[Lt_Riza_Hawkeye]

The problem here was Debian's distribution process. Any distro compiling linux from the releases on kernel.org was not affected.

[peppermint_gum]

This is not accurate. As you can see in the changelogs, the problematic commit made it to 6.1.64 and the fix was merged in 6.1.66:

"properly sync file size update after O_SYNC direct IO": https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.6...

"update ki_pos a little later in iomap_dio_complete": https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.6...

This post explains the relationship between the two commits: https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuh...

[burtness]

This is a misreading of the bug. It is from upstream stable kernels before 6.5 that include commit 91562895f803 but not 936e114a245b6[1].

In this case Debian's current process is good - it's kernels track kernel.org stable releases. This debian bug is responsibly flagging "for visibility" that a serious bug has been discussed and fixed upstream.

[1] https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuh...

[csdvrx]

Do you have a link to just the 2 patches (in patch form) that could be before on a kernel tarball to revert these 2 changes?

[uselpa]

Are you sure about that (genuine question)? The linked discussion involves a Suse engineer and a request to the kernel maintainer directly, not to a Debian packager-

[burtness]

No, its an upstream bug being discussed in the debian bug tracker

[Roark66]

What if you build your own kernel from kernel.org, but you use Debian tools to make dpkgs? (and you use old config)?

[Blikkentrekker]

So this is another bug introduced by Debian itself by patching things?

I remember that there was a fairly severe one which was caused by patching OpenSSL I think? But I remember the change they made being fairly weird and no one understood why but it was easy to see that it would introduce a vulnerability.

[mordae]

No, the issue was caused by backporting a patch A but not backporting a patch B. Sadly in this case the overall behavior after applying just A was broken when issuing direct IO writes.

[keep_reading]

I remember when they made 2 CVEs back to back in Apache by incorrect back porting of changes

[remram]

No, it exists in the upstream release.