Re: [BUG] watch_queue: RCU/info_id overlap leaks kernel stack

[Zhiyu Zhang]

Hi Jarkko,

Sorry for disturbing, and thank you for the concrete suggestion.
We have now reduced the watch_queue issue to a shell + keyctl reproducer
using watch_session, watch_add and timeout.

We will send the reproducers (including the complete exp for lpe) to you
and the relevant maintainers privately. I understand your point that a
similar reproducer can likely be recreated with a few LLM prompts.
Nevertheless, Documentation/process/security-bugs.rst says not to
publish a reproducer for an AI-assisted finding, so we are keeping it off-list.
The same guidance says that AI-assisted findings must be treated as public,
which is why the report was posted publicly.

We have also prepared the fix and verified locally that it prevents the
issue. We sent the report first so that the patch commit can carry the
stable lore URL in its Closes: trailer. We will post the patch for review asap.

Best,
Zhiyu

Jarkko Sakkinen <jarkko@xxxxxxxxxx> 于2026年10月28日周三 23:56写道：
>
> On Wed, Oct 28, 2026 at 11:41:35PM +0800, Zhiyu Zhang wrote:
> > We have a short source reproducer, exact config and QEMU results. In
> > accordance with the kernel policy, we are not posting the reproducer publicly.
> > We can provide it privately if a maintainer requests it. On the vulnerable
> > baseline it normally reports the canary, stack/task pointers and two agreeing
> > KASLR anchors within a few seconds.
>
> This is public nobody cares. Likely I could make the reproducec with a
> couple of prompts.
>
> What if you instead spent some time with your "short reproducer" and figure
> out how to make equal reproducer with bash and keyctl? It's a good
> habbit and helps to check the relevance because you have to think things
> through.
>
> This announcement is just total waste of time and energy anyhow.
>
> Br, Jarkko
>
>