In the Linux kernel, the following vulnerability has been resolved:
net: vlan: fix underflow for the real_dev refcnt
Inject error before dev_hold(real_dev) in register_vlan_dev(), and execute the following testcase:
ip link add dev dummy1 type dummy ip link add name dummy1.100 link dummy1 type vlan id 100 ip link del dev dummy1
When the dummy netdevice is removed, we will get a WARNING as following:
======================================================================= refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 2 PID: 0 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
and an endless loop of:
======================================================================= unregister_netdevice: waiting for dummy1 to become free. Usage count = -1073741824
That is because dev_put(real_dev) in vlan_dev_free() be called without dev_hold(real_dev) in register_vlan_dev(). It makes the refcnt of real_dev underflow.
Move the dev_hold(real_dev) to vlan_dev_init() which is the call-back of ndo_init(). That makes dev_hold() and dev_put() for vlan's real_dev symmetrical.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade perfUpgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-headersUpgrade perf-debuginfoUpgrade python-perfUpgrade bpftoolUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-livepatch-5.10.93-87.444 | May 22, 2025 | May 24, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 24, 2024 |
| Suse | — | Upgrade ocfs2-kmp-defaultUpgrade dtb-allwinnerUpgrade kselftests-kmp-azureUpgrade kernel-64kb-develUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-source-rtUpgrade kernel-debugUpgrade kernel-default-livepatchUpgrade dtb-caviumUpgrade dtb-hisiliconUpgrade reiserfs-kmp-64kbUpgrade dtb-nvidiaUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-rt-extraUpgrade dtb-renesasUpgrade kernel-rt-develUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade dtb-sprdUpgrade kernel-defaultUpgrade kernel-rt_debug-develUpgrade dtb-amdUpgrade kernel-rt_debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade kernel-devel-rtUpgrade dtb-appleUpgrade gfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-develUpgrade kernel-default-optionalUpgrade kernel-64kb-extraUpgrade kernel-rt-optionalUpgrade kernel-azure-optionalUpgrade kernel-rt-livepatchUpgrade dtb-alteraUpgrade gfs2-kmp-azureUpgrade kernel-default-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade reiserfs-kmp-azureUpgrade dtb-freescaleUpgrade reiserfs-kmp-defaultUpgrade kernel-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-obs-buildUpgrade cluster-md-kmp-rtUpgrade dtb-rockchipUpgrade kernel-debug-vdsoUpgrade dtb-xilinxUpgrade dtb-socionextUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade dtb-lgUpgrade gfs2-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade dtb-mediatekUpgrade kernel-64kb-optionalUpgrade dlm-kmp-azureUpgrade kernel-64kbUpgrade gfs2-kmp-rtUpgrade dtb-amlogicUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-develUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-azureUpgrade dtb-marvellUpgrade kernel-syms-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-docsUpgrade dtb-armUpgrade dtb-qcomUpgrade kernel-obs-qaUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-defaultUpgrade dtb-exynosUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade kernel-default-extraUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade cluster-md-kmp-defaultUpgrade kernel-default-develUpgrade kernel-rt-vdsoUpgrade kernel-azure-extraUpgrade kernel-azure-develUpgrade kernel-devel-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-symsUpgrade kernel-macrosUpgrade dtb-apmUpgrade dlm-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-source-azureUpgrade dtb-amazonUpgrade ocfs2-kmp-rt | Aug 9, 2024 | May 24, 2024 |
| Ubuntu | — | Upgrade linux-ibmUpgrade linux-azureUpgrade linux-gcpUpgrade linux-fipsUpgrade linux-kvmUpgrade linux-gkeopUpgrade linux-hwe-5.4Upgrade linux-gcp-5.4Upgrade linux-azure-5.4Upgrade linux-oracleUpgrade linuxUpgrade linux-raspi-5.4Upgrade linux-awsUpgrade linux-ibm-5.4Upgrade linux-raspiUpgrade linux-bluefieldUpgrade linux-aws-5.4Upgrade linux-oracle-5.4 | Nov 19, 2024 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub