Skip to content

Commit 0fc626c

Browse files
CBL-Mariner-Botazurelinux-securityjslobodzian
authored
Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch pytorch for CVE-2026-24747 [HIGH] - branch 3.0-dev" #15625
Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
1 parent 34e1e83 commit 0fc626c

2 files changed

Lines changed: 81 additions & 1 deletion

File tree

SPECS/pytorch/CVE-2026-24747.patch

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
From cef4c4308729099f4d2fc11bfd5f5132cc6c0225 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Wed, 28 Jan 2026 18:21:32 +0000
4+
Subject: [PATCH] override SWALR.state_dict and load_state_dict; add
5+
_set_anneal_func and use in __init__
6+
7+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
8+
Upstream-reference: AI Backport of https://github.com/pytorch/pytorch/commit/167ad09be5af5c52666759412a3804068c6955d1.patch
9+
---
10+
torch/optim/swa_utils.py | 39 +++++++++++++++++++++++++++++++++++----
11+
1 file changed, 35 insertions(+), 4 deletions(-)
12+
13+
diff --git a/torch/optim/swa_utils.py b/torch/optim/swa_utils.py
14+
index 90b3f159..e792f727 100644
15+
--- a/torch/optim/swa_utils.py
16+
+++ b/torch/optim/swa_utils.py
17+
@@ -7,6 +7,8 @@ import torch
18+
from torch.nn import Module
19+
from torch.optim.lr_scheduler import LRScheduler
20+
from torch.utils._foreach_utils import _get_foreach_kernels_supported_devices
21+
+from typing_extensions import override
22+
+
23+
24+
__all__ = [
25+
'AveragedModel',
26+
@@ -326,10 +328,7 @@ class SWALR(LRScheduler):
27+
if anneal_strategy not in ['cos', 'linear']:
28+
raise ValueError("anneal_strategy must by one of 'cos' or 'linear', "
29+
f"instead got {anneal_strategy}")
30+
- elif anneal_strategy == 'cos':
31+
- self.anneal_func = self._cosine_anneal
32+
- elif anneal_strategy == 'linear':
33+
- self.anneal_func = self._linear_anneal
34+
+ self._set_anneal_func(anneal_strategy)
35+
if not isinstance(anneal_epochs, int) or anneal_epochs < 0:
36+
raise ValueError(f"anneal_epochs must be equal or greater than 0, got {anneal_epochs}")
37+
self.anneal_epochs = anneal_epochs
38+
@@ -375,3 +374,35 @@ class SWALR(LRScheduler):
39+
alpha = self.anneal_func(t)
40+
return [group['swa_lr'] * alpha + lr * (1 - alpha)
41+
for group, lr in zip(self.optimizer.param_groups, prev_lrs)]
42+
+
43+
+
44+
+ def _set_anneal_func(self, anneal_strategy):
45+
+ self._anneal_strategy = anneal_strategy
46+
+ if anneal_strategy == 'cos':
47+
+ self.anneal_func = self._cosine_anneal
48+
+ else:
49+
+ self.anneal_func = self._linear_anneal
50+
+
51+
+ @override
52+
+ def state_dict(self):
53+
+ """Return the state of the scheduler as a :class:`dict`.
54+
+
55+
+ It contains an entry for every variable in self.__dict__ which
56+
+ is not the optimizer or anneal_func.
57+
+ """
58+
+ return {
59+
+ key: value
60+
+ for key, value in self.__dict__.items()
61+
+ if key not in ("optimizer", "anneal_func")
62+
+ }
63+
+
64+
+ @override
65+
+ def load_state_dict(self, state_dict):
66+
+ """Load the scheduler's state.
67+
+
68+
+ Args:
69+
+ state_dict (dict): scheduler state. Should be an object returned
70+
+ from a call to :meth:`state_dict`.
71+
+ """
72+
+ self.__dict__.update(state_dict)
73+
+ self._set_anneal_func(self._anneal_strategy)
74+
--
75+
2.45.4
76+

SPECS/pytorch/pytorch.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Tensors and Dynamic neural networks in Python with strong GPU acceleration.
33
Name: pytorch
44
Version: 2.2.2
5-
Release: 10%{?dist}
5+
Release: 11%{?dist}
66
License: BSD-3-Clause
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -36,6 +36,7 @@ Patch11: CVE-2025-55552.patch
3636
Patch12: CVE-2025-55560.patch
3737
Patch13: CVE-2025-46152.patch
3838
Patch14: CVE-2025-3001.patch
39+
Patch15: CVE-2026-24747.patch
3940

4041
%description
4142
PyTorch is a Python package that provides two high-level features:
@@ -97,6 +98,9 @@ cp -arf docs %{buildroot}/%{_pkgdocdir}
9798
%{_docdir}/*
9899

99100
%changelog
101+
* Wed Jan 28 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.2.2-11
102+
- Patch for CVE-2026-24747
103+
100104
* Thu Dec 25 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.2.2-10
101105
- Patch for CVE-2025-3001
102106

0 commit comments

Comments
 (0)