Cover Letter Detail
Show a cover letter.
GET /api/1.0/covers/2198394/?format=api
{ "id": 2198394, "url": "http://patchwork.ozlabs.org/api/1.0/covers/2198394/?format=api", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/1.0/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null }, "msgid": "<20260219200848.41897-1-ian.whitfield@canonical.com>", "date": "2026-02-19T20:08:47", "name": "[SRU,J/N/Q,0/1] CVE-2026-23209", "submitter": { "id": 89403, "url": "http://patchwork.ozlabs.org/api/1.0/people/89403/?format=api", "name": "Ian Whitfield", "email": "ian.whitfield@canonical.com" }, "series": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=XUGf/Y5i;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fH4GG1JvJz1xxN\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 20 Feb 2026 07:09:09 +1100 (AEDT)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1vtAKS-0001Nq-Kc; Thu, 19 Feb 2026 20:08:52 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <ian.whitfield@canonical.com>)\n id 1vtAKR-0001Nb-CF\n for kernel-team@lists.ubuntu.com; Thu, 19 Feb 2026 20:08:51 +0000", "from mail-qt1-f198.google.com (mail-qt1-f198.google.com\n [209.85.160.198])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 35A333F2C9\n for <kernel-team@lists.ubuntu.com>; Thu, 19 Feb 2026 20:08:51 +0000 (UTC)", "by mail-qt1-f198.google.com with SMTP id\n d75a77b69052e-506b3fb32a1so205429611cf.0\n for <kernel-team@lists.ubuntu.com>; Thu, 19 Feb 2026 12:08:51 -0800 (PST)", "from localhost ([2600:4041:dc:e800:330b:57ec:6fe8:f022])\n by smtp.gmail.com with ESMTPSA id\n af79cd13be357-8cb4b38e4f6sm1545869085a.13.2026.02.19.12.08.49\n for <kernel-team@lists.ubuntu.com>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Thu, 19 Feb 2026 12:08:49 -0800 (PST)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1771531731;\n bh=b4iPD1FQQyyO6nT4Vrb9oCKbcfEXHqFsZEfY/8729bo=;\n h=From:To:Subject:Date:Message-ID:MIME-Version;\n b=XUGf/Y5iCYAdcMNgeQ9Jsyz4SVVjllOYf/OEtHJrSYqOB9mNsZ/r7DDg2jVVWCFY6\n N7evEFPhJD2UVzFhTN3W6SjGCqbUbBfeMStYWkLXbOGH2tWygSgxaVqKOXQmIu9C5p\n xpaw9ydC3m3fldehuRmyPycdxPHjEVn3lEbSlBqdakcZ9MPlo7NZ0LTcUGM9fgH6qJ\n 9LSsPhZ5qH20cVv4iGZj81QjhV8G+fDRyMrXr1aBysdfrT5xmv5I6xIGYkGGVltQmo\n GBvQ0pBMl2eAPJ1JGrW1WKMWRBOuuUupVC7blzTTV7JMn3Z9J4Z05aWeMmYwsmEjZT\n vW+TFW69r8JPVA18gH8pR0IwGYimIFiAUOqw5F6VX4VCW2ftt3j+gbrcZqHYW/kLIY\n GPNCTK2J7x2sotOjxVaCTYH7ewjmAijCRHg4zTxQvP+gKbtBzvvpRTteuUM2pOwnfY\n hyQ74ikpsCMpW3Do24A9BPilRLRVw3raPbl+zaHV3KVB4XsEV/wXQJolUqxano/rLj\n taeUlfYt0/aTaBPonlTeC+e9VY0zG6rD7gAS+7OAnrwy753Vl+uWn22kasYBmcVtIx\n GNCCxUogOwgzI4YTOcZt3/M1cfDKctJrqPulCMiGnvsFz6devxlaRZ4v8kQjJwAgQQ\n x8fBvK05oNEY0tqIEY7OVFUA=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1771531730; x=1772136530;\n h=content-transfer-encoding:mime-version:message-id:date:subject:to\n :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=b4iPD1FQQyyO6nT4Vrb9oCKbcfEXHqFsZEfY/8729bo=;\n b=jFX+doW/+KLMKj2kBuDH/M6VHLttcFY5D9qVHiiLUVAYaECZGZt3mfz76er9DbHwQc\n 0bfPyvoFAXCQLCOXHUX8+FDHHwUJnYQ7letQEayKfqfwAfmFjeXjpOBvrfndlXxsq9u0\n cmn/HJGG2aM7QM3DSFFt+oBrwaSV8A8JAaeNHTvSn98k0mA4HPh8tOV7Bi+2/cHrfkHD\n igrueokAIt6knSmASD+1PnwrZW8kpBoXtdA8oPS9Lq2uWQZ0yYJ+rT0npxlFC7DvAojg\n LIEq6XI1OhWYv2/EJse/K2daU9jKva0gIX4gtKuxZpi+mHB1OaaDTeWVtB8PnC0J6Pfp\n 1Rbw==", "X-Gm-Message-State": "AOJu0YwDt+CI2UaB7989+032bV64VhYeynwjNXqHyo0XJpShN4tVC8nn\n bpsP62PYAK+QMQIa2k/9NgacrYS+Tub/2XT1varVe/G6QYvAdA2MzfsEWrKMVUgBZQTNicet01s\n lsRqEmHgfPAYY8bTXsYFZ06tyAGxnB6+bft4YhJ/IOQ3ITn9NytEyvZuVwJZu2byG8cCL/RhPMo\n u64aDYfZ6q7gnlOQ==", "X-Gm-Gg": "AZuq6aI+q7RlZbY2jE5RK5lAoYP9whFd3Cwn6JHVJBxLHVbWZ1eu3ff7wObaUPtaLs3\n KrU1WWjON1pb5A21GDsX/Km75ZHTPkhOwX7b2asdC+doNyqTiGzz2rHGDFYVSJFEmWHGtRw++mu\n MR8LkySEmd3PUoxiSVBf3j9CdQMrzXZNGXEzMMtCUR/zn+v3kQLbmUwgPq1l9JUPmjmWszBwdbb\n ic0avGjWCwmWe/k80iCti507FVG9dCcASyDxyoUk18FsUwg9sqqRjgoHIwmAwU8fHcfO5d8faoU\n V0QuMDMCJMZt8P3Rtd+WVB2U1qDG9h7LkdlscRHUJ/+IGlHXDYSeZ/okM7OBgwW5IsGdt/o3TN7\n 8k9HMD+85MVoI20DFfCixW7UUCNDbCM0=", "X-Received": [ "by 2002:a05:620a:4607:b0:8c7:176b:ebbe with SMTP id\n af79cd13be357-8cb4c014765mr2514788885a.57.1771531730034;\n Thu, 19 Feb 2026 12:08:50 -0800 (PST)", "by 2002:a05:620a:4607:b0:8c7:176b:ebbe with SMTP id\n af79cd13be357-8cb4c014765mr2514784785a.57.1771531729482;\n Thu, 19 Feb 2026 12:08:49 -0800 (PST)" ], "From": "Ian Whitfield <ian.whitfield@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][J/N/Q][PATCH 0/1] CVE-2026-23209", "Date": "Thu, 19 Feb 2026 15:08:47 -0500", "Message-ID": "<20260219200848.41897-1-ian.whitfield@canonical.com>", "X-Mailer": "git-send-email 2.43.0", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "[Impact]\n\nmacvlan: fix error recovery in macvlan_common_newlink()\n\nvalis provided a nice repro to crash the kernel:\n\nip link add p1 type veth peer p2\nip link set address 00:00:00:00:00:20 dev p1\nip link set up dev p1\nip link set up dev p2\n\nip link add mv0 link p2 type macvlan mode source\nip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20\n\nping -c1 -I p1 1.2.3.4\n\nHe also gave a very detailed analysis:\n\n<quote valis>\n\nThe issue is triggered when a new macvlan link is created with\nMACVLAN_MODE_SOURCE mode and MACVLAN_MACADDR_ADD (or\nMACVLAN_MACADDR_SET) parameter, lower device already has a macvlan\nport and register_netdevice() called from macvlan_common_newlink()\nfails (e.g. because of the invalid link name).\n\nIn this case macvlan_hash_add_source is called from\nmacvlan_change_sources() / macvlan_common_newlink():\n\nThis adds a reference to vlan to the port's vlan_source_hash using\nmacvlan_source_entry.\n\nvlan is a pointer to the priv data of the link that is being created.\n\nWhen register_netdevice() fails, the error is returned from\nmacvlan_newlink() to rtnl_newlink_create():\n\n if (ops->newlink)\n err = ops->newlink(dev, ¶ms, extack);\n else\n err = register_netdevice(dev);\n if (err < 0) {\n free_netdev(dev);\n goto out;\n }\n\nand free_netdev() is called, causing a kvfree() on the struct\nnet_device that is still referenced in the source entry attached to\nthe lower device's macvlan port.\n\nNow all packets sent on the macvlan port with a matching source mac\naddress will trigger a use-after-free in macvlan_forward_source().\n\n</quote valis>\n\nWith all that, my fix is to make sure we call macvlan_flush_sources()\nregardless of @create value whenever \"goto destroy_macvlan_port;\"\npath is taken.\n\nMany thanks to valis for following up on this issue.\n\n[Backport]\n\nThe patch was applied cleanly.\n\n[Fix]\n\nQuesting: Cherry-pick\nNoble: Cherry-pick\nJammy: Cherry-pick\nFocal: PR on Forgejo\nBionic: Sent to ESM ML\nXenial: not affected\nTrusty: not affected\n\n[Test Case]\n\nCompile and boot tested.\n\n[Where problems could occur]\n\nThis fix affects those who use MAC-VLAN to create virtual interfaces that map\npackets to or from specific MAC addresses to a particular interface. An issue\nwith this fix would be visible to the user via a kernel crash or networking\nissues with virtual interfaces (containers/VMs).\n\nEric Dumazet (1):\n macvlan: fix error recovery in macvlan_common_newlink()\n\n drivers/net/macvlan.c | 5 +++--\n 1 file changed, 3 insertions(+), 2 deletions(-)" }