RE_HWPOISON in order to stop send SIGBUS signal when accessing an error page after a memory error on a clean folio. However during page migration, anon folio must be set with TTU_HWPOISON during unmap_*(). For pagecache we need some policy just like the one in hwpoison_user_mappings to set this flag. So move this policy from hwpoison_user_mappings to unmap_poisoned_folio to handle this warning properly. Warning will be produced during unamp poison folio with the following log: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 365 at mm/rmap.c:1847 try_to_unmap_one+0x8fc/0xd3c Modules linked in: CPU: 1 UID: 0 PID: 365 Comm: bash Tainted: G W 6.13.0-rc1-00018-gacdb4bbda7ab #42 Tainted:
x8fc/0xd3c Modules linked in: CPU: 1 UID: 0 PID: 365 Comm: bash Tainted: G W 6.13.0-rc1-00018-gacdb4bbda7ab #42 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : try_to_unmap_one+0x8fc/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0x8fc/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs
x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c ---[ end trace 0000000000000000 ]--- [mawupeng1@huawei.com: unmap_poisoned_folio(): remove shadowed local `mapping', per Miaohe] References: - https://git.kernel.org/stable/c/608cc7deb428f1122ed426060233622ebf667b6e - https://git.kernel.org/stable/c/425c12c076e6fc6b2cb04b9f960319d31dcabc76 - http
8cc7deb428f1122ed426060233622ebf667b6e - https://git.kernel.org/stable/c/425c12c076e6fc6b2cb04b9f960319d31dcabc76 - https://git.kernel.org/stable/c/b81679b1633aa43c0d973adfa816d78c1ed0d032
CVE ID: CVE-2025-21908 State: PUBLISHED Published: 2025-04-01T15:40:48.171Z Last Updated: 2025-10-01T19:26:34.548Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd. Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back to NFS (which triggers writeback to NFSD via NFS loopback mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio): 6070.550357] INFO: task kcompact
ack mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio): 6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds. {--- [58] "kcompactd0" [<0>] folio_wait_bit+0xe8/0x200 [<0>] folio_wait_writeback+0x2b/0x80 [<0>] nfs_wb_folio+0x80/0x1b0 [nfs] [<0>] nfs_release_folio+0x68/0x130 [nfs] [<0>] split_huge_page_to_list_to_order+0x362/0x840 [<0>] migrate_pages_batch+0x43d/0xb90 [<0>] migrate_pages_sync+0x9a/0x240 [<0>] migrate_pages+0x93c/0x9f0 [<0>] compact_zone+0x8e2/0x1030 [<0>] compact_node+0xdb/0x120 [<0>] kcompactd+0x121/0x2e0 [<0>] kthread+0xcf/0x100 [<0>] ret_from_fork+0x31/0x40 [<0>] ret_from_fork_asm+0x1a/0x30 ---} [akpm@linux-foundation.org:
0>] kthread+0xcf/0x100 [<0>] ret_from_fork+0x31/0x40 [<0>] ret_from_fork_asm+0x1a/0x30 ---} [akpm@linux-foundation.org: fix build] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ab0727d6e2196682351c25c1dd112136f6991f11 - https://git.kernel.org/stable/c/5ae31c54cff745832b9bd5b32e71f3d1b607cd1e - https://git.kernel.org/stable/c/8253ff29edcb429a9a6c75710941c6a16a9a34b1 - https://git.kernel.org/stable/c/ce6d9c1c2b5cc785016faa11b48b6cd317eb367e
CVE ID: CVE-2025-21909 State: PUBLISHED Published: 2025-04-01T15:40:48.680Z Last Updated: 2025-11-03T19:38:54.220Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject cooked mode if it is set along with other flags It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor interface from the userspace. This causes a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit set because the monitor interface is in the cooked state and it takes precedence over all other states. When the interface is then being deleted the kernel calls WARN_ONCE() fr
and it takes precedence over all other states. When the interface is then being deleted the kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing that bit. Fix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with other flags. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5ea856d93794c4afa5542defd8c61f2708dc245a - https://git.kernel.org/stable/c/351eb7ac53ff1cd94d893c0c4534ced2f36ae7d7 - https://git.kernel.org/stable/c/cd1bdcb77fdc03c253137e55bae10551b3481461 - https://git.kernel.org/stable/c/236f41ca728f23210b31ed2d1d8a6df575a4b2d6 - https
bdcb77fdc03c253137e55bae10551b3481461 - https://git.kernel.org/stable/c/236f41ca728f23210b31ed2d1d8a6df575a4b2d6 - https://git.kernel.org/stable/c/ebebbb0eded2ed9a1abfa31962f6fb699e6abce7 - https://git.kernel.org/stable/c/521e55c2b0d6028861ac0a2d06aa57bb0e3ac486 - https://git.kernel.org/stable/c/ac4860141300581d3e2f6c6dafa37220f7ea9f65 - https://git.kernel.org/stable/c/49f27f29446a5bfe633dd2cc0cfebd48a1a5e77f
CVE ID: CVE-2025-21910 State: PUBLISHED Published: 2025-04-01T15:40:49.189Z Last Updated: 2025-11-03T19:38:56.982Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: regulatory: improve invalid hints checking Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regulatory_hint_user() call. Such invalid regulatory hints should be rejected. While a sanity check from commit 47caf685a685 ("cfg80211: regulatory: reject invalid hints") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons. 1) The way isalpha()
s") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons. 1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters. 2) While processing a user regulatory request, between reg_process_hint_user() and regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird lett
() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[]. Syzbot triggers a warning in is_user_regdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check. Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin letters and nothing else. [1] Syzbot report: ------------[ cut here ]------------ Unexpected user alpha2: A� WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/re
net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 Modules linked in: CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_power_efficient crda_timeout_work RIP: 0010:is_user_regdom_saved net/wireless/reg.c:440 [inline] RIP: 0010:restore_alpha2 net/wireless/reg.c:3424 [inline] RIP: 0010:restore_regulatory_
net/wireless/reg.c:440 [inline] RIP: 0010:restore_alpha2 net/wireless/reg.c:3424 [inline] RIP: 0010:restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 ... Call Trace: <TASK> crda_timeout_work+0x27/0x50 net/wireless/reg.c:542 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/62b1a9bbfebba4b4c2bb6c1ede9ef7ecee7a9ff6