In the Linux kernel, the following vulnerability has been resolved:
mrp: introduce active flags to prevent UAF when applicant uninit
The caller of del_timer_sync must prevent restarting of the timer, If we have no this synchronization, there is a small probability that the cancellation will not be successful.
And syzbot report the fellowing crash: ================================================================== BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256 Pointer tag: [f9], memory tag: [fe]
CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395 kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320 do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367 el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627 call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4 kernel/time/timer.c:1519
To fix it, we can introduce a new active flags to make sure the timer will not restart.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.86-53.137Upgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-4.14.304-226.531Upgrade kernel-livepatch-5.10.165-143.735Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libs | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-hwe-5.4Upgrade linux-azure-fde-5.15Upgrade linux-fipsUpgrade linux-nvidia-tegra-5.15Upgrade linux-intel-iotgUpgrade linux-riscv-5.15Upgrade linux-gcp-4.15Upgrade linux-intel-iot-realtimeUpgrade linux-gcpUpgrade linux-ibmUpgrade linux-gcp-fipsUpgrade linux-hweUpgrade linux-azure-fipsUpgrade linux-aws-fipsUpgrade linuxUpgrade linux-ibm-5.4Upgrade linux-azure-5.15Upgrade linux-gcp-5.4Upgrade linux-gkeopUpgrade linux-xilinx-zynqmpUpgrade linux-kvmUpgrade linux-oracle-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-gcp-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-aws-hweUpgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-aws-5.4Upgrade linux-awsUpgrade linux-realtimeUpgrade linux-nvidiaUpgrade linux-oracleUpgrade linux-gkeUpgrade linux-azure-4.15Upgrade linux-azure-5.4Upgrade linux-azureUpgrade linux-raspiUpgrade linux-aws-5.15Upgrade linux-lowlatencyUpgrade linux-hwe-5.15Upgrade linux-oracle-5.4Upgrade linux-iot | Jan 6, 2026 | Dec 24, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub