In the Linux kernel, the following vulnerability has been resolved:
fs: fix UAF/GPF bug in nilfs_mdt_destroy
In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF).
Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-coreUpgrade kernel-rt-64k-coreUpgrade perfUpgrade kernel-debug-develUpgrade kernel-docUpgrade kernel-rt-debugUpgrade rtlaUpgrade kernel-64k-modules-extraUpgrade bpftoolUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-develUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-kvmUpgrade kernel-uki-virtUpgrade kernel-develUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-develUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-cross-headersUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-develUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-debug-modulesUpgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-64kUpgrade kernel-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64kUpgrade kernel-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-64k-debugUpgrade rvUpgrade kernel-rt-64k-debug-coreUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-modules-coreUpgrade kernel-toolsUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-modules-coreUpgrade libperfUpgrade kernel-rt-modules-coreUpgrade kernel-rt-modules-extra | Nov 10, 2025 | Nov 3, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.149-133.644Upgrade kernel-toolsUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade python-perfUpgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.296-222.539Upgrade kernel-livepatch-5.15.73-48.135 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Sep 19, 2025 | Sep 19, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade bpftool | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade kernel | Nov 5, 2025 | Sep 17, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Nov 4, 2025 | Sep 17, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debuginfo | Feb 5, 2026 | Nov 13, 2025 |
| Ubuntu | — | Upgrade linux-fipsUpgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-oracleUpgrade linux-azure-5.15Upgrade linux-gkeUpgrade linux-oracle-5.4Upgrade linux-hwe-5.4Upgrade linux-intel-iotgUpgrade linux-kvmUpgrade linux-riscv-5.15Upgrade linux-ibm-5.4Upgrade linux-aws-fipsUpgrade linux-raspi-5.4Upgrade linux-nvidiaUpgrade linuxUpgrade linux-gkeopUpgrade linux-azureUpgrade linux-iotUpgrade linux-aws-5.4Upgrade linux-raspiUpgrade linux-oracle-5.15Upgrade linux-gcp-5.15Upgrade linux-aws-5.15Upgrade linux-hwe-5.15Upgrade linux-aws-hweUpgrade linux-hweUpgrade linux-azure-fipsUpgrade linux-lowlatencyUpgrade linux-gcp-4.15Upgrade linux-ibmUpgrade linux-awsUpgrade linux-azure-4.15Upgrade linux-azure-5.4Upgrade linux-realtimeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iotg-5.15 | Sep 26, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub