Bug#1118437: marked as done (kernel crash in interrupt after receiving an ip packet on veth from xsk from user space (CVE-2025-40290))

To: Bastian Blank <waldi@debian.org>
Subject: Bug#1118437: marked as done (kernel crash in interrupt after receiving an ip packet on veth from xsk from user space (CVE-2025-40290))
From: "Debian Bug Tracking System" <owner@bugs.debian.org>
Date: Mon, 15 Dec 2025 20:13:07 +0000
Message-id: <[🔎] handler.1118437.D1118437.1765829416995021.ackdone@bugs.debian.org>
Reply-to: 1118437@bugs.debian.org
References: <E1vVEtY-00GipX-2M@fasolo.debian.org> <176091056328.779313.4901801207060344593.reportbug@noti>

Your message dated Mon, 15 Dec 2025 20:10:12 +0000
with message-id <E1vVEtY-00GipX-2M@fasolo.debian.org>
and subject line Bug#1118437: fixed in linux 6.18.1-1~exp1
has caused the Debian Bug report #1118437,
regarding kernel crash in interrupt after receiving an ip packet on veth from xsk from user space (CVE-2025-40290)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1118437: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1118437
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

--- Begin Message ---

To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: linux-image-6.17.2-amd64: kernel crash in interrupt after receiving an ip packet on veth from xsk from user space
From: mc36 <mc36@freemail.hu>
Date: Sun, 19 Oct 2025 23:49:23 +0200
Message-id: <176091056328.779313.4901801207060344593.reportbug@noti>

Package: src:linux
Version: 6.17.2-1~exp1
Severity: important

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
a downstream packager reported hard crash to freertr.org xsk dataplane....

   * What exactly did you do (or not do) that was effective (or
     ineffective)?
found out how this all happened... will attach screenshot of the crash, and the
reproducer code...

   * What was the outcome of this action?
kernel hang...

   * What outcome did you expect instead?
nothing... it survives on oldstable kernel....

*** End of the template - remove these template lines ***


-- Package-specific info:
** Version:
Linux version 6.17.2-amd64 (debian-kernel@lists.debian.org) (x86_64-linux-gnu-gcc-15 (Debian 15.2.0-4) 15.2.0, GNU ld (GNU Binutils for Debian) 2.45) #1 SMP PREEMPT_DYNAMIC Debian 6.17.2-1~exp1 (2025-10-13)

** Command line:
BOOT_IMAGE=/boot/vmlinuz-6.17.2-amd64 root=UUID=9dede21d-ca7a-40c4-9b21-64ff63cbd2b8 ro panic=10

** Not tainted

** Kernel log:
Unable to read kernel log; any relevant messages should be attached

** Model information
sys_vendor: Dell Inc.
product_name: Latitude 5540
product_version: 
chassis_vendor: Dell Inc.
chassis_version: 
bios_vendor: Dell Inc.
bios_version: 1.23.1
board_vendor: Dell Inc.
board_name: 031CD3
board_version: A00

** Configuration for modprobe:
blacklist arkfb
blacklist aty128fb
blacklist atyfb
blacklist radeonfb
blacklist cirrusfb
blacklist cyber2000fb
blacklist kyrofb
blacklist matroxfb_base
blacklist mb862xxfb
blacklist neofb
blacklist pm2fb
blacklist pm3fb
blacklist s3fb
blacklist savagefb
blacklist sisfb
blacklist tdfxfb
blacklist tridentfb
blacklist vt8623fb
blacklist microcode
install ib_qib modprobe -i ib_qib $CMDLINE_OPTS && /usr/lib/truescale-serdes.cmds start
options snd_pcsp index=-2
options cx88_alsa index=-2
options snd_atiixp_modem index=-2
options snd_intel8x0m index=-2
options snd_via82xx_modem index=-2
options md_mod start_ro=1
options bonding max_bonds=0
options dummy numdummies=0
options ifb numifbs=0

