[ciqlts8_6] Multiple patches tested (7 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet

jira VULN-193903
cve CVE-2026-17523
commit-author Thomas Gleixner <tglx@linutronix.de>
commit bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68

Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

jira VULN-186560
cve CVE-2026-46056
commit-author Shuvam Pandey <shuvampandey1@gmail.com>
commit 85fa3512048793076eef658f66489112dcc91993

Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

jira VULN-189582
cve CVE-2026-53071
commit-author Dudu Lu <phx0fer@gmail.com>
commit 42776497cdbc9a665b384a6dcb85f0d4bd927eab

ice: fix double-free of tx_buf skb

jira VULN-189502
cve CVE-2026-53009
commit-author Michal Schmidt <mschmidt@redhat.com>
commit 1a303baa715e6b78d6a406aaf335f87ff35acfcd
upstream-diff Upstream uses `first->type = ICE_TX_BUF_EMPTY` from the
  ice_tx_buf_type enum introduced by aa1d3faf71a6 ("ice: Robustify
  cleaning/completing XDP Tx buffers"). This tree predates that refactor;
  ice_unmap_and_free_tx_buf() gates all freeing on `tx_buf->skb != NULL`,
  so the equivalent clear is `first->skb = NULL`.

ipv6: fix possible UAF in icmpv6_rcv()

jira VULN-189491
cve CVE-2026-53006
commit-author Eric Dumazet <edumazet@google.com>
commit f996edd7615e686ada141b7f3395025729ff8ccb

i2c: stub: Reject I2C block transfers with invalid length

jira VULN-192581
cve CVE-2026-64191
commit-author Weiming Shi <bestswngs@gmail.com>
commit 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e

USB: serial: io_ti: fix heap overflow in get_manuf_info()

jira VULN-189703
cve CVE-2026-53196
commit-author Adrian Korwel <adriank20047@gmail.com>
commit 183c1076eca43bbb3e7bdf597456f91d81c73e74

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	17m 50s	19m 0s
aarch64	9m 58s	10m 38s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	108	31	ciqlts8_6	✅ No regressions
aarch64	66	21	ciqlts8_6	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1456	13	ciqlts8_6	✅ No regressions
aarch64	1425	14	ciqlts8_6	✅ No regressions

• View LTP logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 34856702243

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/34882790808

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit fb73e5552265 (can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet) → upstream bf74aa86e111
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -539,3 +557,2 @@
 	/* create notification to user */
-	memset(&msg_head, 0, sizeof(msg_head));
 	msg_head.opcode  = RX_TIMEOUT;

• ⚠️ PR commit 78d558b8e12e (Bluetooth: hci_event: fix potential UAF in SSP passkey handlers) → upstream 85fa35120487
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5521,6 +5526,8 @@
 
 	bt_dev_dbg(hdev, "");
 
+	hci_dev_lock(hdev);
+
 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
 	if (!conn)
 		return;
@@ -5523,7 +5530,7 @@
 
 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
 	if (!conn)
-		return;
+		goto unlock;
 
 	switch (ev->type) {
 	case HCI_KEYPRESS_STARTED:
@@ -5527,7 +5534,7 @@
 	switch (ev->type) {
 	case HCI_KEYPRESS_STARTED:
 		conn->passkey_entered = 0;
-		return;
+		goto unlock;
 
 	case HCI_KEYPRESS_ENTERED:
 		conn->passkey_entered++;
@@ -5543,7 +5550,7 @@
 		break;
 
 	case HCI_KEYPRESS_COMPLETED:
-		return;
+		goto unlock;
 	}
 
 	if (hci_dev_test_flag(hdev, HCI_MGMT))
@@ -5547,6 +5554,9 @@
 		mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
 					 conn->dst_type, conn->passkey_notify,
 					 conn->passkey_entered);
+
+unlock:
+	hci_dev_unlock(hdev);
 }
 
 static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4835,5 +4835,5 @@
 
-	BT_DBG("%s", hdev->name);
+	bt_dev_dbg(hdev, "");
 
 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
 	if (!conn)
@@ -4851,4 +5508,4 @@
 					 conn->passkey_entered);
 }
 
-static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data,
@@ -4855,5 +5512,5 @@
 
-	BT_DBG("%s", hdev->name);
+	bt_dev_dbg(hdev, "");
 
 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
 	if (!conn)
@@ -4889,4 +5547,4 @@
 					 conn->passkey_entered);
 }
 
-static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
+static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,

• ⚠️ PR commit 788d75dc9364 (ice: fix double-free of tx_buf skb) → upstream 1a303baa715e
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -2355,7 +2355,7 @@
 out_drop:
 	ice_trace(xmit_frame_ring_drop, tx_ring, skb);
 	dev_kfree_skb_any(skb);
-	first->skb = NULL;
+	first->type = ICE_TX_BUF_EMPTY;
 	return NETDEV_TX_OK;
 }
 

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -2296,2 +2188,3 @@
 	first->skb = skb;
+	first->type = ICE_TX_BUF_SKB;
 	first->bytecount = max_t(unsigned int, skb->len, ETH_ZLEN);

• ⚠️ PR commit 1064abc11089 (ipv6: fix possible UAF in icmpv6_rcv()) → upstream f996edd7615e
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -810,5 +812,5 @@
 	struct inet6_dev *idev = __in6_dev_get(dev);
 	const struct in6_addr *saddr, *daddr;
 	struct icmp6hdr *hdr;
 	u8 type;
-	bool success = false;
+
@@ -838,5 +1133,5 @@
 
-	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INMSGS);
+	__ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_INMSGS);
 
 	saddr = &ipv6_hdr(skb)->saddr;
 	daddr = &ipv6_hdr(skb)->daddr;

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/34882790808