APPLIED: [SRU][J][PATCH 0/1] CVE-2022-1205

[Stefan Bader]

On 18/09/2026 19:05, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2022-1205
> 
> [ Impact ]
> 
> A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio
> AX.25 protocol functionality in the way a user connects with the protocol. This
> flaw allows a local user to crash the system.
> 
> [ Fix ]
> 
> jammy/linux: backported from 7d8a3a477b3e
> 
> The fix reworks AX.25 session cleanup in ax25_release() and ax25_disconnect().
> It adds a device_up flag to ax25_dev so that del_timer_sync() is not called in
> ax25_release() while sessions still need the timers to complete cleanup, deletes
> the ax25_cb in ax25_kill_by_device() now that the timers may be stopped, reorders
> the ax25_list_lock in ax25_cb_del() for synchronization, corrects the socket
> check in ax25_disconnect() so incoming sessions with a NULL sk are cleaned up
> properly, and avoids calling ax25_disconnect() twice by skipping it in
> ax25_release() when the socket is already SOCK_DEAD.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A bad fix would affect systems that actually use the AX.25 amateur radio
> protocol stack, such as amateur radio operators running packet radio over KISS
> TNCs or similar AX.25 network devices; regressions could show up as stuck
> sessions, incorrect socket states, or use-after-free issues around session
> timers. Systems that do not load or use the AX.25 protocol are not affected.
> 
> [ Other Info ]
> 
> Kybele flow-v12-14-g7bcc3c7e. Reference: 0939f898/v1
> 

Applied to jammy:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260922/1bf87312/attachment.sig>