In the Linux kernel, the following vulnerability has been resolved:
mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()
KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference:
================================================================== BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock
write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0: drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306 refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340 obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408 memcg_slab_free_hook mm/slab.h:587 [inline] __cache_free mm/slab.c:3373 [inline] __do_kmem_cache_free mm/slab.c:3577 [inline] kmem_cache_free+0x105/0x280 mm/slab.c:3602 __d_free fs/dcache.c:298 [inline] dentry_free fs/dcache.c:375 [inline] __dentry_kill+0x422/0x4a0 fs/dcache.c:621 dentry_kill+0x8d/0x1e0 dput+0x118/0x1f0 fs/dcache.c:913 __fput+0x3bf/0x570 fs/file_table.c:329 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x123/0x160 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1: obj_stock_flush_required mm/memcontrol.c:3319 [inline] drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361 try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703 try_charge mm/memcontrol.c:2837 [inline] mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290 sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025 sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525 udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692 udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668 __sys_setsockopt+0x1c3/0x230 net/socket.c:2271 __do_sys_setsockopt net/socket.c:2282 [inline] __se_sys_setsockopt net/socket.c:2279 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0xffff8881382d52c0 -> 0xffff888138893740
Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to stock->cached_objcg.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-develUpgrade perfUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-rt-debug-coreUpgrade kernel-develUpgrade kernel-tools-libs-develUpgrade kernel-cross-headersUpgrade kernel-rt-debugUpgrade bpftoolUpgrade kernelUpgrade kernel-headersUpgrade python3-perfUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modulesUpgrade kernel-docUpgrade kernel-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modules-extraUpgrade kernel-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libsUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules | Dec 10, 2025 | Dec 8, 2025 |
| Amazon_linux_2023 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-livepatch-6.1.49-69.116Upgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-develUpgrade kernel-libbpf-develUpgrade python3-perf | Oct 16, 2025 | Sep 18, 2025 |
| Debian | — | Upgrade linux | Sep 22, 2025 | Sep 22, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel | Dec 12, 2025 | Dec 11, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Jan 15, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools | Dec 12, 2025 | Dec 11, 2025 |
| Oracle_linux | — | Upgrade kernel | Dec 10, 2025 | Sep 18, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Nov 7, 2025 | Sep 18, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-rt-modulesUpgrade bpftool-debuginfoUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade perf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-coreUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-modulesUpgrade python3-perfUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-kvmUpgrade perfUpgrade kernel-debugUpgrade kernelUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-modules-extra | Feb 5, 2026 | Dec 13, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub