In the Linux kernel, the following vulnerability has been resolved:
xfrm: interface: fix use-after-free after changing collect_md xfrm interface
collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.
The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.
Calling changelink would thus errornously place the special interface xi in the xfrmi_net->xfrmi hash, but since it also exists in the xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when the net namespace was taken down [1].
Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.
[1] resulting oops: [ 8.516540] kernel BUG at net/core/dev.c:12029! [ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary) [ 8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 8.516569] Workqueue: netns cleanup_net [ 8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0 [ 8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24 [ 8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206 [ 8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60 [ 8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122 [ 8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100 [ 8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00 [ 8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00 [ 8.516615] FS: 0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000 [ 8.516619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0 [ 8.516625] PKRU: 55555554 [ 8.516627] Call Trace: [ 8.516632] <TASK> [ 8.516635] ? rtnl_is_locked+0x15/0x20 [ 8.516641] ? unregister_netdevice_queue+0x29/0xf0 [ 8.516650] ops_undo_list+0x1f2/0x220 [ 8.516659] cleanup_net+0x1ad/0x2e0 [ 8.516664] process_one_work+0x160/0x380 [ 8.516673] worker_thread+0x2aa/0x3c0 [ 8.516679] ? __pfx_worker_thread+0x10/0x10 [ 8.516686] kthread+0xfb/0x200 [ 8.516690] ? __pfx_kthread+0x10/0x10 [ 8.516693] ? __pfx_kthread+0x10/0x10 [ 8.516697] ret_from_fork+0x82/0xf0 [ 8.516705] ? __pfx_kthread+0x10/0x10 [ 8.516709] ret_from_fork_asm+0x1a/0x30 [ 8.516718] </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-develUpgrade kernel-64k-develUpgrade kernel-64k-debug-develUpgrade python3-perfUpgrade kernel-debug-uki-virtUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-develUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-cross-headersUpgrade kernel-modules-coreUpgrade kernelUpgrade kernel-rt-debugUpgrade perfUpgrade kernel-debug-develUpgrade kernel-64k-debug-coreUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-debugUpgrade kernel-rt-kvmUpgrade kernel-rt-64k-modulesUpgrade rtlaUpgrade kernel-coreUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-64k-coreUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade rvUpgrade kernel-rt-debug-modulesUpgrade libperfUpgrade kernel-rt-64k-debugUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-toolsUpgrade kernel-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-abi-stablelistsUpgrade kernel-64k-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-64k-modules-extraUpgrade kernel-docUpgrade kernel-64k-debugUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-debug-coreUpgrade kernel-tools-libsUpgrade kernel-uki-virtUpgrade kernel-headersUpgrade kernel-debug-modules-extraUpgrade kernel-rt-64k-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-modulesUpgrade kernel-rt-64k-coreUpgrade kernel-64kUpgrade kernel-rt-64k | Sep 30, 2025 | Sep 2, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfoUpgrade kernel-livepatch-6.1.148-173.267Upgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-modules-extraUpgrade bpftoolUpgrade kernel-libbpf-develUpgrade python3-perf-debuginfoUpgrade kernel6.12-headersUpgrade kernel6.12Upgrade kernelUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12Upgrade kernel6.12-libbpfUpgrade kernel-livepatch-6.12.46-66.121Upgrade bpftool6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel-develUpgrade kernel6.12-modules-extraUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perfUpgrade python3-perf6.12Upgrade perf-debuginfoUpgrade kernel6.12-toolsUpgrade kernel6.12-libbpf-develUpgrade kernel-tools-develUpgrade kernel-modules-extra-commonUpgrade python3-perf6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-libbpf-debuginfoUpgrade python3-perfUpgrade kernel-libbpf-debuginfo | Sep 9, 2025 | Aug 12, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Sep 8, 2025 | Sep 8, 2025 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Sep 4, 2025 | Aug 12, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Sep 3, 2025 | Aug 12, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-debug-debuginfoUpgrade kernel-debug-develUpgrade kernel-modules-extraUpgrade rtlaUpgrade kernel-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-coreUpgrade kernel-modules-coreUpgrade kernel-rt-coreUpgrade perf-debuginfoUpgrade kernel-rt-modulesUpgrade python3-perf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-rt-debugUpgrade kernel-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rtUpgrade libperfUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade perfUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-devel-matchedUpgrade kernel-toolsUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-kvmUpgrade libperf-debuginfoUpgrade kernel-devel-matchedUpgrade kernel-rt-modules-extraUpgrade rvUpgrade kernel-zfcpdump-core | Feb 5, 2026 | Oct 10, 2025 |
| Suse | — | Upgrade kernel-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-debugUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-armUpgrade kernel-symsUpgrade dtb-renesasUpgrade dlm-kmp-azureUpgrade kernel-docsUpgrade kernel-develUpgrade dtb-apmUpgrade kernel-rt-livepatchUpgrade dtb-allwinnerUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade dtb-qcomUpgrade kernel-default-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-debug-develUpgrade kernel-default-extraUpgrade reiserfs-kmp-defaultUpgrade kernel-default-vdsoUpgrade dtb-rockchipUpgrade kernel-rt-develUpgrade ocfs2-kmp-defaultUpgrade kernel-zfcpdumpUpgrade dtb-caviumUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade dtb-amdUpgrade dtb-exynosUpgrade ocfs2-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-sourceUpgrade kernel-64kb-optionalUpgrade kernel-default-baseUpgrade dtb-xilinxUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade kselftests-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade dtb-hisiliconUpgrade dtb-freescaleUpgrade kernel-source-azureUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-azure-optionalUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-extraUpgrade dtb-sprdUpgrade reiserfs-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-syms-rtUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade dtb-socionextUpgrade dtb-amlogicUpgrade dtb-alteraUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade dtb-broadcomUpgrade kernel-rt-extraUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-defaultUpgrade dtb-marvellUpgrade kernel-default-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-syms-azureUpgrade kernel-docs-htmlUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade kernel-azureUpgrade dtb-lgUpgrade dtb-amazonUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kbUpgrade gfs2-kmp-azureUpgrade dtb-nvidiaUpgrade dtb-appleUpgrade kernel-source-rtUpgrade kernel-64kb-extraUpgrade kernel-rt-optional | Dec 5, 2025 | Sep 5, 2025 |
| Ubuntu | — | Upgrade linux-image-gke-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-generic-6.8Upgrade linux-image-raspiUpgrade linux-image-raspi-6.14Upgrade linux-image-oracle-6.8Upgrade linux-image-realtime-6.14Upgrade linux-image-6.8.0-1024-gkeopUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcp-6.14Upgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-aws-64k-6.14Upgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-6.8.0-1041-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1040-nvidia-lowlatencyUpgrade linux-image-azureUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1040-azure-fdeUpgrade linux-image-generic-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.14.0-1013-realtimeUpgrade linux-image-6.14.0-1017-gcpUpgrade linux-image-6.8.0-85-genericUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1038-ibmUpgrade linux-image-ibm-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1040-nvidia-64kUpgrade linux-image-gcpUpgrade linux-image-realtimeUpgrade linux-image-kvmUpgrade linux-image-raspi-realtimeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-oem-24.04cUpgrade linux-image-6.8.0-1040-raspiUpgrade linux-image-aws-64k-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-virtual-6.14Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure-6.8Upgrade linux-image-azure-fde-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1040-nvidiaUpgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-aws-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-aws-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.1-1035-realtimeUpgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-85-lowlatencyUpgrade linux-image-6.8.0-1037-gkeUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-virtual-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-6.8.0-1041-gcp-64kUpgrade linux-image-6.14.0-1014-aws-64kUpgrade linux-image-6.8.0-1037-gke-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1040-aws-64kUpgrade linux-image-6.8.0-1040-awsUpgrade linux-image-6.14.0-1013-azureUpgrade linux-image-oem-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.14.0-1014-oracle-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-1040-nvidia-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-gcp-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gkeopUpgrade linux-image-azure-6.14Upgrade linux-image-oem-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-gke-64kUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-6.14.0-1017-gcp-64kUpgrade linux-image-azure-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1040-azureUpgrade linux-image-6.14.0-33-genericUpgrade linux-image-6.14.0-1014-awsUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-6.14.0-1013-oemUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-ibmUpgrade linux-image-gkeUpgrade linux-image-generic-64k-6.14Upgrade linux-image-azure-lts-24.04Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-nvidiaUpgrade linux-image-oem-6.14Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-virtualUpgrade linux-image-6.8.0-85-lowlatency-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-33-generic-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.14.0-1015-raspiUpgrade linux-image-6.14.0-1014-oracleUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracle-lts-24.04 | Oct 2, 2025 | Aug 12, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 3, 2025 | Aug 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub