In the Linux kernel, the following vulnerability has been resolved:
rhashtable: clear stale iter->p on table restart
rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the table and sets iter->p = NULL if the object is gone. When iter->walker.tbl is NULL (table was freed during resize), it resets slot and skip but forgets to clear iter->p.
rhashtable_walk_next() then dereferences the stale iter->p, reading freed memory. This is a use-after-free.
Any caller that does multi-fragment rhashtable walks across walk_stop/walk_start boundaries is affected. Concrete cases include netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC (tipc_nl_sk_walk in net/tipc/socket.c).
Crash stack (netlink_diag): BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0 Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080) Call Trace: rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016) __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122) netlink_diag_dump+0xc2/0x240 netlink_dump+0x5bc/0x1270 netlink_recvmsg+0x7a3/0x980 sock_recvmsg+0x1bc/0x200 __sys_recvfrom+0x1d4/0x2c0
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf6.18Upgrade bpftool6.18Upgrade kernel6.12Upgrade kernel6.12-tools-develUpgrade kernel6.18-modules-extraUpgrade microvm-kernel6.18Upgrade kernel6.18-tools-develUpgrade kernel6.18Upgrade kernel6.18-modules-extra-commonUpgrade kernel6.12-toolsUpgrade kernel-livepatch-6.18.44-99.149Upgrade python3-perf6.12Upgrade perf6.12-debuginfoUpgrade kernel6.12-headersUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-develUpgrade kernel-livepatch-6.12.103-127.188Upgrade kernel6.18-toolsUpgrade python3-perf6.12-debuginfoUpgrade python3-perf6.18-debuginfoUpgrade python3-perf6.18Upgrade kernel6.12-tools-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.18-debuginfoUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.12-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade bpftool6.18-debuginfoUpgrade kernel6.18-headersUpgrade kernel6.18-debuginfo-common-aarch64Upgrade perf6.18-debuginfoUpgrade perf6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-devel | Sep 1, 2026 | Aug 4, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Aug 9, 2026 | Aug 9, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 27, 2026 | Aug 4, 2026 |
| Rocky_linux | — | Upgrade perfUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade rvUpgrade kernel-rt-kvmUpgrade kernel-modules-extra-matchedUpgrade kernel-debuginfo-common-s390xUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-coreUpgrade kernel-rt-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-libsUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-develUpgrade kernel-debug-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-coreUpgrade kernelUpgrade kernel-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-debugUpgrade kernel-rt-debug-kvmUpgrade libperf-debuginfoUpgrade rtlaUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virtUpgrade kernel-coreUpgrade kernel-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade libperfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-devel | Sep 10, 2026 | Sep 9, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 14, 2026 | Aug 4, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub