Naresh Kamboju

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to the fixed version **Description** A vulnerability in the Linux kernel has been resolved. The issue is related to the stack layout for constructing arguments for the `ftrace return to handler` function in the `return to handler` function, which does not match the ` arch ftrace regs` structure of riscv, leading to unexpected results. This can cause a "Bad frame pointer" kernel warning. The vulnerability can be reproduced with a specific command sequence involving dynamic events and tracing. **Recommendations** To resolve the issue, update to a version of the Linux kernel where the stack layout for constructing arguments for the `ftrace return to handler` function has been fixed to match the ` arch ftrace regs` structure of riscv. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability in the Linux kernel has been resolved, related to the `dst entries add()` function using per-cpu data that might be freed at netns dismantle from `ip6 route net exit()` calling `dst entries destroy()`. This can cause a race condition, as `dst entries destroy()` could have been called already. The issue is also related to the `dst release()` function, which waits an rcu grace period before calling `dst destroy()`. Additionally, in the `CONFIG XFRM` case, `dst destroy()` can call `dst release immediate(child)`, potentially causing a use-after-free (UAF) issue if the child does not have `DST NOCOUNT` set. Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider disabling the `dst entries add()` function until a patch is available. Restrict access to the `dst release()` function to minimize the risk of exploitation. Avoid using the `dst entries destroy()` function in conjunction with `dst release()` until the issue is resolved. At the moment, there is no other information about additional mitigation measures.