Description
In the Linux kernel, the following vulnerability has been resolved:
clk: zynqmp: Fix stack-out-of-bounds in strncpy`
"BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68"
Linux-ATF interface is using 16 bytes of SMC payload. In case clock name is
longer than 15 bytes, string terminated NULL character will not be received
by Linux. Add explicit NULL character at last byte to fix issues when clock
name is longer.
This fixes below bug reported by KASAN:
==================================================================
BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68
Read of size 1 at addr ffff0008c89a7410 by task swapper/0/1
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.4.0-00396-g81ef9e7-dirty #3
Hardware name: Xilinx Versal vck190 Eval board revA (QSPI) (DT)
Call trace:
dump_backtrace+0x0/0x1e8
show_stack+0x14/0x20
dump_stack+0xd4/0x108
print_address_description.isra.0+0xbc/0x37c
__kasan_report+0x144/0x198
kasan_report+0xc/0x18
__asan_load1+0x5c/0x68
strncpy+0x30/0x68
zynqmp_clock_probe+0x238/0x7b8
platform_drv_probe+0x6c/0xc8
really_probe+0x14c/0x418
driver_probe_device+0x74/0x130
__device_attach_driver+0xc4/0xe8
bus_for_each_drv+0xec/0x150
__device_attach+0x160/0x1d8
device_initial_probe+0x10/0x18
bus_probe_device+0xe0/0xf0
device_add+0x528/0x950
of_device_add+0x5c/0x80
of_platform_device_create_pdata+0x120/0x168
of_platform_bus_create+0x244/0x4e0
of_platform_populate+0x50/0xe8
zynqmp_firmware_probe+0x370/0x3a8
platform_drv_probe+0x6c/0xc8
really_probe+0x14c/0x418
driver_probe_device+0x74/0x130
device_driver_attach+0x94/0xa0
__driver_attach+0x70/0x108
bus_for_each_dev+0xe4/0x158
driver_attach+0x30/0x40
bus_add_driver+0x21c/0x2b8
driver_register+0xbc/0x1d0
__platform_driver_register+0x7c/0x88
zynqmp_firmware_driver_init+0x1c/0x24
do_one_initcall+0xa4/0x234
kernel_init_freeable+0x1b0/0x24c
kernel_init+0x10/0x110
ret_from_fork+0x10/0x18
The buggy address belongs to the page:
page:ffff0008f9be1c88 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
raw: 0008d00000000000 ffff0008f9be1c90 ffff0008f9be1c90 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff
page dumped because: kasan: bad access detected
addr ffff0008c89a7410 is located in stack of task swapper/0/1 at offset 112 in frame:
zynqmp_clock_probe+0x0/0x7b8
this frame has 3 objects:
[32, 44) 'response'
[64, 80) 'ret_payload'
[96, 112) 'name'
Memory state around the buggy address:
ffff0008c89a7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0008c89a7380: 00 00 00 00 f1 f1 f1 f1 00 04 f2 f2 00 00 f2 f2
>ffff0008c89a7400: 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff0008c89a7480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0008c89a7500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.2 | 5.4.220 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.0.3-1 | — |
| Debian 13 | linux | 6.0.3-1 | — |
| Debian 12 | linux | 6.0.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1014.16 | — |
| Ubuntu 24.04 LTS | linux-riscv +10 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-60.66 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1030.34 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1033.40 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1033.40.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1029.36 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1027.32 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1015.19 | — |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1025.28 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1025.30 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1028.33 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1017.17 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1029.35 | — |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1024.26 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-139.156 | — |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1096.104 | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1030.34~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1103.109 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1033.40~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1058.64 | — |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1100.109 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1029.36~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-60.66~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1044.49 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1025.30~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1012.14 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1086.92 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1093.102 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1029.35~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1080.91 | — |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1029.33~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1021.25 | — |
| Ubuntu 18.04 LTS | linux-aws-5.4 | 5.4.0-1096.104~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1103.109~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp-5.4 | 5.4.0-1100.109~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-139.156~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-ibm-5.4 | 5.4.0-1044.49~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1093.102~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1080.91~18.04.1 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1096.104+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1103.109+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1072.81 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1100.109+fips1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.133.1 | SUSE-SU-2026:0317-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.133.1.150500.6.65.1 | SUSE-SU-2026:0317-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.194.1 | SUSE-SU-2026:0617-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.194.1.150400.24.98.3 | SUSE-SU-2026:0617-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.133.1.150500.6.65.1 | SUSE-SU-2026:0317-1 |
| SLES for SAP 15 SP5 | kernel-docs +4 | 5.14.21-150500.55.133.1 | SUSE-SU-2026:0317-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.194.1.150400.24.98.3 | SUSE-SU-2026:0617-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.194.1 | SUSE-SU-2026:0617-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.133.1.150500.6.65.1 | SUSE-SU-2026:0317-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.118.1 | SUSE-SU-2026:0263-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.133.1 | SUSE-SU-2026:0317-1 |
| SLE Micro 5.4 | kernel-default | 5.14.21-150400.24.194.1 | SUSE-SU-2026:0617-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.194.1.150400.24.98.3 | SUSE-SU-2026:0617-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.142.1 | SUSE-SU-2026:0411-1 |
| SLE Micro 5.3 | kernel-default | 5.14.21-150400.24.194.1 | SUSE-SU-2026:0617-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.194.1.150400.24.98.3 | SUSE-SU-2026:0617-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.142.1 | SUSE-SU-2026:0411-1 |
| SLE Micro 5.2 | kernel-default | 5.3.18-150300.59.232.1 | SUSE-SU-2026:0369-1 |
| SLE Micro 5.2 | kernel-default-base | 5.3.18-150300.59.232.1.150300.18.138.1 | SUSE-SU-2026:0369-1 |
| SLE Micro 5.2 | kernel-rt +1 | 5.3.18-150300.232.1 | SUSE-SU-2026:0350-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.133.1 | SUSE-SU-2026:0317-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_34 | 1-150500.11.3.1 | SUSE-SU-2026:0317-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.194.1 | SUSE-SU-2026:0617-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_48 | 1-150400.9.7.1 | SUSE-SU-2026:0617-1 |
| SLE HPC 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.133.1 | SUSE-SU-2026:0317-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.133.1.150500.6.65.1 | SUSE-SU-2026:0317-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.194.1 | SUSE-SU-2026:0617-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.194.1.150400.24.98.3 | SUSE-SU-2026:0617-1 |
Advisories 6
- SUSE-SU-2026:0369-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0350-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0317-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0617-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 26, 2026
- SUSE-SU-2026:0411-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 10, 2026
- SUSE-SU-2026:0263-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://git.kernel.org/stable/c/5dbfcf7b080306b65d9f756fadf46c9495793750
- https://git.kernel.org/stable/c/d9e2585c3bcecb1c83febad31b9f450e93d2509e
- https://git.kernel.org/stable/c/0a07b13af04d0db7325018aaa83b5ffe864790c9
- https://git.kernel.org/stable/c/d66fea97671fcb516bd6d34bcc033f650ac7ee91
- https://git.kernel.org/stable/c/bce41e4ac6f5ca3b22a07e8cdadc12044bbf9d3b
- https://git.kernel.org/stable/c/dd80fb2dbf1cd8751efbe4e53e54056f56a9b115