In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: Fix UAF in blkcg_unpin_online()
blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF:
================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117
CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> ... Freed by task 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30
Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online().
Fix it by reading the parent pointer before destroying the blkcg's blkg's.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-64k-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-docUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rtUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modules-extraUpgrade rvUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64kUpgrade kernel-tools-libs-develUpgrade kernel-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-64k-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debugUpgrade kernel-rt-modulesUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-64k-debug-modules-coreUpgrade libperfUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-debugUpgrade kernel-64kUpgrade kernel-64k-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-headersUpgrade kernel-rt-64k-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-rt-debug-develUpgrade kernel-64k-develUpgrade perfUpgrade kernel-cross-headersUpgrade python3-perfUpgrade rtlaUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-coreUpgrade kernelUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debugUpgrade kernel-coreUpgrade kernel-debug-develUpgrade kernel-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-rt-develUpgrade kernel-tools-libs | Nov 20, 2025 | Nov 11, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.15.178-120.178Upgrade bpftoolUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade python-perfUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.234-225.895Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-headers | Feb 26, 2025 | Dec 27, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpfUpgrade perfUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.1.124-134.200Upgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-libbpf-static | Feb 26, 2025 | Dec 27, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jan 13, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftool | Apr 11, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Mar 19, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-tools | Apr 1, 2025 | Dec 27, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Mar 12, 2025 | Dec 27, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jul 9, 2025 | Dec 27, 2024 |
| Rocky_linux | — | Upgrade libperf-debuginfoUpgrade kernel-rt-debuginfoUpgrade rtlaUpgrade kernel-debug-develUpgrade perfUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modulesUpgrade libperfUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-coreUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-tools-libsUpgrade rvUpgrade kernel-rt-develUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-debug-modulesUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-coreUpgrade kernelUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-coreUpgrade kernel-rt-debugUpgrade kernel-debug-modules-extraUpgrade kernel-modules-extra | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1016-oemUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-1073-nvidia-lowlatencyUpgrade linux-image-6.8.0-1026-azure-fdeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04dUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-azure-lts-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-5.15.0-1073-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-realtimeUpgrade linux-image-5.15.0-1080-awsUpgrade linux-image-genericUpgrade linux-image-6.8.0-57-genericUpgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-6.8.0-1026-awsUpgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-oem-20.04bUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-1061-gkeopUpgrade linux-image-oem-22.04cUpgrade linux-image-6.11.0-1010-azureUpgrade linux-image-5.15.0-1079-awsUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-1078-gcpUpgrade linux-image-oem-20.04Upgrade linux-image-6.8.1-1019-realtimeUpgrade linux-image-5.15.0-1074-intel-iotgUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-24.04aUpgrade linux-image-oem-20.04cUpgrade linux-image-6.11.0-1010-azure-fdeUpgrade linux-image-6.11.0-1012-oracle-64kUpgrade linux-image-6.8.0-1027-gcp-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1082-azure-fdeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-intel-iotgUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-6.11.0-19-generic-64kUpgrade linux-image-oracleUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1076-oracleUpgrade linux-image-5.15.0-134-generic-64kUpgrade linux-image-intelUpgrade linux-image-6.11.0-19-genericUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-134-lowlatency-64kUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-6.8.0-57-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04Upgrade linux-image-oem-24.04bUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-tegraUpgrade linux-image-6.8.0-1023-oracle-64kUpgrade linux-image-5.15.0-1082-azureUpgrade linux-image-gkeUpgrade linux-image-oem-20.04dUpgrade linux-image-6.11.0-1006-realtimeUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-kvmUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.11.0-1010-gcpUpgrade linux-image-azure-nvidiaUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-134-genericUpgrade linux-image-awsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-134-lowlatencyUpgrade linux-image-6.8.0-1025-nvidia-lowlatencyUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-cvmUpgrade linux-image-lowlatencyUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.11.0-1009-raspiUpgrade linux-image-azure-lts-24.04Upgrade linux-image-5.15.0-1076-gkeUpgrade linux-image-oem-22.04bUpgrade linux-image-ibmUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.8.0-1023-ibmUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-6.8.0-1025-oemUpgrade linux-image-5.15.0-1073-raspiUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1027-gcpUpgrade linux-image-aws-lts-22.04Upgrade linux-image-gcp-64kUpgrade linux-image-azureUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-1022-gkeUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-raspiUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-6.8.0-1026-azureUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1071-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1025-nvidiaUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-6.8.0-1023-oracleUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-6.8.0-1025-nvidia-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1025-nvidia-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1009-gkeopUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.11.0-1012-oracleUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-57-lowlatencyUpgrade linux-image-5.15.0-134-generic-lpaeUpgrade linux-image-nvidia-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.11.0-1010-awsUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-lowlatency-64k | Mar 6, 2025 | Dec 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 29, 2025 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub