In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not change while the driver periodically traverses it in order to update the kernel about multicast route stats that were queried from the device.
One instance of list entry deletion (during route replace) was missed and it can result in a use-after-free [1].
Fix by acquiring the mutex before deleting the entry from the list and releasing it afterwards.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] Read of size 8 at addr ffff8881523c2fa8 by task kworker/2:5/22043
CPU: 2 UID: 0 PID: 22043 Comm: kworker/2:5 Not tainted 6.18.0-rc1-custom-g1a3d6d7cd014 #1 PREEMPT(full) Hardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017 Workqueue: mlxsw_core mlxsw_sp_mr_stats_update [mlxsw_spectrum] Call Trace: <TASK> dump_stack_lvl+0xba/0x110 print_report+0x174/0x4f5 kasan_report+0xdf/0x110 mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 mlxsw_sp_mr_route_add+0xd8/0x4770 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30
Freed by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x43/0x70 kfree+0x14e/0x700 mlxsw_sp_mr_route_add+0x2dea/0x4770 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:444 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernelUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-rt-debugUpgrade bpftoolUpgrade kernel-rt-64k-coreUpgrade kernel-coreUpgrade kernel-64k-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-debugUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-64k-modules-extraUpgrade rtlaUpgrade kernel-64k-debug-develUpgrade kernel-64k-debug-coreUpgrade kernel-debug-coreUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-64k-modulesUpgrade kernel-64kUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-develUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-cross-headersUpgrade kernel-rt-64k-modules-coreUpgrade kernel-debug-develUpgrade kernel-tools-libsUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-abi-stablelistsUpgrade kernel-rt-modules-coreUpgrade libperfUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-modulesUpgrade kernel-toolsUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-docUpgrade kernel-rt-64kUpgrade kernel-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rtUpgrade kernel-64k-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-64k-debugUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade python3-perfUpgrade kernel-64k-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-uki-virtUpgrade kernel-debug-modules-extraUpgrade perfUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-headersUpgrade rv | Feb 25, 2026 | Feb 23, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade python-perfUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.248-247.988Upgrade kernel-develUpgrade kernel-headersUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Feb 11, 2026 | Feb 11, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade python3-perf | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade kernel | Feb 26, 2026 | Jan 13, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Feb 26, 2026 | Jan 13, 2026 |
| Rocky_linux | — | Upgrade kernel-tools-debuginfoUpgrade kernel-rt-debugUpgrade kernel-uki-virtUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade rvUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modulesUpgrade perfUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-debug-uki-virtUpgrade python3-perfUpgrade kernel-rt-develUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rtUpgrade kernel-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modulesUpgrade rtlaUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-debug-develUpgrade libperfUpgrade kernel-tools-libsUpgrade kernel-rt-modules-extraUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modules-coreUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-debug-debuginfoUpgrade libperf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-devel-matchedUpgrade kernelUpgrade kernel-zfcpdump-modules-core | Mar 31, 2026 | Mar 26, 2026 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1054-gcpUpgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-110-lowlatency-64kUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1051-ibmUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-virtual-6.17Upgrade linux-image-5.15.0-173-genericUpgrade linux-image-6.17.0-1014-raspiUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-oem-24.04cUpgrade linux-image-6.8.0-1051-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1098-intel-iotgUpgrade linux-image-azure-5.15Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1052-awsUpgrade linux-image-aws-64k-6.17Upgrade linux-image-5.15.0-1098-nvidia-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-5.15.0-1103-aws-64kUpgrade linux-image-intel-iotgUpgrade linux-image-lowlatency-5.15Upgrade linux-image-6.8.1-1047-realtimeUpgrade linux-image-generic-64k-5.15Upgrade linux-image-kvmUpgrade linux-image-raspiUpgrade linux-image-oem-20.04cUpgrade linux-image-virtual-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-oem-6.17Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.17.0-22-genericUpgrade linux-image-oracle-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-aws-fips-5.15Upgrade linux-image-virtual-5.15Upgrade linux-image-gcp-6.17Upgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-24.04dUpgrade linux-image-6.17.0-22-generic-64kUpgrade linux-image-aws-fips-6.8Upgrade linux-image-6.17.0-1012-gcpUpgrade linux-image-5.15.0-173-lowlatency-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-raspi-5.15Upgrade linux-image-5.15.0-1102-realtimeUpgrade linux-image-6.8.0-1052-raspiUpgrade linux-image-gkeUpgrade linux-image-intelUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-nvidia-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-gcp-64k-6.17Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-6.8.0-1037-gkeopUpgrade linux-image-5.15.0-1099-gkeUpgrade linux-image-6.8.0-1054-azureUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-5.15.0-1067-xilinx-zynqmpUpgrade linux-image-aws-64k-6.8Upgrade linux-image-nvidia-5.15Upgrade linux-image-oem-20.04Upgrade linux-image-gke-64kUpgrade linux-image-oracle-64k-6.17Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.17.0-1012-aws-64kUpgrade linux-image-azure-fipsUpgrade linux-image-aws-5.15Upgrade linux-image-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-2042-raspi-realtimeUpgrade linux-image-azureUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-110-lowlatencyUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-ibm-5.15Upgrade linux-image-realtime-5.15Upgrade linux-image-5.15.0-1103-gcp-fipsUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1054-gcp-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.17.0-1011-oracleUpgrade linux-image-nvidia-64kUpgrade linux-image-5.15.0-1086-gkeopUpgrade linux-image-5.15.0-1094-intel-iot-realtimeUpgrade linux-image-6.17.0-1010-realtimeUpgrade linux-image-5.15.0-1103-gcpUpgrade linux-image-gke-64k-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-generic-64k-6.17Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-raspi-6.8Upgrade linux-image-awsUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1110-azureUpgrade linux-image-gcp-5.15Upgrade linux-image-6.8.0-1054-azure-fipsUpgrade linux-image-5.15.0-1109-azure-fipsUpgrade linux-image-6.17.0-1013-azureUpgrade linux-image-oem-20.04dUpgrade linux-image-raspi-6.17Upgrade linux-image-6.8.0-1054-gcp-fipsUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-110-generic-64kUpgrade linux-image-6.8.0-110-fipsUpgrade linux-image-realtime-6.17Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-1022-nvidia-tegra-rtUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-kvm-5.15Upgrade linux-image-gcp-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-aws-6.17Upgrade linux-image-5.15.0-1103-aws-fipsUpgrade linux-image-oracle-6.17Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-5.15.0-1055-nvidia-tegra-rtUpgrade linux-image-5.15.0-1100-oracleUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-6.17.0-1020-oemUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1052-aws-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-ibm-classicUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-oem-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-azure-6.8Upgrade linux-image-5.15.0-1097-raspiUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-genericUpgrade linux-image-6.8.0-1051-nvidia-lowlatencyUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1022-nvidia-tegraUpgrade linux-image-5.15.0-1103-awsUpgrade linux-image-5.15.0-1044-nvidia-tegra-igxUpgrade linux-image-oracleUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-nvidiaUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-6.8.0-1050-gke-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1055-nvidia-tegraUpgrade linux-image-5.15.0-173-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.8.0-1059-azureUpgrade linux-image-6.8.0-1052-aws-fipsUpgrade linux-image-6.8.0-1051-nvidiaUpgrade linux-image-6.17.0-1012-gcp-64kUpgrade linux-image-6.17.0-1012-awsUpgrade linux-image-5.15.0-173-generic-lpaeUpgrade linux-image-virtualUpgrade linux-image-gcpUpgrade linux-image-6.17.0-1011-oracle-64kUpgrade linux-image-gkeopUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-24.04bUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-6.8Upgrade linux-image-generic-5.15Upgrade linux-image-fips-5.15Upgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1050-gkeUpgrade linux-image-6.8.0-1049-oracle-64kUpgrade linux-image-6.8.0-1049-oracleUpgrade linux-image-5.15.0-1109-azureUpgrade linux-image-5.15.0-1098-nvidiaUpgrade linux-image-5.15.0-1044-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1097-ibmUpgrade linux-image-5.15.0-1095-kvmUpgrade linux-image-5.15.0-173-generic-64kUpgrade linux-image-5.15.0-173-fipsUpgrade linux-image-xilinxUpgrade linux-image-raspi-realtimeUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-fipsUpgrade linux-image-azure-fips-6.8Upgrade linux-image-azure-fips-5.15Upgrade linux-image-azure-6.17Upgrade linux-image-aws-fipsUpgrade linux-image-aws-64k-5.15Upgrade linux-image-6.8.0-110-genericUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-tegraUpgrade linux-image-generic-6.17Upgrade linux-image-6.8.0-1051-nvidia-64kUpgrade linux-image-aws-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-fips-6.8Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-ibmUpgrade linux-image-gcp-lts-22.04 | Mar 17, 2026 | Jan 13, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub