In the Linux kernel, the following vulnerability has been resolved:
igbvf: fix double free in `igbvf_probe`
In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF.
In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`.
The KASAN logs are as follows:
[ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernelUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade python-perfUpgrade kernel-headersUpgrade kernel-livepatch-4.14.262-200.489Upgrade kernel-develUpgrade kernel-livepatch-5.10.93-87.444Upgrade bpftoolUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfo | Aug 2, 2024 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Dell Powerstore Dsa2025223 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 27, 2025 |
| Huawei Euleros 2_0_sp8 | — | Upgrade bpftoolUpgrade kernel-develUpgrade kernelUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-headersUpgrade python3-perfUpgrade kernel-toolsUpgrade python-perf | Jan 21, 2025 | Jun 19, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perf | Oct 8, 2024 | Jun 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-symsUpgrade gfs2-kmp-azureUpgrade kernel-default-extraUpgrade kernel-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-default-develUpgrade kernel-64kbUpgrade kernel-devel-azureUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade kernel-sourceUpgrade kernel-syms-azureUpgrade kernel-azure-develUpgrade kernel-rt_debug-develUpgrade kernel-preempt-develUpgrade kernel-rtUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-rtUpgrade kernel-source-rtUpgrade kernel-source-azureUpgrade kernel-zfcpdumpUpgrade kernel-rt-vdsoUpgrade kernel-azure-baseUpgrade kernel-preemptUpgrade kernel-develUpgrade cluster-md-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-rt-develUpgrade kernel-default-baseUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-defaultUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-devel-rtUpgrade kernel-syms-rtUpgrade kernel-default-manUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade kernel-rt_debugUpgrade kernel-azure-vdsoUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kernel-docs | Aug 9, 2024 | Jun 19, 2024 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-4.4.0-1149-kvmUpgrade linux-image-4.4.0-1186-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-awsUpgrade linux-image-kvmUpgrade linux-image-4.4.0-273-genericUpgrade linux-image-4.4.0-1119-fipsUpgrade linux-image-4.4.0-1148-awsUpgrade linux-image-4.4.0-273-lowlatencyUpgrade linux-image-genericUpgrade linux-image-generic-lts-xenialUpgrade linux-image-lowlatencyUpgrade linux-image-fips | Nov 19, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub