In the Linux kernel, the following vulnerability has been resolved:
igbvf: fix double free in `igbvf_probe`
In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF.
In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`.
The KASAN logs are as follows:
[ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade python-perfUpgrade kernelUpgrade perfUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.262-200.489Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.93-87.444Upgrade bpftool | Aug 2, 2024 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Dell Powerstore Dsa2025223 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 27, 2025 |
| Huawei Euleros 2_0_sp8 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-develUpgrade python-perfUpgrade python3-perfUpgrade kernel-headersUpgrade perfUpgrade kernel-tools | Jan 21, 2025 | Jun 19, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools | Oct 8, 2024 | Jun 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-syms-rtUpgrade kernel-64kb-develUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade kernel-devel-rtUpgrade kernel-default-manUpgrade kernel-rt-extraUpgrade kernel-rt_debugUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-develUpgrade dlm-kmp-azureUpgrade kernel-default-baseUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-docsUpgrade kselftests-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade reiserfs-kmp-azureUpgrade kernel-develUpgrade kernel-preemptUpgrade kernel-azure-baseUpgrade kernel-rt-livepatchUpgrade kernel-source-rtUpgrade kselftests-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-rt-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-source-azureUpgrade gfs2-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-develUpgrade kernel-sourceUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-default-extraUpgrade kernel-devel-azureUpgrade cluster-md-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-symsUpgrade kernel-rtUpgrade kernel-azure-extraUpgrade kernel-default-develUpgrade kernel-preempt-develUpgrade kernel-64kbUpgrade kernel-azureUpgrade ocfs2-kmp-rt | Aug 9, 2024 | Jun 19, 2024 |
| Ubuntu | — | Upgrade linux-image-4.4.0-273-lowlatencyUpgrade linux-image-fipsUpgrade linux-image-genericUpgrade linux-image-generic-lts-xenialUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-1149-kvmUpgrade linux-image-virtualUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-4.4.0-1148-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.4.0-1186-awsUpgrade linux-image-4.4.0-273-genericUpgrade linux-image-awsUpgrade linux-image-4.4.0-1119-fips | Nov 19, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub