Re: [PATCH v2] dlm: fix buffer overflow from negative len in dlm_search_rsb_tree

[Greg KH]

On Fri, May 29, 2026 at 09:24:59AM -0400, Alexander Aring wrote:
> Hi,
> 
> On Tue, May 26, 2026 at 12:09 PM Greg KH <gregkh@xxxxxxxxxx> wrote:
> >
> > On Tue, May 26, 2026 at 09:58:32AM -0400, Alexander Aring wrote:
> > > Hi,
> > >
> > > On Mon, May 25, 2026 at 1:39 PM Alexander Aring <aahringo@xxxxxxxxxx> wrote:
> > > >
> > > > Hi,
> > > >
> > > > On Mon, May 25, 2026 at 10:27 AM Alexander Aring <aahringo@xxxxxxxxxx> wrote:
> > > > >
> > > > > Hi,
> > > > >
> > > > > On Sat, May 16, 2026 at 10:03 PM Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> wrote:
> > > > > >
> > > > > > commit 080e5563f878 only checks for len > DLM_RESNAME_MAXLEN, which does
> > > > >
> > > > > check with checkpath, it reports an error regarding how this commit
> > > > > reference is done.
> > > > >
> > > >
> > > > This also addresses CVE-2026-43125 [0].
> > > >
> > > > - Alex
> > > >
> > > > [0] https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43125-c9f9@gregkh/
> > >
> > > cc the right folks cve@xxxxxxxxxx as described in the kernel documentation.
> >
> > For what?
> >
> 
> because
> 
> "If the CVE assignment team misses a specific fix that any user feels
> should have a CVE assigned to it, please email them at
> <cve@xxxxxxxxxx> and the team there will work with you on it." [0]
> 
> The initial fix did not resolve CVE-2026-43125, there are additional
> changes are required.

That CVE describes the specific issue that that patch fixes.  If there
are additional issues that this patch does not resolve, then it deserves
a new CVE for the new fix, OR you should add the new sha1 to the old CVE
entry.

Where is the new fix?

thanks,

greg k-h