In the Linux kernel, the following vulnerability has been resolved:
igbvf: fix double free in `igbvf_probe`
In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF.
In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`.
The KASAN logs are as follows:
[ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.93-87.444Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.262-200.489Upgrade kernel-tools-develUpgrade python-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-headersUpgrade perf-debuginfoUpgrade perf | Aug 2, 2024 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Dell Powerstore Dsa2025223 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 27, 2025 |
| Huawei Euleros 2_0_sp8 | — | Upgrade bpftoolUpgrade kernelUpgrade kernel-develUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-toolsUpgrade python-perfUpgrade perf | Jan 21, 2025 | Jun 19, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools | Oct 8, 2024 | Jun 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-macrosUpgrade kernel-rt_debugUpgrade kernel-azure-vdsoUpgrade kernel-default-baseUpgrade kselftests-kmp-rtUpgrade kernel-docsUpgrade kernel-rt-develUpgrade kernel-obs-buildUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-rt-livepatch-develUpgrade kernel-default-manUpgrade kernel-rt-extraUpgrade kernel-syms-rtUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-sourceUpgrade kernel-azure-optionalUpgrade kernel-azureUpgrade kernel-64kbUpgrade kernel-rt-livepatchUpgrade kernel-azure-extraUpgrade kernel-azure-develUpgrade kernel-azure-livepatch-develUpgrade kernel-source-azureUpgrade kernel-preemptUpgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-default-extraUpgrade kernel-rt_debug-develUpgrade kernel-symsUpgrade kselftests-kmp-azureUpgrade kernel-develUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-azure-baseUpgrade kernel-rtUpgrade kernel-preempt-develUpgrade gfs2-kmp-rtUpgrade kernel-source-rtUpgrade kernel-default-devel | Aug 9, 2024 | Jun 19, 2024 |
| Ubuntu | — | Upgrade linux-image-4.4.0-1148-awsUpgrade linux-image-virtualUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-273-genericUpgrade linux-image-awsUpgrade linux-image-4.4.0-1119-fipsUpgrade linux-image-4.4.0-1186-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.4.0-1149-kvmUpgrade linux-image-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lts-xenialUpgrade linux-image-genericUpgrade linux-image-fipsUpgrade linux-image-4.4.0-273-lowlatency | Nov 19, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub