Source status: Each selected upstream commit directly credits Sashiko or Sashiko AI as reporter and describes a concrete security consequence. No CVEs were assigned at the audit cutoff.
Summary
The selected accepted fixes include:
- an hwmon report-length bug that could expose uninitialized bytes through sysfs;
- a kprobes/module-unload use-after-free;
- userspace-controlled LoongArch KVM MSI data capable of out-of-bounds kernel reads and writes;
- paired kernel and userspace bootconfig integer-overflow fixes for crafted initrds;
- missing VMCI packet-source validation;
- four tracing lifetime bugs with use-after-free or KASAN failure paths; and
- a tracing cleanup bound error that can produce an out-of-bounds access and fatal fault. The affected path has been unreachable in mainline since Linux 6.3; the accepted patch is preventive hardening before another planned change makes it reachable again.
These are accepted public patches without CVE assignments, so the group counts as one finding page and adds zero to the unique-CVE total.
Selection boundary
The same upstream search produced dozens of additional Sashiko-reported correctness fixes. They are excluded unless the commit itself documents a security-relevant impact. Some selected commits mention Codex or Gemini-based assistants in implementation trailers; the cluster credits only Sashiko as the reporting review system and preserves those narrower roles in the upstream record.
References
- Linux: validate hwmon HID report lengths
- Linux: protect kprobe blacklist with RCU
- Linux: validate LoongArch KVM MSI data
- Linux: reject bootconfig size overflow
- Linux tools: harden bootconfig size arithmetic
- Linux: validate vsock VMCI packet source
- Linux: reference named histogram before publish
- Linux: hold trace-array reference for options files
- Linux: hold trace-array reference for tracer options
- Linux: unwind tracing registration safely
- Linux: bound tracing entry-count cleanup
Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.