[ciqlts9_6] Multiple patches tested (4 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

scsi: qla2xxx: Fix improper freeing of purex item

jira VULN-171237
cve CVE-2025-68741
commit-author Zilin Guan <zilin@seu.edu.cn>
commit 78b1a242fe612a755f2158fd206ee6bb577d18ca

RDMA/umad: Reject negative data_len in ib_umad_write

jira VULN-178542
cve CVE-2026-23243
commit-author YunJe Shin <yjshin0438@gmail.com>
commit 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2

KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

jira VULN-180397
cve CVE-2026-23401
commit-author Sean Christopherson <seanjc@google.com>
commit aad885e774966e97b675dfe928da164214a71605

can: raw: fix ro->uniq use-after-free in raw_rcv()

jira VULN-182366
cve CVE-2026-31532
commit-author Samuel Page <sam@bynar.io>
commit a535a9217ca3f2fccedaafb2fddb4c48f27d36dc

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	33m 0s	34m 4s
aarch64	18m 21s	19m 9s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	207	42	ciqlts9_6	✅ No regressions
aarch64	154	45	ciqlts9_6	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1453	82	ciqlts9_6	✅ No regressions
aarch64	1426	83	ciqlts9_6	✅ No regressions

• View LTP logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 25678081465

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/25667456941

[github-actions]

🔍 Upstream Linux Kernel Commit Check

• ⚠️ PR commit 31f87504d5f (nfsd: release svc_expkey/svc_export with rcu_work) references upstream commit
  f8c989a0c89a which has been referenced by a Fixes: tag in the upstream
  Linux kernel:

    69d803c40ed nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work" (Yang Erkun)

This is an automated message from the kernel commit checker workflow.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 31f87504d5f (nfsd: release svc_expkey/svc_export with rcu_work) → upstream f8c989a0c89a
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -348,4 +348,4 @@
-					     EXP_STATS_COUNTERS_NUM);
+					    EXP_STATS_COUNTERS_NUM);
 }
 
 static void svc_export_put(struct kref *ref)

• ⚠️ PR commit 344e81b8e96 (KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE) → upstream aad885e77496
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2891,5 +3051,5 @@
 	}
 
 	if (is_shadow_present_pte(*sptep)) {
-		/*
-		 * If we overwrite a PTE page pointer with a 2MB PMD, unlink
+		if (prefetch && is_last_spte(*sptep, level) &&
+		    pfn == spte_to_pfn(*sptep))
@@ -2912,3 +3076,3 @@
 	wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch,
-			   true, host_writable, &spte);
+			   false, host_writable, &spte);

• ⚠️ PR commit 8d49242d2d8 (can: raw: fix ro->uniq use-after-free in raw_rcv()) → upstream a535a9217ca3
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/can/raw.c
+++ b/net/can/raw.c
@@ -400,4 +433,5 @@
 	ro->bound = 0;
+	ro->dev = NULL;
 	ro->count = 0;
 	free_percpu(ro->uniq);

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/25667456941

[roxanan1996]

🔍 Upstream Linux Kernel Commit Check

* ⚠️ PR commit `31f87504d5f (nfsd: release svc_expkey/svc_export with rcu_work)` references upstream commit
  `f8c989a0c89a` which has been referenced by a `Fixes:` tag in the upstream
  Linux kernel:

    69d803c40ed nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work" (Yang Erkun)

This is an automated message from the kernel commit checker workflow.

Not sure why I don't catch this locally and in the cve remediation GHA. But this is true, the commit is reverted later.
To be investigated.

The fix is reverted, but It seems there is a proper fix here https://lore.kernel.org/all/20241225065908.1547645-1-yangerkun@huawei.com/
To be investigated if that can be included easily in this kernel.

FOr now, I'll drop this commit so we can merge the rest.

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/25678498120

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit d5462463f8e (KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE) → upstream aad885e77496
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2891,5 +3051,5 @@
 	}
 
 	if (is_shadow_present_pte(*sptep)) {
-		/*
-		 * If we overwrite a PTE page pointer with a 2MB PMD, unlink
+		if (prefetch && is_last_spte(*sptep, level) &&
+		    pfn == spte_to_pfn(*sptep))
@@ -2912,3 +3076,3 @@
 	wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch,
-			   true, host_writable, &spte);
+			   false, host_writable, &spte);

• ⚠️ PR commit 9d6cf6208cd (can: raw: fix ro->uniq use-after-free in raw_rcv()) → upstream a535a9217ca3
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/can/raw.c
+++ b/net/can/raw.c
@@ -400,4 +433,5 @@
 	ro->bound = 0;
+	ro->dev = NULL;
 	ro->count = 0;
 	free_percpu(ro->uniq);

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/25678498120