In the Linux kernel, the following vulnerability has been resolved:
igbvf: fix double free in `igbvf_probe`
In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF.
In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`.
The KASAN logs are as follows:
[ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.93-87.444Upgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade perfUpgrade kernel-headersUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.262-200.489Upgrade perf-debuginfoUpgrade python-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-debuginfo-common-x86_64 | Aug 2, 2024 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Dell Powerstore Dsa2025223 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 27, 2025 |
| Huawei Euleros 2_0_sp8 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-headersUpgrade perfUpgrade python-perfUpgrade kernelUpgrade kernel-devel | Jan 21, 2025 | Jun 19, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Oct 8, 2024 | Jun 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 19, 2024 |
| Suse | — | Upgrade reiserfs-kmp-defaultUpgrade kernel-docsUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-develUpgrade kernel-obs-buildUpgrade kernel-rt_debugUpgrade kernel-rt_debug-vdsoUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade dlm-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-rt-develUpgrade kernel-default-manUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-default-baseUpgrade kernel-syms-rtUpgrade kernel-devel-rtUpgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade kernel-rt-livepatchUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-preempt-develUpgrade gfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kernel-symsUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-azure-optionalUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-default-develUpgrade ocfs2-kmp-rtUpgrade kernel-develUpgrade kernel-azure-baseUpgrade kernel-preemptUpgrade kernel-azure-extraUpgrade kernel-64kbUpgrade kernel-azureUpgrade kernel-rt-vdso | Aug 9, 2024 | Jun 19, 2024 |
| Ubuntu | — | Upgrade linux-image-awsUpgrade linux-image-4.4.0-1149-kvmUpgrade linux-image-kvmUpgrade linux-image-4.4.0-1148-awsUpgrade linux-image-4.4.0-1119-fipsUpgrade linux-image-4.4.0-1186-awsUpgrade linux-image-virtualUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-273-genericUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-genericUpgrade linux-image-4.4.0-273-lowlatencyUpgrade linux-image-generic-lts-xenial | Nov 19, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub