From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A2EEB1494DB; Sat, 17 Jan 2026 14:43:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.165.32 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768661023; cv=fail; b=dZGEcuRms8M350QnjKjfpSxG0M2jS7QBnBHQVyH+ibzbVp7+0jHc/RYCknSUOl5PsygN3yIqZAHKjmxEJdWpu13QsXULvdOv2YVPgtJR3RbHLvtDm5nvk4Z0ra4YbCmaiiOVm7FO83621OZjLhxc4YSMyiMBzt2nJ2ZFKorT+Xs= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768661023; c=relaxed/simple; bh=Kc0h5TSm16eRtiidB3BlODORArotEFP2FUwcD8eK5gE=; h=Message-ID:Date:Subject:To:Cc:References:From:In-Reply-To: Content-Type:MIME-Version; b=WesR/2PcHkfLdHglZWLDBtg7okCo17+Xxk69OpY+rM3ibqfnDccpsFgG2D101uB2XbAyy1K3KlC7vNZEKm9d0K9nNaGMUrvfGtMR2LCPEThsPj/bzZPfQ2D3fPWah5s1opdpqcyP4jjL9D/R2wj3nUAC8UMYDsu4rdEHvtAJhu4= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=MThvlmKe; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=WyC28iO4; arc=fail smtp.client-ip=205.220.165.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="MThvlmKe"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="WyC28iO4" Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 60HDtdeV974259; Sat, 17 Jan 2026 14:43:32 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= corp-2025-04-25; bh=wGd1Rd8MXmbpFz3cpILUEXJgnJTTl2/BY6kSVa9+Diw=; b= MThvlmKe+XT8Wshvhjr83b//9n8ZSh6ug61/q/oJY85hruqykzhWqnldXDQKdwmy y+CVTSTPredjQJsngOx5kMcDy62aXDC/oZaW1gLtmfVQpP8EVfZbnBe1bxCuDsQU NbXX2zbQnohMsGrJJkrFi7sn5PWPFEQzglnW5jTPPF8BezS+EJHg5gL4+Z3A+N2o NIlMnoOVRMWu7FhSA2a3vyPz9HD8ivOSlcZE9nMiwzFoCEvZZNmF3uzasMSg6752 WW6d4TvRADnIv4PiGAv1WLyYWwpPP+XVMG36mWK2XtLMrkN+qqoE+Lkl17CIGOuJ 6gR/A2wcQTFAhhDHOA0nTA== Received: from iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta01.appoci.oracle.com [130.35.100.223]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 4br10vrc7w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 17 Jan 2026 14:43:31 +0000 (GMT) Received: from pps.filterd (iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (8.18.1.2/8.18.1.2) with ESMTP id 60HEHYXf022460; Sat, 17 Jan 2026 14:43:30 GMT Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11011060.outbound.protection.outlook.com [52.101.62.60]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 4br0vae1w1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 17 Jan 2026 14:43:30 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YEyMsnMrdgnician01CNci4u/2Ao/bizoZnXhYRTFjaC0sMWTAS1V1NTAWxxiS6qXl8/u/RnHgqgz389bGj2iqCCYy3YqML9FmWQEWYebh2o693N+5ORTQwyruXAmD2zJciH0NcFX1U0Qo63rsn9YE3VI0DOUOCFYpSly7IS1HOPflnQecvqNxKnx0wy05WtZ3rwaoGZA5FbMM0H9scVVtFrzxLtQNUy1GLpNhoutGJ8l958PS3Md4j6XumX4nRg8vd3NGrX9Bse3/Be31noufkmAzxHnFplvzUnvX7KQ1LAVloTJ6fTGMQxWeUeGCyGgQp860TuE+0dEWLJns8VVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=wGd1Rd8MXmbpFz3cpILUEXJgnJTTl2/BY6kSVa9+Diw=; b=wbbtQ+v+3WWeVGOr/ISrrspr8V845TCPY6m0mDVqH0mV2G9lDIRhFuRQWcCvNyP6GlFWZ7Cr0p0cWlYAXi4qUZ+na8S/focWpt0GTX/1QhhJmDE/WObW/zIsXbU9iJ/hgRkfvGK4rigf9BfwOLUHnLAk+u3HF4u3Uj8OxI22fFbntZvhEls8hnRbR3a/DRmXbhv1K+b15jwic0mL0Xu0j+0tDMLSNBaec/b4p7Vu6m45tvMpc69hbrsvrSspCTe3lwo4O+QrfGjSUKI4Zzm4j197TrPoWk/HOOScwwE6hfGl21xTcEr0olVb+iDFcf4XGvSq2hYDDvjcCu2zOfKdlw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wGd1Rd8MXmbpFz3cpILUEXJgnJTTl2/BY6kSVa9+Diw=; b=WyC28iO4jEWy9uIkrOB2XpRj9HovdpPcWcoEeBtrUh8Lo4Pr/Q0hZKjQmDXtenaTqxxMOuTL0YFHD5ooh3tptJ1mugqtC5aU9MwFnGvD85xwn4DkUsSAGCfiFWV18ToF09uQLYJkk2pTMrnoTxZezAsqb8n/HBAtmaJCcqUdRaU= Received: from DS3PR10MB997700.namprd10.prod.outlook.com (2603:10b6:8:347::19) by PH8PR10MB6549.namprd10.prod.outlook.com (2603:10b6:510:227::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9520.5; Sat, 17 Jan 2026 14:43:28 +0000 Received: from DS3PR10MB997700.namprd10.prod.outlook.com ([fe80::4c1c:3bb:c4c9:8e7a]) by DS3PR10MB997700.namprd10.prod.outlook.com ([fe80::4c1c:3bb:c4c9:8e7a%6]) with mapi id 15.20.9520.005; Sat, 17 Jan 2026 14:43:27 +0000 Message-ID: <234e1969-d574-469e-a571-e1165d274cef@oracle.com> Date: Sat, 17 Jan 2026 20:13:21 +0530 User-Agent: Mozilla Thunderbird Subject: Re: CVE-2025-68212: fs: Fix uninitialized 'offp' in statmount_string() To: cve@kernel.org, linux-kernel@vger.kernel.org, linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman References: <2025121630-CVE-2025-68212-eab7@gregkh> Content-Language: en-US From: Harshit Mogalapalli In-Reply-To: <2025121630-CVE-2025-68212-eab7@gregkh> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-ClientProxiedBy: LO4P123CA0276.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:195::11) To DS3PR10MB997700.namprd10.prod.outlook.com (2603:10b6:8:347::19) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DS3PR10MB997700:EE_|PH8PR10MB6549:EE_ X-MS-Office365-Filtering-Correlation-Id: 09810e28-826e-4830-ef32-08de55d6c653 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|376014|1800799024; X-Microsoft-Antispam-Message-Info: =?utf-8?B?ZkdORU1QN25hWVVSaXpKYmlUYXpnWk1oenFBTWQzZis0RVI4Q0NVbU9aQ2pU?= =?utf-8?B?ek1VcW9QTWtqNXF5MjVjRTZOVDd1Ly9ldk9iZjl1WkhTSUpZM3BaQjF5ZGpW?= =?utf-8?B?aWt1MEdDeVR5UnVCaFBOZUI0Z2RoUU96QWhlNU93OUl0YkFwTmhNdjl3SFcv?= =?utf-8?B?a1pyTUgvWEVwSWM5ZWtiZ05wTTRid0VyV2xEOG0vSExscGZoeFNEVU1Teld3?= =?utf-8?B?VWEveUg4UU1pTnVyVlpCUTRhQ2NZMDVraHBmQmZYQkRLZGdjM3NsdEZGc3hu?= =?utf-8?B?SDBIYy80K2c0STJNaFlqZ2NMcDA0bFFZR1Y5OVhod2FiRDVHOXFnc1pnZ0Nt?= =?utf-8?B?S2MyaDBrMkIxMUhSNmJRbWtEejNFa2ZPZmpHRThFeDM5MEQwdG9QSDRSNFls?= =?utf-8?B?b28rYXBZejUzWThyRHpmYjJ6NGFSREQyNis4Nm1ubmhxNVlROERVMStlVjFI?= =?utf-8?B?NkN0VDZnMlhXNnlET3pLVVBCaFBkdHBTZ0VxbkpjK29aQ1pFdE4zbzZUbjN1?= =?utf-8?B?QkhjbFRuV2RFS2I3Y0NvS0Q0YXF2enhIRDVpOE40RUF4eDJFTHJxLzdDQmpu?= =?utf-8?B?WTFiczloOEdJa2E5VVI0b2dCWnpBOTM1R2V2SU1YeDhzWVlwQmM5cnM3Tzh6?= =?utf-8?B?VmZkUEltU0JLd0RTb3dEdGI5TDBZUi9WZW92dm0wYjNwaE1WS0dLNDJ6NXJS?= =?utf-8?B?MHl6MnVnSHo4V0VNS040aCtLY0tXRVBHSTZYRDk2UWMzb09XZTVyeTdnc3Ux?= =?utf-8?B?K1Z2WjJFYmIrTlB3cmNlUTBCZXNxbFFQVGhqc3JQNlVIQTZuMSt1QTJ1b3Qw?= =?utf-8?B?cHIvekJjd1hzSDZVMmRSVHd0VDcvNUNWYXBiZTNTSVJqbkdzZlkydlpVM2Z1?= =?utf-8?B?blBpREFaZFRuWk5lb1NFaUZqd1JPakhVMS9MSzVackpKeU81Z3lyTzRLQkQ0?= =?utf-8?B?aHRkK0NVdFM1bHZLbk9FZnF1N0picmVDY0NzN0d1VVprTkpMSGFFQUdFTDVu?= =?utf-8?B?Rmtzem9jeFVaOHc0bFlFYzMxRXplWDFQM1F4MkZhelh3a3g4V3hWR2NqZkRs?= =?utf-8?B?d3dWSExQWks1RGhOUnpWRlp1Sno2M1dNNnhSaEZTZmZIV1JMK0V2QmRWdUtV?= =?utf-8?B?cW1RYmo3OVd1TmJobUE5VzgrcTIyVDQ3Wk9Sc3VDOE9XdnU4NHB6aml0TmJp?= =?utf-8?B?UEJlVUk2Zk9RcEpuSVZ3NjIyOFJ2ZVRxZjU2Vll4VXV3TGZLb0dqNHJlb3pU?= =?utf-8?B?YXNOZkhLczY1UDVGU0FCajZRQUx4U2lKdE1jOWdHNjJuWHNlWjF5WVB1YTVr?= =?utf-8?B?UVhJK2FPZnZLeWxzRklxM05LYXB3cXJLR1AzWnNzY1A5U2VOa1dleEpPSmJG?= =?utf-8?B?NlV3NlEyTGc2WUFpV0pQcEs5UW1nR3g4eG8vY2VnNG5wc05jaW9uM050L3J0?= =?utf-8?B?SDI1TDdZWE81WkliUC9YdGFnYkNtUkQ0ajJqQ3VYWXYvemtOQURUNVBmOVZp?= =?utf-8?B?SlZuMnpLYUR0V0o1RjdscEM1M2QrNW9CR0dSTE9jQW5YVlVNUlVQQVZuUExz?= =?utf-8?B?cXkrT25HVkZBaUZ0OFJFVlNNM1QxeG1Ib083QWxVUFNLalMvWkRpUGJFVTNE?= =?utf-8?B?MCtDK1AybnNlVllDaG9XVW95c2F6bVdnckEyMWp4WC9UYlE0MzZ3TWdQS3Uz?= =?utf-8?B?TGErMEFJanQyYjNHY04rRmpyUFM4UnFhaXViZ0p5REhOeHhCcjJjdXdnK24z?= =?utf-8?B?K2l0LzJ2Z3h4aU8wZlFJV0M4M0F2RXFFT2daUXJXd1AxT2V1N1JsZVdHM3Ru?= =?utf-8?B?RGllZWJFTURDTk1DR21lQkdUZmxTU0xyT2h6UDYyTWxEV3JUTmJoVlliZGdi?= =?utf-8?B?T2hKd25ycFVzTUhhc0xVMVdhUG5JTkgxRE1MTGFZYkFscHArOEs0QTFjVGYy?= =?utf-8?B?ZWhaZnBwZ0FUVVRRS3R5MHdXbUVOSGxITk5xVUMzY1dlenptamtwK2F2dENk?= =?utf-8?B?bXZKNGlzS2hWOTZ3cS90MGlVWmxvWnlYK0M4eXpNTytmdG1nY041bWNDU2Vz?= =?utf-8?Q?3ZEycB?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DS3PR10MB997700.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(1800799024);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?eXlrRk4xU3JRWXd6N29oamJjTGF4dE1HK0pGcDdpNWhPYVExZUVENnRSaEZY?= =?utf-8?B?WjhxcFI4eDRZVE9sVThjSnZZeGRWYlFXTjJGOVk1QnhUdkkrYW9lODBUYmNp?= =?utf-8?B?N2gvejV5TzBrREtiN1haRnhHN1dhZHZJZzVyS1NDN1l5ZlBNTlFQZ3hjd0RG?= =?utf-8?B?OSt1RXhieHpqZ1BmWjcwRmwzcWpzdjZtMEV6SThmQVNjTXV4OUl1MWRzWmdS?= =?utf-8?B?bk0zY2dQQUFCeGRFdm54aFZBKzdrNjlybXR5eEszZG15aUI3citCTFBPQ1Ja?= =?utf-8?B?NGhCdDY0aHo1ZERMTFpuZ29vRVFmUWdFNUlOSVJsd2FGN0VuQ3NUa1M3TzFF?= =?utf-8?B?bWcrNG9UZEZncGwxOW9Eb3hhdlk3Mkxydk9UZXZ5elN6OTg2aTFXQStyaVBn?= =?utf-8?B?emhRSkVraWlXUjU5bG9ZS0w5TEpTT1pzYXordWVxWHFiYm0xYjgvc3A1Sk5h?= =?utf-8?B?OHAxdm5ZUkhDbmlybS9Cc2pSTHNGRGF6SElDUTZRL2RCTzl4ZThjbDRKK2dC?= =?utf-8?B?WW5jcSs1TDJzWU56Mm5zWkp6WUdZWG1DYmhZb1ZPMjdQRlVja3l0NWh2bklW?= =?utf-8?B?ZjJ1TG9WelZzc3Z0UWVJR2QxeFlmSkxhOG9rdmdlS2Y4bUlrQmppVzArU2FO?= =?utf-8?B?K3EzckdjTXlGdWhIOWFvOWtNTTBtN0FEck8xZG1WdytMdXN0QnpPUEQ2WGpz?= =?utf-8?B?WG16Z2YyRFhsa2xIVm5HUnZjaXQyNHZoZ0FJTnYxWkh3UmxzYlFKUTEwV01u?= =?utf-8?B?T2F1NFVreXM1MkFMbEE2SVRTYnNMNHZBYkVickF5V2RueEE1UHdZYWRXRWI1?= =?utf-8?B?bERPb1daWFRoV3RrdjdONGQxVVRrd3lvcEh3R2Z1SGVMWjZDTElqMWM5bjc2?= =?utf-8?B?ZjI5VmtxSEhGaVlET3RYTForQ05DbW90cEdkeXVndGpxN1RtQVNZaElDaE9F?= =?utf-8?B?ZzU3a1pJTHpXbDBiQUljK3Z2bklXNTZlWEwydkhvQTI1c1F6cDAra2cxbDBx?= =?utf-8?B?bmNTaUtLbzJkTy9OOWJuNDZ4cmxzNDVtSDY5bXJFaEhaY1NWTFlyRXhKeDRt?= =?utf-8?B?YXkxcmt0WW0wQTk3c29kcTU4SVo2dFhEemZBNEJvemw1UktlSWVXS2VXdVVk?= =?utf-8?B?LzFUbkdKMkVWeUJqZWM2QTFnQWhzOHJzSUJxSTZsRjZSTTI4S0Q0akh5ZStG?= =?utf-8?B?aHM3MVZYSVRNeGRVQkNXVzR6SnEycklQL20wbE81aXdFZHNQVlBZVTNlSXl2?= =?utf-8?B?ZWVJQWJLYitZRkJnQTNWTkxwaHA0ZmFUN21BVDdsMWF4bGxLWnU3T2VPNGhz?= =?utf-8?B?VlhTNjNJb0JPdmVLd2FSRFhkN1I2V3hLcHgzaFNrZW9XNzJZaTBRRmpqUWNY?= =?utf-8?B?c2VnTWpHK0Z4ckRwL0lMSG9tWi9hYWtFa05wRmVBaFYybW96dmFFbnJmUHFF?= =?utf-8?B?dEVvSDFoODlxeTBSVmoreHlnb2ZJV2pTYzRYbXI0OUpOeGNqYWo2K0NUamh0?= =?utf-8?B?a0U0Qm1pd0lZdkttc2V0R3A2a013M1lvSTFudGF0VTNXc01ad01VSSs3alpU?= =?utf-8?B?M0lRSHFWdGdiMjlQMEpsZjVtOExyRE5FeGxxTVJpdU9odVVyem9QM1pUVkxV?= =?utf-8?B?NlRydWZseFJhTkJjYTU3N0pFVGZqYU44OUxtd1cxbG5TU3g0RExpZGFjTkJD?= =?utf-8?B?czZKaTU4Q2JOUGp1VE1DdDB3NU1LYkFIMVl6cC9kS0RUdXhoUHprODg4dkxD?= =?utf-8?B?bXdXWjh6MjFxTFZtUndJSnc5WC9BZllSSXU4R1N3MWdDUUtld3Faak9Yemxv?= =?utf-8?B?WXhjSzVYOHdvd1NDV2xCMWxBbHBRbWZJTi9BWll2NFJjL1BTQmR3QllFbFor?= =?utf-8?B?T3NLUVJGYUJKdHBLRXlrRjVQNFhtUlNvYlNPbEhaSnhhMHZ1TlI2OVF6NFcv?= =?utf-8?B?YWZWZ2xBd0prK0FwOTlXMHhwUnUvZlpKSzBDRWpHS0ZxbE9nTWhBb3h6VzZI?= =?utf-8?B?Rk1lZUNBb0dZV3orZUJqWFJUKzVrbzQ1c2N3K2s0YmdJR1p2bm50THBGSXpD?= =?utf-8?B?bDliVVJTakdSdVRlK3g2VE95V2kvbC81dVFhenUxY2MvT2RwVEpBNkpCdUl4?= =?utf-8?B?ejNZZkRBTE9OaVRXWFBWa0dJNFFjZWVpRUFHYXBZWmV6U0w2c0xsUEdFOXFu?= =?utf-8?B?bytEN0FMaTRIem9ZZWtkQzVUSmU4WGM1bW5LSDdMOE04MHdHeC9ycVRpR1JX?= =?utf-8?B?QjkvTVFJaGE3cmZobmlrRzR2NkdMaE5FNzBjbWZxRTFtcGRML08vNURmclZE?= =?utf-8?B?aUxoRGVKYlQveWxaWnNBMHNGcnF0akRKcmcwRzdHb05ZTnJXbDQ4bjFEbkxz?= =?utf-8?Q?Kkj9oWy+gjbVvKkoOzF4rZrCZ59oOAFVhDeBX?= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: yc1YHV7K3RJtwyO4irGVxJgg3EL0mrn40gFqekFAj5B3O4YqQRWstxZqKFoqM/TrdIyNQkRZ6/sweCDE4SibfmrJpN0sjx4tGOZ+e4ploynJ4h8S13ibtDs4GWqGl9yjnWDV08DeaBLQ3MbsbaAd/9UsTFMRid6ZkJn7wFgdXoze0IDx8M8AIiRDvlik/pKTp0J4RVezbAruhAR0DX+SmyvS/nbTJPdnTw7FGXZBiSLyhOai9L3xf+kdLp7qDZC+cbCUgU2ES/ksNRXA2wLmgzls6UroSxJUbexIy+Kben+5GHqqV+zeZibGuCrbetm6TeQIqmN9q3k9Gx1AgDoTSBnlJJv3rg9AHQZ8uSSKtNHPvCcihqUuxcIEw1taKyH/gBxxxUOv4mz78qmrbJRvEXfhtOZFoG8cZYjytBAnYG14ObQQMluWdYqMcygrnZ2YJY158jO0BZQBgWpjTTJSmnjuM2nqdclBgCtaB48iZV/RWJPFiq7ufZLUdZgsmk+qKvNIeFrHtUPSrj3NkQLXaRJFhPdnQRHog89aiNxMuTSvUYPWbQr5tnYLT8d3ay90ADYqRLrAjD3mmElC8mWxBByrOdgD0I3DRPeVQ1HNzMY= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 09810e28-826e-4830-ef32-08de55d6c653 X-MS-Exchange-CrossTenant-AuthSource: DS3PR10MB997700.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Jan 2026 14:43:27.3603 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jxmKpBrqBNkecmIZrg9oVwZzOF+sl+EE4DyMJYxQ9jrf61Yo10wBd8b9AX7xFsGhF/VEVa4kRre28XghbQQD4/66AgXIrHpuOUBZ79dPYpmZbS90UrGJ7VQ4hmEkXtZy X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR10MB6549 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2026-01-17_01,2026-01-15_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 adultscore=0 bulkscore=0 phishscore=0 mlxlogscore=999 mlxscore=0 malwarescore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2601150000 definitions=main-2601170122 X-Authority-Analysis: v=2.4 cv=H4nWAuYi c=1 sm=1 tr=0 ts=696ba013 b=1 cx=c_pps a=zPCbziy225d3KhSqZt3L1A==:117 a=zPCbziy225d3KhSqZt3L1A==:17 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=vUbySO9Y5rIA:10 a=GoEa3M9JfhUA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VwQbUJbxAAAA:8 a=8r2qhXULAAAA:8 a=JdEro35RFbQR3I6S1jQA:9 a=QEXdDO2ut3YA:10 a=8gvLZcY7Nlvl4CGD_6nf:22 cc=ntf awl=host:12109 X-Proofpoint-GUID: eUI9MvItLa7DqJ8f2fNq7vltzzUmu5-9 X-Proofpoint-ORIG-GUID: eUI9MvItLa7DqJ8f2fNq7vltzzUmu5-9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMTE3MDEyMiBTYWx0ZWRfXxdNEBToBnETb zUB7QGdvyFM2hfsEiB1FvtoZeVVew41stDF/WmwWEF9Xrh6ZY+LjNg5hhD1K0OnXukM1SFe+eoX c+2/76KCMMH/fVmd9T1lLLH53vdOnewVnUVoEyR8qiaiHFNIDkAdoJpNWjLOfJTZZj+z9xUuasN JrIdWeILD6IOXfL8fEgA8nvfzSdorqMqwjSJLHKwGq2cFrYeJY5MidIHndRRkOceIN3WDkiWjnV G6mtyv474WY3XjG7oiu27L8yizy6HDFdevyUnEV6vFUybXWa4LmpO709AFMJXjG0WvAbksEkAbi re2W164xEr8A7w3DPjKFtDyh1ap8NG4T/NwhpQxqc6gDubv+C3hajEPTL5jZDNIGRBDWP4cznd5 7s5887hs72XKIK9CElC4WTZUMHt82ueoD629izLeJJ5+fL0zkD6Jvsk6X6y41z5LjYaG+sKOA9u ZZ2PQPoEqn45blHO/nMbFIL2s9wuhZzboE9MF5Gk= Hi Greg, On 16/12/25 19:27, Greg Kroah-Hartman wrote: > From: Greg Kroah-Hartman > > Description > =========== > > In the Linux kernel, the following vulnerability has been resolved: > > fs: Fix uninitialized 'offp' in statmount_string() > > In statmount_string(), most flags assign an output offset pointer (offp) > which is later updated with the string offset. However, the > STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP cases directly set the > struct fields instead of using offp. This leaves offp uninitialized, > leading to a possible uninitialized dereference when *offp is updated. > > Fix it by assigning offp for UIDMAP and GIDMAP as well, keeping the code > path consistent. > > The Linux kernel CVE team has assigned CVE-2025-68212 to this issue. > > > Affected and fixed versions > =========================== > > Issue introduced in 6.14 with commit e52e97f09fb66fd868260d05bd6b74a9a3db39ee and fixed in 6.17.10 with commit acfde9400e611c8d2668f1c70053c4a1d6ecfc36 > Issue introduced in 6.14 with commit e52e97f09fb66fd868260d05bd6b74a9a3db39ee and fixed in 6.18 with commit 0778ac7df5137d5041783fadfc201f8fd55a1d9b > Issue introduced in 6.12.14 with commit d49c64c1d723c167f521833f429ab28d3ca7e0d9 > Issue introduced in 6.13.3 with commit c3787a4fae66e710543137b4b1b073cb2bff3bca > I have reviewed the broken commit/vulnerable commit for this: Probably the logic in scripts is to find the oldest Fixes tag if there are more than one Fixes' tags in the commit message: commit 0778ac7df5137d5041783fadfc201f8fd55a1d9b Author: Zhen Ni Date: Mon Oct 13 19:41:51 2025 +0800 fs: Fix uninitialized 'offp' in statmount_string() In statmount_string(), most flags assign an output offset pointer (offp) which is later updated with the string offset. However, the STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP cases directly set the struct fields instead of using offp. This leaves offp uninitialized, leading to a possible uninitialized dereference when *offp is updated. Fix it by assigning offp for UIDMAP and GIDMAP as well, keeping the code path consistent. Fixes: 37c4a9590e1e ("statmount: allow to retrieve idmappings") Fixes: e52e97f09fb6 ("statmount: let unset strings be empty") For the CVE fix, the actual broken commit which is more appropriate is 37c4a9590e1e introduces the STATMOUNT_MNT_{U,G}IDMAP cases but only writes sm->mnt_* = start while leaving offp unset, so the shared tail of statmount_string() later dereferences an uninitialised pointer. Hence 37c4a9590e1e is probably the more appropriate vulnerable commit for this CVE. Should I send a patch to add CVE-2025-68212.vulnerable for getting it updated correctly ? Thanks, Harshit > Please see https://www.kernel.org for a full list of currently supported > kernel versions by the kernel community. > > Unaffected versions might change over time as fixes are backported to > older supported kernel versions. The official CVE entry at > https://cve.org/CVERecord/?id=CVE-2025-68212 > will be updated if fixes are backported, please check that for the most > up to date information about this issue. > > > Affected files > ============== > > The file(s) affected by this issue are: > fs/namespace.c > > > Mitigation > ========== > > The Linux kernel CVE team recommends that you update to the latest > stable kernel version for this, and many other bugfixes. Individual > changes are never tested alone, but rather are part of a larger kernel > release. Cherry-picking individual commits is not recommended or > supported by the Linux kernel community at all. If however, updating to > the latest release is impossible, the individual changes to resolve this > issue can be found at these commits: > https://git.kernel.org/stable/c/acfde9400e611c8d2668f1c70053c4a1d6ecfc36 > https://git.kernel.org/stable/c/0778ac7df5137d5041783fadfc201f8fd55a1d9b >