In the Linux kernel, the following vulnerability has been resolved:
igbvf: fix double free in `igbvf_probe`
In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF.
In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`.
The KASAN logs are as follows:
[ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.93-87.444Upgrade bpftool-debuginfoUpgrade kernel-develUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perfUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade python-perfUpgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.262-200.489 | Aug 2, 2024 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Dell Powerstore Dsa2025223 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 27, 2025 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-perfUpgrade kernel-headersUpgrade python3-perfUpgrade kernel-toolsUpgrade perfUpgrade kernel-develUpgrade kernelUpgrade kernel-tools-libsUpgrade bpftool | Jan 21, 2025 | Jun 19, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Oct 8, 2024 | Jun 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 19, 2024 |
| Suse | — | Upgrade cluster-md-kmp-rtUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade kernel-rt-optionalUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-azure-extraUpgrade kernel-default-develUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-rtUpgrade kernel-preempt-develUpgrade kernel-default-extraUpgrade kernel-azure-optionalUpgrade gfs2-kmp-rtUpgrade kernel-azure-baseUpgrade kernel-azure-develUpgrade kernel-sourceUpgrade kernel-syms-azureUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade kernel-symsUpgrade cluster-md-kmp-azureUpgrade kernel-64kbUpgrade kernel-rt-vdsoUpgrade kernel-source-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-preemptUpgrade kernel-develUpgrade ocfs2-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-default-baseUpgrade kernel-devel-rtUpgrade kselftests-kmp-rtUpgrade kernel-rt-develUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade kernel-rt_debugUpgrade kernel-64kb-develUpgrade kernel-default-manUpgrade kernel-syms-rt | Aug 9, 2024 | Jun 19, 2024 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-4.4.0-1149-kvmUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-273-genericUpgrade linux-image-4.4.0-1119-fipsUpgrade linux-image-4.4.0-1186-awsUpgrade linux-image-awsUpgrade linux-image-4.4.0-1148-awsUpgrade linux-image-virtualUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-273-lowlatencyUpgrade linux-image-genericUpgrade linux-image-fipsUpgrade linux-image-generic-lts-xenial | Nov 19, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub