In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix use-after-free when volume resizing failed
There is an use-after-free problem reported by KASAN: ================================================================== BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735
CPU: 2 PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi] ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK>
When ubi_change_vtbl_record() returns an error in ubi_resize_volume(), "new_eba_tbl" will be freed on error handing path, but it is holded by "vol->eba_tbl" in ubi_eba_replace_table(). It means that the liftcycle of "vol->eba_tbl" and "vol" are different, so when resizing volume in next time, it causing an use-after-free fault.
Fix it by not freeing "new_eba_tbl" after it replaced in ubi_eba_replace_table(), while will be freed in next volume resizing.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-5.10.173-154.642Upgrade python-perfUpgrade bpftoolUpgrade kernel-livepatch-4.14.309-231.529Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-develUpgrade perf-debuginfoUpgrade perfUpgrade kernel-tools | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Dec 10, 2025 | Dec 10, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libs | Mar 17, 2026 | Mar 16, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 9, 2025 |
| Ubuntu | — | Upgrade linux-gkeopUpgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linux-kvmUpgrade linux-gcp-fipsUpgrade linux-raspiUpgrade linux-intel-iotg-5.15Upgrade linux-hwe-5.4Upgrade linux-oracleUpgrade linux-xilinx-zynqmpUpgrade linux-azure-5.15Upgrade linux-aws-fipsUpgrade linux-aws-5.4Upgrade linux-bluefieldUpgrade linux-gcp-5.15Upgrade linux-realtimeUpgrade linux-iotUpgrade linux-raspi-5.4Upgrade linux-azureUpgrade linux-azure-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-ibmUpgrade linux-lowlatencyUpgrade linuxUpgrade linux-oracle-5.15Upgrade linux-awsUpgrade linux-riscv-5.15Upgrade linux-ibm-5.15Upgrade linux-gcpUpgrade linux-nvidia-tegra-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-gcp-5.4Upgrade linux-ibm-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-gkeUpgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-intel-iotgUpgrade linux-aws-5.15Upgrade linux-nvidia-tegraUpgrade linux-azure-fips | Dec 11, 2025 | Dec 9, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub