firefox153: update to 153.5.1
Mozilla Foundation Security Advisory 2026-112
Security Vulnerabilities fixed in Firefox ESR 153.5.1
Announced
October 20, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 153.5.1
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
[11 lines not shown]
[LoongArch] Add shuffle and vector element cost hooks (#233033)
The default BasicTTI costs a broadcast of <2 x double> as 3 and a
single-source permutation of 32/64-bit elements as up to 4, although
LSX/LASX need one [x]vreplvei/[x]vreplgr2vr/xvreplve0 or vshuf4i
instruction. Extracting element 0 of an FP vector is free since it is
the aliased FPR.
These overestimates made the SLP vectorizer reject the {x, y} lanes of
the rustc-perf nbody force loop, which needs two scalar splats per
iteration. With them the loop splits its divisions between the vector
and scalar dividers: 21.5 -> 16.0 cycles per pair on LA664.
rustc-perf nbody on LA664: instructions -11.1%, cycles -13.5%.
[asan][Darwin] Build the DriverKit C++ slice without exceptions
dc53f17c ("[asan] Adopt sanitizer_common operator-new framework") made
all Darwin dargets compile asan_new_delete.cpp with exception support.
Some Darwin targets (i.e. DriverKit) do not support exceptions, so we
need to compile for those OSes without exception support.
DriverKit is not fully supported upstream yet, so the buildbots didn't
catch this.
Assisted-By: Claude
rdar://190438043
Count a retained runtime condition in the strict-subset check
The unguarded candidate of a match_any WHEN clause keeps its condition
key but not the condition trait, so it had one trait fewer than an
identical guarded candidate and counted as its strict subset. A key
without a trait now counts as a trait. A WHEN clause with an omitted
directive is ranked without its condition, so it no longer gets a key.
Fold logical user conditions of any kind
EvaluateUserCondition only folded default-kind logicals, so a condition
like .false._8 stayed a runtime check. getConditionKey folded it on its
own and gave it the empty key of a constant, so the WHEN clause was
ranked like a true constant although it can never apply.
EvaluateUserCondition now folds logical constants of any kind, and
getConditionKey only sees runtime conditions.
[mlir][SPIR-V] Serialize decorations on FunctionCall results (#233917)
Decorations such as RelaxedPrecision on an OpFunctionCall result were
dropped in both directions (serialize/deserialize)
---------
Co-authored-by: Igor Wodiany <dev at wodiany.com>
[AMDGPU] Fold fmul with zero checks to fmul.legacy
Recognize f32 multiplication with zero checks in AMDGPUCodeGenPrepare,
including fabs/fneg wrappers.
Example:
```
(x == 0 || y == 0) ? +0.0 : x * y
==>
llvm.amdgcn.fmul.legacy(x, y)
```
[AMDGPU] Add fmul.legacy select fold tests. NFC
Add AMDGPUCodeGenPrepare tests for folding a select guarded by zero
checks into llvm.amdgcn.fmul.legacy, including negative tests and min
cases for future work.
[RISCV][P-ext] Add scalar sati/usati intrinsics (#233769)
Add the scalar Saturation intrinsics:
https://github.com/riscv/riscv-p-spec/blob/master/P-ext-intrinsics.adoc#saturation
- `__riscv_sati_i32`, `__riscv_usati_u32`
- `__riscv_sati_i64`, `__riscv_usati_u64` (RV64 only)
`llvm.riscv.sati`/`llvm.riscv.usati` are overloaded on the integer
type. RV32 and the i64 forms select `sati`/`usati` directly. RV64 has
no 32-bit scalar forms, so the i32 intrinsics use `psati.w`/`pusati.w`
on the low word.
Merge tag 'dlm-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm
Pull dlm updates from David Teigland:
"This contains several fixes for bugs found by static analysis, fuzzing
and code review. They mostly involve invalid input, e.g. from
userspace, configfs or remote nodes, and are unlikely to be seen in
normal usage"
* tag 'dlm-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm:
dlm: fix typos in comments
dlm: clean up a type in waiters_read()
dlm: validate node weights before building member array
dlm: wait for outstanding SRCU callbacks to complete in exit paths
dlm: fix variable key length lookup
dlm: fix NULL pointer dereference in dlm_dump_rsb_name()
dlm: validate lock modes in recovery messages
dlm: fix buffer overflow from negative len in dlm_search_rsb_tree
dlm: validate userspace lock resource name length
dlm: require CAP_SYS_ADMIN for dlm-monitor device
dlm: gate dlm_plock device on CAP_SYS_ADMIN
Merge tag 'erofs-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull erofs updates from Gao Xiang:
"The most notable change is to support superblock sharing for
composefs, thanks to Giuseppe again.
Another one switches to iomap for file-backed mounts on unencoded
inodes, which enables efficient sub-folio I/Os. The others are all
random ones.
Summary:
- Support superblock sharing for file-backed mounts
- Use iomap for file-backed mounts on unencoded inodes
- Minor fixes and cleanups"
* tag 'erofs-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
erofs: enable iomap for file-backed mounts on unencoded inodes
erofs: use on-disk blkszbits for lz4 max pcluster bound
mailmap: update entry for Gao Xiang
[4 lines not shown]
Add a three-way runtime condition tie to the tests
The first WHEN clause is a strict subset of the third, which ties with the
second. Clause order then tests `b` first, and TASKYIELD is never
selected.
Compare the condition of an unguarded match_any candidate
A match_any WHEN clause with a runtime condition also gets a candidate
without the condition, since its other traits can still match. That
candidate has no condition trait, so isStrictSubset skipped the key
check, and it became a subset of a WHEN clause with a different
condition. The key is now compared whenever it is set.
[flang][OpenMP] Don't treat different runtime conditions as subsets
When two METADIRECTIVE candidates have the same score and one selector is
a strict subset of the other, the superset wins. Flang ranks every
runtime condition with the same property, so isStrictSubset saw
different conditions as the same:
!$omp metadirective &
!$omp& when(user={condition(a)}, &
!$omp& implementation={vendor(score(4): llvm)}: taskyield) &
!$omp& when(user={condition(b)}, device={kind(host)}, &
!$omp& implementation={vendor(score(3): llvm)}: taskwait)
Both candidates score 5, and `b` was tested first, so TASKWAIT ran when
both conditions were true. Neither selector is a subset of the other, so
clause order should decide.
This patch adds a UserCondition key to VariantMatchInfo, and
isStrictSubset requires equal keys when the first selector has a
[14 lines not shown]
Merge tag 'xfs-merge-7.4' of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux
Pull xfs updates from Carlos Maiolino:
"The bulk of this are bug fixes, cleanups and code refactoring, lots of
them. Majority of those bug fixes are targeting scrub and online
repair code. There are no real new features here but lots of prep code
for future work. There are also some small performance optimizations
but nothing major"
* tag 'xfs-merge-7.4' of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux: (168 commits)
xfs: don't limit software atomic writes by the group alignment
xfs: add missing cursor stat checks after xfs_btree_delete
xfs: add missing cursor status check after xfs_inobt_get_rec
xfs: handle NULL open_zone for merged ioends in xfs_end_ioend_write_zoned
xfs: refactor inode forkoff to byte conversions
xfs: drop unnecessary sr parameter from xchk_rtgroup init functions
xfs: drop unnecessary sa parameter from xchk_ag init functions
xfs: drop unnecessary sr parameter from xrep_rtgroup init functions
xfs: drop unnecessary sa parameter from the xrep_ag init functions
[12 lines not shown]
[clang-cl] Don't count linker inputs against /Fo and /Fa (#232611)
The /Fo and /Fa checks reject a file name when there is more than one
input. But the input list also holds object files, libraries, and linker
options such as -Xlinker, which go straight to the linker and never get
an output named by /Fo or /Fa. So
clang-cl /c foo.c /Fofoo.obj -Xlinker -bar
failed with "cannot specify '/Fofoo.obj' when compiling multiple source
files". MSVC's cl.exe also accepts .obj and .lib inputs next to
/Fo<file>.
Count only the inputs that get compiled.
Fixes #216085.
Merge tag 'gfs2-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2
Pull gfs2 updates from Andreas Gruenbacher:
- Two journaled data inode fixes (fix journaled truncate range end
offset, fix the escaped block copy in gfs2_before_commit)
- When reading a new resource group from disk, validate its boundaries
- To eliminate lock contention, get rid of the per-filesystem
sd_async_glock_wait queue and wait for the individual glock locking
events instead
- Shut up sparse RCU warnings by marking ip->i_gl as __rcu. Accessing
it through gfs2_inode_glock() -> rcu_dereference_protected() where we
know that the pointer cannot change
- Some more minor fixes and cleanups
[20 lines not shown]
