In the Linux kernel, the following vulnerability has been resolved:
mctp: perform route lookups under a RCU read-side lock
Our current route lookups (mctp_route_lookup and mctp_route_lookup_null) traverse the net's route list without the RCU read lock held. This means the route lookup is subject to preemption, resulting in an potential grace period expiry, and so an eventual kfree() while we still have the route pointer.
Add the proper read-side critical section locks around the route lookups, preventing premption and a possible parallel kfree.
The remaining net->mctp.routes accesses are already under a rcu_read_lock, or protected by the RTNL for updates.
Based on an analysis from Sili Luo <[email protected]>, where introducing a delay in the route lookup could cause a UAF on simultaneous sendmsg() and route deletion.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 29, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 29, 2024 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade kernel-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-azure-extraUpgrade kernel-syms-azureUpgrade kselftests-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-azure | Jun 24, 2024 | Feb 29, 2024 |
| Ubuntu | — | Upgrade linuxUpgrade linux-aws-5.15Upgrade linux-ibm-5.15Upgrade linux-nvidia-tegraUpgrade linux-nvidia-tegra-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-nvidia-tegra-igxUpgrade linux-gcpUpgrade linux-lowlatency-hwe-5.15Upgrade linux-bluefieldUpgrade linux-awsUpgrade linux-gkeUpgrade linux-raspiUpgrade linux-kvmUpgrade linux-intel-iotg-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-gcp-fipsUpgrade linux-oracle-5.15Upgrade linux-intel-iotgUpgrade linux-gcp-5.15Upgrade linux-azureUpgrade linux-riscv-5.15Upgrade linux-realtimeUpgrade linux-aws-fipsUpgrade linux-nvidia-6.5Upgrade linux-ibmUpgrade linux-oracleUpgrade linux-azure-fdeUpgrade linux-lowlatencyUpgrade linux-gkeopUpgrade linux-nvidiaUpgrade linux-gkeop-5.15Upgrade linux-azure-5.15Upgrade linux-hwe-5.15Upgrade linux-fips | Nov 19, 2024 | Feb 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Feb 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub