Aurelien Jarno

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.65 **Description** The issue is related to a commit in the Linux kernel that increased the max req size, even for 4K pages, causing various problems. These issues include panic booting the kernel/rootfs from an SD card on Rockchip RK3566 and StarFive JH7100, as well as "swiotlb buffer is full" and data corruption on StarFive JH7110. The commit in question is 8396c793ffdf, which attempted to fix IDMAC operation with pages bigger than 4K but introduced these new issues. At this stage, no fix has been found, so the change has been reverted. **Recommendations** For Linux kernel versions prior to 6.6.65, update to version 6.6.65 or later to resolve the issue. As a temporary workaround, consider reverting the commit 8396c793ffdf to prevent the issues caused by the increased max req size. Restrict access to SD cards on affected devices, such as Rockchip RK3566 and StarFive JH7100, to minimize the risk of panic booting or data corruption. Avoid using the `mmc: dw mmc` module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** GNU C Library versions 2.19 through 2.26 **Description** The issue is related to the `fillin rpath` and `decompose rpath` functions in the GNU C Library, which mishandle RPATH and RUNPATH containing `$ORIGIN` for privileged programs. This allows a local user to gain privileges via a Trojan horse library in the current working directory. The problem is associated with the misinterpretation of an empty RPATH/RUNPATH token as the "./" directory. It is noted that this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon. **Recommendations** For GNU C Library versions 2.19 through 2.26, consider restricting the use of the `fillin rpath` and `decompose rpath` functions until a patch is available. As a temporary workaround, avoid using RPATH and RUNPATH containing `$ORIGIN` for privileged programs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.