CentOS Stream 9: missing kernel security fixes Someone reminded me last week that lots of enterprise Linux kernels are not based on upstream stable trees. The most notable enterprise Linux distro I'm aware of is RHEL (Red Hat Enterprise Linux), so I decided to take a look at the kernel tree of CentOS Stream 9 - according to CentOS Stream is the closest freely available thing to RHEL. The CentOS Stream 9 kernel () is based on the original upstream 5.14 release, so I decided to look through for interesting commits in the linux-5.15.y stable tree and check whether the same commits exist in the CentOS kernel tree. One interesting candidate I found is 390031c94211 (\"coredump: Use the vma snapshot in fill_files_note\") which fixes a locking bug that can lead to out-of-bounds writes, but from what I can tell actually exploiting this would be a big pain because unless you manage to race with the vulnerable code twice, a memory write will happen approximately 4GiB out of bounds. ebda44da44f6 (\"net: sched: fix race condition in qdisc_graft()\") also looked maybe interesting. 9a2544037600 (\"ovl: fix use after free in struct ovl_aio_req\") looks like a moderately nice bug, but I think it might only be hittable on CentOS if an ext4 filesystem is mounted, although https://access.redhat.com/articles/rhel-limits seems to imply that ext4 is a supported filesystem on RHEL. I am reporting this bug under our usual 90-day deadline this time because our policy currently doesn't have anything stricter for cases where security fixes aren't backported; we might change our treatment of this type of issue in the future. It would be good if upstream Linux and distributions like you could figure out some kind of solution to keep your security fixes in sync, so that an attacker who wants to quickly find a nice memory corruption bug in CentOS/RHEL can't just find such bugs in the delta between upstream stable and your kernel. (I realize there's probably a lot of history here.) This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 30 days after the fix was made available. Otherwise, this bug report will become public at the deadline. The scheduled deadline is 2023-03-19. Related CVE Numbers: CVE-2023-1249,CVE-2023-0590,CVE-2023-1252. Found by: jannh@google.com