** Loaded modules:
cmac
nls_utf8
cifs
cifs_arc4
nls_ucs2_utils
cifs_md4
dns_resolver
netfs
snd_seq_dummy
snd_hrtimer
snd_seq
snd_seq_device
ipmi_devintf
ipmi_msghandler
veth
snd_hda_codec_intelhdmi
snd_hda_codec_alc269
snd_hda_scodec_component
snd_hda_codec_realtek_lib
snd_hda_codec_generic
snd_hda_intel
snd_sof_pci_intel_tgl
overlay
snd_sof_pci_intel_cnl
snd_sof_intel_hda_generic
soundwire_intel
soundwire_generic_allocation
snd_sof_intel_hda_sdw_bpt
snd_sof_intel_hda_common
snd_soc_hdac_hda
snd_sof_intel_hda_mlink
snd_sof_intel_hda
snd_hda_codec_hdmi
soundwire_cadence
snd_sof_pci
snd_sof_xtensa_dsp
snd_sof
intel_uncore_frequency
intel_uncore_frequency_common
snd_sof_utils
snd_soc_acpi_intel_match
x86_pkg_temp_thermal
snd_soc_acpi_intel_sdca_quirks
intel_powerclamp
snd_soc_acpi
coretemp
crc8
soundwire_bus
kvm_intel
snd_soc_sdca
iwlmvm
snd_soc_avs
sunrpc
snd_soc_hda_codec
uvcvideo
kvm
binfmt_misc
snd_hda_ext_core
videobuf2_vmalloc
mac80211
uvc
snd_hda_codec
videobuf2_memops
btusb
videobuf2_v4l2
btrtl
snd_hda_core
irqbypass
dell_pc
videodev
nls_ascii
btintel
ghash_clmulni_intel
snd_ctl_led
platform_profile
aesni_intel
btbcm
nls_cp437
snd_intel_dspcfg
rapl
videobuf2_common
btmtk
dell_wmi
vfat
snd_intel_sdw_acpi
intel_cstate
snd_hwdep
fat
dell_rbtn
mei_wdt
mei_pxp
mei_hdcp
intel_rapl_msr
libarc4
bluetooth
dell_laptop
mc
dell_wmi_sysman
iwlwifi
snd_soc_core
intel_uncore
dell_smm_hwmon
dell_smbios
dell_wmi_ddv
pcspkr
snd_compress
dcdbas
firmware_attributes_class
processor_thermal_device_pci
snd_pcm_dmaengine
processor_thermal_device
dell_wmi_descriptor
wmi_bmof
snd_pcm
processor_thermal_wt_hint
ee1004
snd_timer
cfg80211
platform_temperature_control
mei_me
snd
processor_thermal_rfim
processor_thermal_rapl
mei
soundcore
intel_rapl_common
rfkill
processor_thermal_wt_req
processor_thermal_power_floor
processor_thermal_mbox
igen6_edac
int3403_thermal
int340x_thermal_zone
intel_pmc_core
pmt_telemetry
joydev
pmt_discovery
int3400_thermal
pmt_class
intel_hid
sparse_keymap
acpi_thermal_rel
acpi_pad
acpi_tad
intel_pmc_ssram_telemetry
ac
evdev
tls
msr
i2c_dev
parport_pc
ppdev
lp
parport
dm_mod
nvme_fabrics
efi_pstore
nfnetlink
autofs4
ext4
crc16
mbcache
jbd2
crc32c_cryptoapi
btrfs
raid10
raid456
async_raid6_recov
async_memcpy
async_pq
async_xor
async_tx
xor
raid6_pq
raid1
raid0
md_mod
xe
intel_vsec
drm_gpuvm
configfs
drm_gpusvm_helper
gpu_sched
drm_ttm_helper
drm_exec
drm_suballoc_helper
hid_sensor_custom
hid_sensor_hub
intel_ishtp_hid
i915
ucsi_acpi
typec_ucsi
typec
roles
nvme
nvme_core
nvme_keyring
nvme_auth
ahci
libahci
drm_buddy
libata
ttm
i2c_algo_bit
drm_display_helper
scsi_mod
hid_multitouch
cec
hid_generic
rc_core
scsi_common
drm_client_lib
i2c_hid_acpi
i2c_hid
sdhci_pci
drm_kms_helper
hid
xhci_pci
sdhci_uhs2
iTCO_wdt
xhci_hcd
intel_pmc_bxt
iTCO_vendor_support
sdhci
intel_ish_ipc
watchdog
drm
psmouse
thunderbolt
usbcore
video
cqhci
e1000e
i2c_i801
intel_lpss_pci
battery
mmc_core
intel_ishtp
intel_lpss
serio_raw
wmi
button
i2c_smbus
vmd
idma64
usb_common
efivarfs

** PCI devices:
0000:00:00.0 Host bridge [0600]: Intel Corporation Raptor Lake-P/U 2p+8e cores Host Bridge/DRAM Controller [8086:a708] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ >SERR- <PERR- INTx-
 Latency: 0
 IOMMU group: 1
 Capabilities: <access denied>
 Kernel driver in use: igen6_edac
 Kernel modules: igen6_edac

0000:00:02.0 VGA compatible controller [0300]: Intel Corporation Raptor Lake-P [UHD Graphics] [8086:a721] (rev 04) (prog-if 00 [VGA controller])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 193
 IOMMU group: 0
 Region 0: Memory at 6054000000 (64-bit, non-prefetchable) [size=16M]
 Region 2: Memory at 4000000000 (64-bit, prefetchable) [size=256M]
 Region 4: I/O ports at 3000 [size=64]
 Expansion ROM at 000c0000 [virtual] [disabled] [size=128K]
 Capabilities: <access denied>
 Kernel driver in use: i915
 Kernel modules: i915, xe

0000:00:04.0 Signal processing controller [1180]: Intel Corporation Raptor Lake Dynamic Platform and Thermal Framework Processor Participant [8086:a71d] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 16
 IOMMU group: 2
 Region 0: Memory at 6055240000 (64-bit, non-prefetchable) [size=128K]
 Capabilities: <access denied>
 Kernel driver in use: proc_thermal_pci
 Kernel modules: processor_thermal_device_pci

0000:00:06.0 System peripheral [0880]: Intel Corporation RST VMD Managed Controller [8086:09ab]
 Control: I/O- Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 IOMMU group: 3

0000:00:07.0 PCI bridge [0604]: Intel Corporation Raptor Lake-P Thunderbolt 4 PCI Express Root Port #0 [8086:a76e] (rev 01) (prog-if 00 [Normal decode])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 122
 IOMMU group: 4
 Bus: primary=00, secondary=01, subordinate=38, sec-latency=0
 I/O behind bridge: 4000-4fff [size=4K] [16-bit]
 Memory behind bridge: 8a000000-9fdfffff [size=350M] [32-bit]
 Prefetchable memory behind bridge: 6000000000-6021ffffff [size=544M] [32-bit]
 Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR-
 BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
  PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
 Capabilities: <access denied>
 Kernel driver in use: pcieport

0000:00:07.1 PCI bridge [0604]: Intel Corporation Device [8086:a73f] (rev 01) (prog-if 00 [Normal decode])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin B routed to IRQ 123
 IOMMU group: 5
 Bus: primary=00, secondary=39, subordinate=70, sec-latency=0
 I/O behind bridge: 5000-5fff [size=4K] [16-bit]
 Memory behind bridge: 74000000-89dfffff [size=350M] [32-bit]
 Prefetchable memory behind bridge: 6030000000-6051ffffff [size=544M] [32-bit]
 Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR-
 BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
  PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
 Capabilities: <access denied>
 Kernel driver in use: pcieport

0000:00:08.0 System peripheral [0880]: Intel Corporation GNA Scoring Accelerator module [8086:a74f] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Interrupt: pin A routed to IRQ 255
 IOMMU group: 6
 Region 0: Memory at 60552a2000 (64-bit, non-prefetchable) [disabled] [size=4K]
 Capabilities: <access denied>

0000:00:0d.0 USB controller [0c03]: Intel Corporation Raptor Lake-P Thunderbolt 4 USB Controller [8086:a71e] (rev 01) (prog-if 30 [XHCI])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0, Cache Line Size: 64 bytes
 Interrupt: pin ? routed to IRQ 161
 IOMMU group: 7
 Region 0: Memory at 6055280000 (64-bit, non-prefetchable) [size=64K]
 Capabilities: <access denied>
 Kernel driver in use: xhci_hcd
 Kernel modules: xhci_pci

0000:00:0d.2 USB controller [0c03]: Intel Corporation Raptor Lake-P Thunderbolt 4 NHI #0 [8086:a73e] (rev 01) (prog-if 40 [USB4 Host Interface])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 16
 IOMMU group: 7
 Region 0: Memory at 6055200000 (64-bit, non-prefetchable) [size=256K]
 Region 2: Memory at 60552a1000 (64-bit, non-prefetchable) [size=4K]
 Capabilities: <access denied>
 Kernel driver in use: thunderbolt
 Kernel modules: thunderbolt

0000:00:0e.0 RAID bus controller [0104]: Intel Corporation Volume Management Device NVMe RAID Controller Intel Corporation [8086:a77f]
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 IOMMU group: 8
 Region 0: Memory at 6052000000 (64-bit, non-prefetchable) [size=32M]
 Region 2: Memory at 72000000 (32-bit, non-prefetchable) [size=32M]
 Region 4: Memory at 6055100000 (64-bit, non-prefetchable) [size=1M]
 Capabilities: <access denied>
 Kernel driver in use: vmd
 Kernel modules: vmd, ahci

0000:00:12.0 Serial controller [0700]: Intel Corporation Alder Lake-P Integrated Sensor Hub [8086:51fc] (rev 01) (prog-if 00 [8250])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 26
 IOMMU group: 9
 Region 0: Memory at 6055270000 (64-bit, non-prefetchable) [size=64K]
 Capabilities: <access denied>
 Kernel driver in use: intel_ish_ipc
 Kernel modules: intel_ish_ipc

0000:00:14.0 USB controller [0c03]: Intel Corporation Alder Lake PCH USB 3.2 xHCI Host Controller [8086:51ed] (rev 01) (prog-if 30 [XHCI])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Interrupt: pin A routed to IRQ 169
 IOMMU group: 10
 Region 0: Memory at 6055260000 (64-bit, non-prefetchable) [size=64K]
 Capabilities: <access denied>
 Kernel driver in use: xhci_hcd
 Kernel modules: xhci_pci

0000:00:14.2 RAM memory [0500]: Intel Corporation Alder Lake PCH Shared SRAM [8086:51ef] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 IOMMU group: 10
 Region 0: Memory at 6055298000 (64-bit, non-prefetchable) [disabled] [size=16K]
 Region 2: Memory at 60552a0000 (64-bit, non-prefetchable) [disabled] [size=4K]
 Capabilities: <access denied>

0000:00:14.3 Network controller [0280]: Intel Corporation Raptor Lake PCH CNVi WiFi [8086:51f1] (rev 01)
 Subsystem: Intel Corporation Wi-Fi 6E AX211 160MHz [8086:4090]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 16
 IOMMU group: 11
 Region 0: Memory at 6055294000 (64-bit, non-prefetchable) [size=16K]
 Capabilities: <access denied>
 Kernel driver in use: iwlwifi
 Kernel modules: iwlwifi

0000:00:15.0 Serial bus controller [0c80]: Intel Corporation Alder Lake PCH Serial IO I2C Controller #0 [8086:51e8] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0, Cache Line Size: 64 bytes
 Interrupt: pin A routed to IRQ 27
 IOMMU group: 12
 Region 0: Memory at 4017000000 (64-bit, non-prefetchable) [size=4K]
 Capabilities: <access denied>
 Kernel driver in use: intel-lpss
 Kernel modules: intel_lpss_pci

0000:00:15.1 Serial bus controller [0c80]: Intel Corporation Alder Lake PCH Serial IO I2C Controller #1 [8086:51e9] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0, Cache Line Size: 64 bytes
 Interrupt: pin B routed to IRQ 40
 IOMMU group: 12
 Region 0: Memory at 4017001000 (64-bit, non-prefetchable) [size=4K]
 Capabilities: <access denied>
 Kernel driver in use: intel-lpss
 Kernel modules: intel_lpss_pci

0000:00:16.0 Communication controller [0780]: Intel Corporation Alder Lake PCH HECI Controller [8086:51e0] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 194
 IOMMU group: 13
 Region 0: Memory at 605529d000 (64-bit, non-prefetchable) [size=4K]
 Capabilities: <access denied>
 Kernel driver in use: mei_me
 Kernel modules: mei_me

0000:00:16.3 Serial controller [0700]: Intel Corporation Alder Lake AMT SOL Redirection [8086:51e3] (rev 01) (prog-if 02 [16550])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Interrupt: pin D routed to IRQ 19
 IOMMU group: 13
 Region 0: I/O ports at 3060 [size=8]
 Region 1: Memory at 9ff21000 (32-bit, non-prefetchable) [size=4K]
 Capabilities: <access denied>
 Kernel driver in use: serial

0000:00:1d.0 PCI bridge [0604]: Intel Corporation Alder Lake PCI Express x1 Root Port #10 [8086:51b1] (rev 01) (prog-if 00 [Normal decode])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin B routed to IRQ 124
 IOMMU group: 14
 Bus: primary=00, secondary=71, subordinate=71, sec-latency=0
 I/O behind bridge: [disabled] [16-bit]
 Memory behind bridge: 9fe00000-9fefffff [size=1M] [32-bit]
 Prefetchable memory behind bridge: [disabled] [64-bit]
 Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR-
 BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
  PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
 Capabilities: <access denied>
 Kernel driver in use: pcieport

0000:00:1f.0 ISA bridge [0601]: Intel Corporation Raptor Lake LPC/eSPI Controller [8086:519d] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 IOMMU group: 15

0000:00:1f.3 Audio device [0403]: Intel Corporation Raptor Lake-P/U/H cAVS [8086:51ca] (rev 01) (prog-if 80)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 64
 Interrupt: pin A routed to IRQ 209
 IOMMU group: 15
 Region 0: Memory at 6055290000 (64-bit, non-prefetchable) [size=16K]
 Region 4: Memory at 6055000000 (64-bit, non-prefetchable) [size=1M]
 Capabilities: <access denied>
 Kernel driver in use: snd_hda_intel
 Kernel modules: snd_soc_avs, snd_sof_pci_intel_tgl, snd_hda_intel

0000:00:1f.4 SMBus [0c05]: Intel Corporation Alder Lake PCH-P SMBus Host Controller [8086:51a3] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
 Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Interrupt: pin A routed to IRQ 16
 IOMMU group: 15
 Region 0: Memory at 605529c000 (64-bit, non-prefetchable) [size=256]
 Region 4: I/O ports at efa0 [size=32]
 Kernel driver in use: i801_smbus
 Kernel modules: i2c_i801

0000:00:1f.5 Serial bus controller [0c80]: Intel Corporation Alder Lake-P PCH SPI Controller [8086:51a4] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 IOMMU group: 15
 Region 0: Memory at 70800000 (32-bit, non-prefetchable) [size=4K]

0000:00:1f.6 Ethernet controller [0200]: Intel Corporation Ethernet Connection (23) I219-LM [8086:0dc5] (rev 01)
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 144
 IOMMU group: 15
 Region 0: Memory at 9ff00000 (32-bit, non-prefetchable) [size=128K]
 Capabilities: <access denied>
 Kernel driver in use: e1000e
 Kernel modules: e1000e

0000:71:00.0 SD Host controller [0805]: Genesys Logic, Inc GL9755 SD Host Controller [17a0:9755] (rev 01) (prog-if 01)
 Subsystem: Genesys Logic, Inc GL9755 SD Host Controller [17a0:9755]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 178
 IOMMU group: 16
 Region 0: Memory at 9fe00000 (32-bit, non-prefetchable) [size=4K]
 Capabilities: <access denied>
 Kernel driver in use: sdhci-pci
 Kernel modules: sdhci_pci

10000:e0:06.0 PCI bridge [0604]: Intel Corporation Raptor Lake PCIe 4.0 Graphics Port [8086:a74d] (rev 01) (prog-if 00 [Normal decode])
 Subsystem: Dell Device [1028:0c05]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin D routed to IRQ 179
 IOMMU group: 8
 Bus: primary=00, secondary=e1, subordinate=e1, sec-latency=0
 I/O behind bridge: [disabled] [16-bit]
 Memory behind bridge: 72000000-720fffff [size=1M] [32-bit]
 Prefetchable memory behind bridge: [disabled] [64-bit]
 Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR-
 BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
  PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
 Capabilities: <access denied>
 Kernel driver in use: pcieport

10000:e1:00.0 Non-Volatile memory controller [0108]: KIOXIA Corporation NVMe SSD Controller BG5 (DRAM-less) [1e0f:000c] (prog-if 02 [NVM Express])
 Subsystem: KIOXIA Corporation Device [1e0f:0001]
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
 Latency: 0
 Interrupt: pin A routed to IRQ 0
 IOMMU group: 8
 Region 0: Memory at 72000000 (64-bit, non-prefetchable) [size=16K]
 Capabilities: <access denied>
 Kernel driver in use: nvme
 Kernel modules: nvme


** USB devices:
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 003 Device 002: ID 1bcf:28d2 Sunplus Innovation Technology Inc. Integrated_Webcam_FHD
Bus 003 Device 003: ID 0a5c:5843 Broadcom Corp. BCM58200 ControlVault 3 (FingerPrint sensor + Contacted SmartCard)
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub


-- System Information:
Debian Release: forky/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.17.2-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages linux-image-6.17.2-amd64 depends on:
ii  initramfs-tools [linux-initramfs-tool]  0.150
ii  kmod                                    34.2-2
ii  linux-base                              4.14

Versions of packages linux-image-6.17.2-amd64 recommends:
pn  apparmor  <none>

Versions of packages linux-image-6.17.2-amd64 suggests:
pn  debian-kernel-handbook  <none>
ii  extlinux                3:6.04~git20190206.bf6db5b4+dfsg1-3.2
ii  firmware-linux-free     20241210-2
ii  grub-efi-amd64          2.12-9
pn  linux-doc-6.17          <none>

Versions of packages linux-image-6.17.2-amd64 is related to:
pn  firmware-amd-graphics      <none>
pn  firmware-atheros           <none>
pn  firmware-bnx2              <none>
pn  firmware-bnx2x             <none>
pn  firmware-brcm80211         <none>
pn  firmware-cavium            <none>
pn  firmware-cirrus            <none>
ii  firmware-intel-graphics    20250917-1
ii  firmware-intel-misc        20250917-1
pn  firmware-intel-sound       <none>
pn  firmware-ipw2x00           <none>
pn  firmware-ivtv              <none>
ii  firmware-iwlwifi           20250917-1
pn  firmware-libertas          <none>
pn  firmware-marvell-prestera  <none>
ii  firmware-mediatek          20250917-1
ii  firmware-misc-nonfree      20250917-1
pn  firmware-myricom           <none>
pn  firmware-netronome         <none>
pn  firmware-netxen            <none>
ii  firmware-nvidia-graphics   20250917-1
pn  firmware-qcom-soc          <none>
pn  firmware-qlogic            <none>
ii  firmware-realtek           20250917-1
pn  firmware-samsung           <none>
pn  firmware-siano             <none>
pn  firmware-ti-connectivity   <none>
pn  xen-hypervisor             <none>

-- no debconf information

Attachment: Screenshot From 2025-10-19 23-17-49.png
Description: PNG image

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <pthread.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <poll.h>
#include <linux/if_link.h>
#include <xdp/xsk.h>

////// gcc xskInt.c -lxdp
////// sudo ip link add veth1 type veth
////// sudo ip link set veth0 up
////// sudo ip link set veth1 up
////// sudo ./a.out

void err(char*buf) {
    printf("%s\n", buf);
    _exit(1);
}




int main(int argc, char **argv) {

    int bpf_flag = XDP_FLAGS_SKB_MODE;

    char ifaceName[] = "veth0";
    printf("opening interface %s\n", ifaceName);

#define framesNum 1024

struct xsk_umem *ifaceUmem;
struct xsk_socket *ifaceXsk;
struct xsk_ring_prod ifaceFq;
struct xsk_ring_cons ifaceCq;
struct xsk_ring_cons ifaceRx;
struct xsk_ring_prod ifaceTx;
char *ifaceBuf;
struct pollfd ifacePfd;

    posix_memalign((void**)&ifaceBuf, getpagesize(), XSK_UMEM__DEFAULT_FRAME_SIZE * 2 * framesNum);
    if (ifaceBuf == NULL) err("error allocating buffer");

    if (xsk_umem__create(&ifaceUmem, ifaceBuf, XSK_UMEM__DEFAULT_FRAME_SIZE * 2 * framesNum, &ifaceFq, &ifaceCq, NULL) != 0) err("error creating umem");

    struct xsk_socket_config cfg;
    memset(&cfg, 0, sizeof(cfg));
    cfg.rx_size = XSK_RING_CONS__DEFAULT_NUM_DESCS;
    cfg.tx_size = XSK_RING_PROD__DEFAULT_NUM_DESCS;
    cfg.xdp_flags = bpf_flag;
    if (xsk_socket__create(&ifaceXsk, ifaceName, 0, ifaceUmem, &ifaceRx, &ifaceTx, &cfg) != 0) err("error creating xsk");

    unsigned int i = 0;
    xsk_ring_prod__reserve(&ifaceFq, framesNum, &i);
    for (i=0; i < framesNum; i++) *xsk_ring_prod__fill_addr(&ifaceFq, i) = i * XSK_UMEM__DEFAULT_FRAME_SIZE;
    xsk_ring_prod__submit(&ifaceFq, framesNum);

    memset(&ifacePfd, 0, sizeof (ifacePfd));
    ifacePfd.fd = xsk_socket__fd(ifaceXsk);
    ifacePfd.events = POLLIN | POLLERR;

    setgid(1);
    setuid(1);
    printf("serving others\n");


unsigned char bufD[] = {0x3a, 0x10, 0x5c, 0x53, 0xb3, 0x5c, 0x0, 0x1e, 0x11, 0x4c, 0x7e, 0x66, 0x8, 0x0, 0x45, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0xff, 0x1, 0xb7, 0xa0, 0x1, 0x1, 0x1, 0xd, 0x1, 0x1, 0x1, 0xe, 0x8, 0x0, 0xa5, 0xfd, 0x16, 0x3b, 0x3b, 0xc7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
int bufS = sizeof(bufD);

        unsigned int idx;
        idx = xsk_ring_cons__peek(&ifaceCq, 16, &idx);
        xsk_ring_cons__release(&ifaceCq, idx);
        if (xsk_ring_prod__reserve(&ifaceTx, 1, &idx) < 1) err("error getting index");
        struct xdp_desc *dsc = xsk_ring_prod__tx_desc(&ifaceTx, idx);
        dsc->addr = (framesNum + (idx % framesNum)) * XSK_UMEM__DEFAULT_FRAME_SIZE;
        dsc->options = 0;
        dsc->len = bufS;
        memcpy(ifaceBuf + dsc->addr, bufD, bufS);
        xsk_ring_prod__submit(&ifaceTx, 1);
        if (!xsk_ring_prod__needs_wakeup(&ifaceTx)) err("error waking up");
        sendto(xsk_socket__fd(ifaceXsk), NULL, 0, MSG_DONTWAIT, NULL, 0);

    sleep(10);
}

--- End Message ---

--- Begin Message ---

To: 1118437-close@bugs.debian.org
Subject: Bug#1118437: fixed in linux 6.18.1-1~exp1
From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
Date: Mon, 15 Dec 2025 20:10:12 +0000
Message-id: <E1vVEtY-00GipX-2M@fasolo.debian.org>
Reply-to: Bastian Blank <waldi@debian.org>

Source: linux
Source-Version: 6.18.1-1~exp1
Done: Bastian Blank <waldi@debian.org>

We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1118437@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastian Blank <waldi@debian.org> (supplier of updated linux package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 15 Dec 2025 16:03:51 +0100
Source: linux
Architecture: source
Version: 6.18.1-1~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Bastian Blank <waldi@debian.org>
Closes: 1106411 1114868 1117959 1118437 1121937 1122144 1122853
Changes:
 linux (6.18.1-1~exp1) experimental; urgency=medium
 .
   * New upstream release: https://kernelnewbies.org/Linux_6.18
     - xsk: avoid data corruption on cq descriptor number (Closes: #1118437)
     - iio: accel: bmc150: Fix irq assumption regression (Closes: #1106411)
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.1
 .
   [ Ben Hutchings ]
   * Add 'c_' prefix to compiler configuration field and variables
   * module: Disable MODVERSIONS, MODULE_ALLOW_BTF_MISMATCH
   * d/l/p/debian_linux/debian.py: Allow adding restrictions to
     PackageRelationGroup
   * Implement configuration for Rust compiler and other build-dependencies
   * d/rules.real: Set KRUSTFLAGS and HOSTRUSTFLAGS to make filenames relative
   * [amd64,arm64,armhf,loong64,riscv64] Enable building Rust drivers and
     features:
     - Enable RUST, RUST_OVERFLOW_CHECKS
     - Build-Depend on bindgen, rustc, and rust-src
     - firmware: Enable RUST_FW_LOADER_ABSTRACTIONS
     - net/phy: Enable drivers written in Rust:
       + Change PHYLIB from module to built-in
       + Enable RUST_PHYLIB_ABSTRACTIONS
       + Eable AMCC_QT2025_PHY as module, and AX88796B_RUST_PHY
     - drm: Enable panic QR codes:
       + Enable DRM_PANIC and DRM_PANIC_SCREEN_QR_CODE (Closes: #1121937)
       + Set DRM_PANIC_SCREEN="qr_code"
       + Point DRM_PANIC_SCREEN_QR_CODE_URL at a Debian-hosted decoder
 .
   [ Bastian Blank ]
   * Install vdso files if available.
   * Move dtb into modules directory.
   * Convert doc to symlink in linux-libc-dev-*-cross.
   * Split modules out of kernel-image udeb.
 .
   [ Salvatore Bonaccorso ]
   * [amd64] drivers/accel/amdxdna: Enable DRM_ACCEL_AMDXDNA as module
     (Closes: #1114868)
   * ipv6: clear RA flags when adding a static route (Closes: #1117959)
   * d/b/stable-update: Use linux_version_full to get current full version
   * [amd64] drivers/spi: Enable SPI_AMD as module (Closes: #1122853)
 .
   [ Maxwell Pevner ]
   * drivers/hid: Enable HID_UNIVERSAL_PIDFF as module (Closes: #1122144)
 .
   [ Shawn Guo ]
   * [arm64] Enable BATTERY_LENOVO_YOGA_C630 as module
Checksums-Sha1:
 3bebab0d400c0f99276605efded0b70e422475c0 131952 linux_6.18.1-1~exp1.dsc
 bb20df8bbe74a4c2e83243392c8cced509797c69 157358648 linux_6.18.1.orig.tar.xz
 bfddbb330f64314202f27149a7d3bcc24fc2eef6 1443988 linux_6.18.1-1~exp1.debian.tar.xz
 ab62f883bf2babf82f1cc125bf7fcc80445b3250 6930 linux_6.18.1-1~exp1_source.buildinfo
Checksums-Sha256:
 1da788a2512f36bfd67830d7f1753984db44ec9bb616c18d279302427cc85c40 131952 linux_6.18.1-1~exp1.dsc
 b18c21c3f20dc4b3d235cdee4e47baed8a1c34514aca24a42a0b7134105b96b1 157358648 linux_6.18.1.orig.tar.xz
 821dcc2876bb7475286297cfcb060e284cce3f72b9bef0a3b48250f2b1465192 1443988 linux_6.18.1-1~exp1.debian.tar.xz
 1e0ea26503f8ec3ba9b05c8a4bccf5ea15cffe569426976e4803e59482754fa1 6930 linux_6.18.1-1~exp1_source.buildinfo
Files:
 0838928215fcea7b92e184b80f96cd3c 131952 kernel optional linux_6.18.1-1~exp1.dsc
 ec75b7f0eca6ff21e3959c12452b29f8 157358648 kernel optional linux_6.18.1.orig.tar.xz
 b0f1e6e1ba3e64857bc8eefb6a14bc14 1443988 kernel optional linux_6.18.1-1~exp1.debian.tar.xz
 c8e83ee9a39cca43f389485b90777bcc 6930 kernel optional linux_6.18.1-1~exp1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQ8pEKDNIgQDAQDOBFji0aBW7swjwUCaUAj4gAKCRBji0aBW7sw
j7o1AQCZ9MMog1TZHIrQBgZxrjpzNqI9rl2hFp0U/UVyLQt2OQEAzD8Axgg3nmR4
0oqpktTH8bbW6kdIhTxvbiZ09Hww1AM=
=S0+a
-----END PGP SIGNATURE-----

Attachment: pgpQ4N0keDhPo.pgp
Description: PGP signature

--- End Message ---

Reply to:

Prev by Date: Bug#1122853: marked as done (Sound card not detected in steamdeck)
Next by Date: Bug#1122144: marked as done (linux-image-amd64: CONFIG_HID_UNIVERSAL_PIDFF is not set)
Previous by thread: Bug#1118437: marked as done (kernel crash in interrupt after receiving an ip packet on veth from xsk from user space (CVE-2025-40290))
Next by thread: Bug#1112643: marked as done (linux-image-6.12.41+deb13-amd64: Older Acer Notebooks do not wake up from suspend afer upgrade to Trixie or new install of Trixie)
Index(es):
- Date
- Thread