In the Linux kernel, the following vulnerability has been resolved:
mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()
KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference:
================================================================== BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock
write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0: drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306 refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340 obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408 memcg_slab_free_hook mm/slab.h:587 [inline] __cache_free mm/slab.c:3373 [inline] __do_kmem_cache_free mm/slab.c:3577 [inline] kmem_cache_free+0x105/0x280 mm/slab.c:3602 __d_free fs/dcache.c:298 [inline] dentry_free fs/dcache.c:375 [inline] __dentry_kill+0x422/0x4a0 fs/dcache.c:621 dentry_kill+0x8d/0x1e0 dput+0x118/0x1f0 fs/dcache.c:913 __fput+0x3bf/0x570 fs/file_table.c:329 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x123/0x160 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1: obj_stock_flush_required mm/memcontrol.c:3319 [inline] drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361 try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703 try_charge mm/memcontrol.c:2837 [inline] mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290 sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025 sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525 udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692 udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668 __sys_setsockopt+0x1c3/0x230 net/socket.c:2271 __do_sys_setsockopt net/socket.c:2282 [inline] __se_sys_setsockopt net/socket.c:2279 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0xffff8881382d52c0 -> 0xffff888138893740
Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to stock->cached_objcg.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-develUpgrade kernel-cross-headersUpgrade kernelUpgrade kernel-debugUpgrade kernel-headersUpgrade kernel-zfcpdump-develUpgrade python3-perfUpgrade perfUpgrade kernel-rt-coreUpgrade bpftoolUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-zfcpdumpUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-docUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-develUpgrade kernel-debug-modules | Dec 10, 2025 | Dec 8, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-staticUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-develUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.49-69.116Upgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade perf-debuginfoUpgrade kernel-headers | Oct 16, 2025 | Sep 18, 2025 |
| Debian | — | Upgrade linux | Sep 22, 2025 | Sep 22, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-toolsUpgrade bpftool | Dec 12, 2025 | Dec 11, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade bpftool | Jan 15, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libs | Dec 12, 2025 | Dec 11, 2025 |
| Oracle_linux | — | Upgrade kernel | Dec 10, 2025 | Sep 18, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Nov 7, 2025 | Sep 18, 2025 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-rt-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modules-extraUpgrade perfUpgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernelUpgrade kernel-rt-develUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade python3-perfUpgrade kernel-rt-debug-coreUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-debug-develUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libsUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-devel | Feb 5, 2026 | Dec 13, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub