In the Linux kernel, the following vulnerability has been resolved:
net: fix UaF in netns ops registration error path
If net_assign_generic() fails, the current error path in ops_init() tries to clear the gen pointer slot. Anyway, in such error path, the gen pointer itself has not been modified yet, and the existing and accessed one is smaller than the accessed index, causing an out-of-bounds error:
BUG: KASAN: slab-out-of-bounds in ops_init+0x2de/0x320 Write of size 8 at addr ffff888109124978 by task modprobe/1018
CPU: 2 PID: 1018 Comm: modprobe Not tainted 6.2.0-rc2.mptcp_ae5ac65fbed5+ #1641 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6a/0x9f print_address_description.constprop.0+0x86/0x2b5 print_report+0x11b/0x1fb kasan_report+0x87/0xc0 ops_init+0x2de/0x320 register_pernet_operations+0x2e4/0x750 register_pernet_subsys+0x24/0x40 tcf_register_action+0x9f/0x560 do_one_initcall+0xf9/0x570 do_init_module+0x190/0x650 load_module+0x1fa5/0x23c0 __do_sys_finit_module+0x10d/0x1b0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f42518f778d Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007fff96869688 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 00005568ef7f7c90 RCX: 00007f42518f778d RDX: 0000000000000000 RSI: 00005568ef41d796 RDI: 0000000000000003 RBP: 00005568ef41d796 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 00005568ef7f7d30 R14: 0000000000040000 R15: 0000000000000000 </TASK>
This change addresses the issue by skipping the gen pointer de-reference in the mentioned error-path.
Found by code inspection and verified with explicit error injection on a kasan-enabled kernel.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.167-147.601Upgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.93-55.139Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernelUpgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade perf | Apr 25, 2025 | Mar 27, 2025 |
| Debian | — | Upgrade linux | Mar 31, 2025 | Mar 27, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libs | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 9, 2025 | Mar 27, 2025 |
| Ubuntu | — | Upgrade linux-fipsUpgrade linux-gcpUpgrade linux-gcp-5.4Upgrade linux-riscv-5.15Upgrade linux-gkeUpgrade linux-nvidia-tegra-5.15Upgrade linux-aws-hweUpgrade linux-ibm-5.4Upgrade linux-azure-fipsUpgrade linux-awsUpgrade linux-aws-5.4Upgrade linuxUpgrade linux-oracle-5.4Upgrade linux-aws-5.15Upgrade linux-lowlatencyUpgrade linux-intel-iot-realtimeUpgrade linux-hwe-5.15Upgrade linux-aws-fipsUpgrade linux-realtimeUpgrade linux-gkeopUpgrade linux-xilinx-zynqmpUpgrade linux-ibmUpgrade linux-azure-5.4Upgrade linux-azureUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-4.15Upgrade linux-azure-5.15Upgrade linux-oracle-5.15Upgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-iotUpgrade linux-intel-iotgUpgrade linux-azure-4.15Upgrade linux-raspi-5.4Upgrade linux-oracleUpgrade linux-hweUpgrade linux-gcp-5.15Upgrade linux-nvidiaUpgrade linux-kvmUpgrade linux-intel-iotg-5.15Upgrade linux-raspiUpgrade linux-hwe-5.4 | Apr 1, 2025 | Mar 27, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 28, 2026 | Mar 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub