In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not change while the driver periodically traverses it in order to update the kernel about multicast route stats that were queried from the device.
One instance of list entry deletion (during route replace) was missed and it can result in a use-after-free [1].
Fix by acquiring the mutex before deleting the entry from the list and releasing it afterwards.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] Read of size 8 at addr ffff8881523c2fa8 by task kworker/2:5/22043
CPU: 2 UID: 0 PID: 22043 Comm: kworker/2:5 Not tainted 6.18.0-rc1-custom-g1a3d6d7cd014 #1 PREEMPT(full) Hardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017 Workqueue: mlxsw_core mlxsw_sp_mr_stats_update [mlxsw_spectrum] Call Trace: <TASK> dump_stack_lvl+0xba/0x110 print_report+0x174/0x4f5 kasan_report+0xdf/0x110 mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 mlxsw_sp_mr_route_add+0xd8/0x4770 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30
Freed by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x43/0x70 kfree+0x14e/0x700 mlxsw_sp_mr_route_add+0x2dea/0x4770 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:444 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-coreUpgrade kernel-rt-64k-debugUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-64k-debug-develUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-coreUpgrade kernel-rt-64k-coreUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-64kUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-rt-64k-modules-coreUpgrade kernelUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade rtlaUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-64k-develUpgrade kernel-zfcpdumpUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-uki-virtUpgrade kernel-64k-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-64k-debug-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-develUpgrade rvUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debugUpgrade kernel-headersUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64kUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-tools-libs-develUpgrade libperfUpgrade kernel-rt-64k-modulesUpgrade kernel-docUpgrade kernel-64k-coreUpgrade kernel-64k-debug-modules-extraUpgrade perfUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt | Feb 25, 2026 | Feb 23, 2026 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.248-247.988Upgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade python-perfUpgrade perf-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Feb 11, 2026 | Feb 11, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perf | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade kernel | Feb 26, 2026 | Jan 13, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Feb 26, 2026 | Jan 13, 2026 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade python3-perfUpgrade perfUpgrade kernel-debug-uki-virtUpgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade kernel-uki-virtUpgrade kernel-debugUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-rtUpgrade kernel-rt-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-develUpgrade rvUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-debug-coreUpgrade kernel-tools-libsUpgrade rtlaUpgrade libperfUpgrade kernel-rt-modules-extraUpgrade kernel-modules-coreUpgrade kernel-debug-develUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modules-coreUpgrade kernel-devel-matchedUpgrade libperf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-coreUpgrade kernelUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfoUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-extra | Mar 31, 2026 | Mar 26, 2026 |
| Ubuntu | — | Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-173-fipsUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-azure-6.8Upgrade linux-image-5.15.0-1055-nvidia-tegraUpgrade linux-image-5.15.0-173-lowlatencyUpgrade linux-image-virtualUpgrade linux-image-6.17.0-1011-oracle-64kUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-tegraUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1051-nvidia-64kUpgrade linux-image-kvm-5.15Upgrade linux-image-aws-6.17Upgrade linux-image-6.8.0-1052-aws-fipsUpgrade linux-image-gcpUpgrade linux-image-generic-6.17Upgrade linux-image-aws-64kUpgrade linux-image-fips-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1022-nvidia-tegra-rtUpgrade linux-image-gcp-6.8Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1103-aws-fipsUpgrade linux-image-raspi-realtimeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-genericUpgrade linux-image-fipsUpgrade linux-image-azure-fips-5.15Upgrade linux-image-azure-6.17Upgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-110-genericUpgrade linux-image-aws-64k-5.15Upgrade linux-image-aws-lts-22.04Upgrade linux-image-ibmUpgrade linux-image-xilinxUpgrade linux-image-5.15.0-1095-kvmUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-5.15.0-1097-ibmUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-173-generic-64kUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-6.8.0-1051-nvidia-lowlatencyUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1050-gke-64kUpgrade linux-image-5.15.0-1055-nvidia-tegra-rtUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1022-nvidia-tegraUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-5.15.0-1100-oracleUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1050-gkeUpgrade linux-image-fips-5.15Upgrade linux-image-6.8.0-1049-oracle-64kUpgrade linux-image-generic-6.8Upgrade linux-image-5.15.0-1044-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1098-nvidiaUpgrade linux-image-6.8.0-1049-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-gkeopUpgrade linux-image-generic-5.15Upgrade linux-image-5.15.0-1109-azureUpgrade linux-image-oem-24.04bUpgrade linux-image-aws-fipsUpgrade linux-image-azure-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1059-azureUpgrade linux-image-6.17.0-1012-gcp-64kUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-5.15.0-1044-nvidia-tegra-igxUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-6.8.0-1051-nvidiaUpgrade linux-image-ibm-classicUpgrade linux-image-6.17.0-1020-oemUpgrade linux-image-6.17.0-1012-awsUpgrade linux-image-5.15.0-1103-awsUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-173-generic-lpaeUpgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-6.8.0-1052-aws-64kUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-ibm-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-1097-raspiUpgrade linux-image-oracle-6.17Upgrade linux-image-azure-lts-24.04Upgrade linux-image-5.15.0-173-lowlatency-64kUpgrade linux-image-aws-5.15Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1052-awsUpgrade linux-image-5.15.0-1098-nvidia-lowlatencyUpgrade linux-image-5.15.0-1098-intel-iotgUpgrade linux-image-intelUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-6.8.0-110-lowlatency-64kUpgrade linux-image-raspi-5.15Upgrade linux-image-6.17.0-22-generic-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azure-fipsUpgrade linux-image-nvidia-6.8Upgrade linux-image-realtime-5.15Upgrade linux-image-oracle-64kUpgrade linux-image-ibm-5.15Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-azureUpgrade linux-image-6.8.0-2042-raspi-realtimeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1103-gcp-fipsUpgrade linux-image-6.8.0-1054-azureUpgrade linux-image-realtime-6.17Upgrade linux-image-oracle-64k-6.17Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1037-gkeopUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-6.17.0-1012-aws-64kUpgrade linux-image-5.15.0-1099-gkeUpgrade linux-image-5.15.0-1067-xilinx-zynqmpUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-nvidia-5.15Upgrade linux-image-gke-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.17.0-22-genericUpgrade linux-image-generic-64k-6.17Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-6.17Upgrade linux-image-lowlatency-5.15Upgrade linux-image-intel-iotgUpgrade linux-image-gkeop-5.15Upgrade linux-image-aws-fips-5.15Upgrade linux-image-generic-64k-5.15Upgrade linux-image-6.8.1-1047-realtimeUpgrade linux-image-5.15.0-1103-aws-64kUpgrade linux-image-gcp-6.17Upgrade linux-image-oem-24.04cUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-aws-64k-6.17Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-5.15Upgrade linux-image-kvmUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-xilinx-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-oem-20.04cUpgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-generic-64k-6.8Upgrade linux-image-oem-20.04dUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-5.15Upgrade linux-image-6.8.0-110-lowlatencyUpgrade linux-image-6.8.0-1054-gcp-fipsUpgrade linux-image-6.8.0-1054-gcpUpgrade linux-image-6.8.0-1054-azure-fipsUpgrade linux-image-6.17.0-1013-azureUpgrade linux-image-5.15.0-1110-azureUpgrade linux-image-virtual-5.15Upgrade linux-image-raspi-6.17Upgrade linux-image-oracle-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1109-azure-fipsUpgrade linux-image-6.8.0-110-fipsUpgrade linux-image-6.8.0-1051-ibmUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-110-generic-64kUpgrade linux-image-6.8.0-1054-gcp-64kUpgrade linux-image-6.17.0-1011-oracleUpgrade linux-image-6.17.0-1010-realtimeUpgrade linux-image-5.15.0-1094-intel-iot-realtimeUpgrade linux-image-5.15.0-1086-gkeopUpgrade linux-image-raspi-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-awsUpgrade linux-image-oem-24.04dUpgrade linux-image-5.15.0-1103-gcpUpgrade linux-image-virtual-6.17Upgrade linux-image-6.17.0-1014-raspiUpgrade linux-image-5.15.0-173-genericUpgrade linux-image-6.8.0-1051-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-azure-5.15Upgrade linux-image-aws-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-aws-fips-6.8Upgrade linux-image-azure-cvmUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1052-raspiUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gcp-64k-6.17Upgrade linux-image-6.17.0-1012-gcpUpgrade linux-image-5.15.0-1102-realtimeUpgrade linux-image-virtual-hwe-20.04 | Mar 17, 2026 | Jan 13, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub