In the Linux kernel, the following vulnerability has been resolved:
ext4: aovid use-after-free in ext4_ext_insert_extent()
As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values:
ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth > path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* here path is still 2000, UAF! */ eh = path[depth].p_hdr
================================================================== BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace: <TASK> ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...]
Allocated by task 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...]
Freed by task 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] ==================================================================
So use *ppath to update the path to avoid the above problem.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.227-219.884Upgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade python-perfUpgrade kernelUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.168-114.166Upgrade perfUpgrade kernel-livepatch-4.14.355-276.618 | Jan 22, 2025 | Oct 21, 2024 |
| Amazon_linux | — | Upgrade kernel | Apr 18, 2025 | Oct 21, 2024 |
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-tools-develUpgrade perfUpgrade python3-perfUpgrade kernel-modules-extra-commonUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-staticUpgrade kernel-libbpf-develUpgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-livepatch-6.1.115-126.197Upgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-headers | Feb 17, 2025 | Oct 21, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Nov 11, 2024 | Oct 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libs | Jan 14, 2025 | Oct 21, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftool | Feb 11, 2025 | Oct 21, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-tools | Feb 11, 2025 | Oct 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Jan 15, 2025 | Oct 21, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Dec 17, 2024 | Oct 21, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | May 15, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1024-gcp-64kUpgrade linux-image-aws-4.15Upgrade linux-image-6.11.0-18-genericUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-54-generic-64kUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gke-5.15Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-4.15.0-1176-gcpUpgrade linux-image-gcpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gcp-fips-4.15Upgrade linux-image-5.15.0-1068-nvidia-lowlatencyUpgrade linux-image-oem-24.04aUpgrade linux-image-aws-lts-24.04Upgrade linux-image-5.15.0-1066-raspiUpgrade linux-image-gkeop-6.8Upgrade linux-image-kvmUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1066-ibmUpgrade linux-image-6.8.0-1019-gkeUpgrade linux-image-4.15.0-240-lowlatencyUpgrade linux-image-5.4.0-1086-ibmUpgrade linux-image-6.8.0-1019-raspiUpgrade linux-image-4.15.0-1183-awsUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-4.4.0-271-lowlatencyUpgrade linux-image-4.15.0-2121-aws-fipsUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-5.15.0-127-generic-64kUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-4.4.0-1146-awsUpgrade linux-image-oem-22.04aUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-6.8.0-54-genericUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-ibmUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-6.8.0-54-lowlatency-64kUpgrade linux-image-raspi2Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-127-lowlatency-64kUpgrade linux-image-5.4.0-1058-xilinx-zynqmpUpgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-1006-gkeopUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.15.0-1138-fipsUpgrade linux-image-6.8.0-1024-oemUpgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-bluefieldUpgrade linux-image-azure-4.15Upgrade linux-image-4.4.0-1147-kvmUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-5.4.0-1143-gcpUpgrade linux-image-oem-20.04cUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-6.8.0-1022-nvidia-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-azure-lts-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-ibm-classicUpgrade linux-image-aws-lts-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-5.4.0-208-generic-lpaeUpgrade linux-image-5.15.0-127-lowlatencyUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-awsUpgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-oem-osp1Upgrade linux-image-6.8.0-54-lowlatencyUpgrade linux-image-6.8.0-1022-nvidia-lowlatency-64kUpgrade linux-image-aws-fips-4.15Upgrade linux-image-azure-lts-20.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-oracleUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1024-gcpUpgrade linux-image-oem-20.04Upgrade linux-image-realtimeUpgrade linux-image-intelUpgrade linux-image-azureUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-4.4.0-271-genericUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-4.4.0-1184-awsUpgrade linux-image-4.15.0-2084-gcp-fipsUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1020-oracleUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-6.8.0-1020-oracle-64kUpgrade linux-image-generic-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-5.15.0-127-genericUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-4.15.0-1166-kvmUpgrade linux-image-5.4.0-1099-bluefieldUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-4.15.0-240-genericUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-1070-gkeUpgrade linux-image-5.15.0-1068-nvidiaUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-genericUpgrade linux-image-aws-fipsUpgrade linux-image-raspiUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-4.15.0-2100-azure-fipsUpgrade linux-image-4.4.0-1116-fipsUpgrade linux-image-5.4.0-1127-kvmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1022-nvidia-lowlatencyUpgrade linux-image-gcp-4.15Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-5.4.0-208-genericUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-aws-lts-18.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-generic-lts-xenialUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-5.4.0-1140-awsUpgrade linux-image-5.4.0-208-lowlatencyUpgrade linux-image-4.15.0-1145-oracleUpgrade linux-image-aws-hweUpgrade linux-image-azure-fips-4.15Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.4.0-1145-azureUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-6.11.0-1009-awsUpgrade linux-image-oracle-4.15Upgrade linux-image-nvidia-6.8Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-azure-lts-18.04Upgrade linux-image-gcp-fipsUpgrade linux-image-5.15.0-1073-awsUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-6.8.0-1025-azureUpgrade linux-image-6.8.0-1023-awsUpgrade linux-image-intel-iotgUpgrade linux-image-5.4.0-1138-oracleUpgrade linux-image-oem-22.04dUpgrade linux-image-oemUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1071-intel-iotgUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-127-generic-lpaeUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1039-xilinx-zynqmpUpgrade linux-image-4.15.0-1191-azureUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gkeopUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-6.8.0-57-genericUpgrade linux-image-5.15.0-1056-gkeopUpgrade linux-image-5.15.0-1071-oracleUpgrade linux-image-6.8.0-1022-nvidiaUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-1070-kvmUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1072-gcpUpgrade linux-image-gcp-64kUpgrade linux-image-gkeUpgrade linux-image-fipsUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-lowlatency-hwe-16.04 | Dec 18, 2024 | Oct 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub