In the Linux kernel, the following vulnerability has been resolved:
mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()
KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference:
================================================================== BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock
write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0: drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306 refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340 obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408 memcg_slab_free_hook mm/slab.h:587 [inline] __cache_free mm/slab.c:3373 [inline] __do_kmem_cache_free mm/slab.c:3577 [inline] kmem_cache_free+0x105/0x280 mm/slab.c:3602 __d_free fs/dcache.c:298 [inline] dentry_free fs/dcache.c:375 [inline] __dentry_kill+0x422/0x4a0 fs/dcache.c:621 dentry_kill+0x8d/0x1e0 dput+0x118/0x1f0 fs/dcache.c:913 __fput+0x3bf/0x570 fs/file_table.c:329 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x123/0x160 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1: obj_stock_flush_required mm/memcontrol.c:3319 [inline] drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361 try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703 try_charge mm/memcontrol.c:2837 [inline] mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290 sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025 sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525 udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692 udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668 __sys_setsockopt+0x1c3/0x230 net/socket.c:2271 __do_sys_setsockopt net/socket.c:2282 [inline] __se_sys_setsockopt net/socket.c:2279 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0xffff8881382d52c0 -> 0xffff888138893740
Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to stock->cached_objcg.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debugUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade kernel-headersUpgrade bpftoolUpgrade kernel-zfcpdump-develUpgrade kernel-rt-develUpgrade kernel-cross-headersUpgrade kernel-rt-modules-extraUpgrade kernel-develUpgrade kernelUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-develUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modules-extraUpgrade kernel-coreUpgrade kernel-docUpgrade kernel-rtUpgrade kernel-debug-coreUpgrade kernel-modulesUpgrade kernel-toolsUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modules-extra | Dec 10, 2025 | Dec 8, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-livepatch-6.1.49-69.116Upgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernelUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-libbpf-staticUpgrade bpftoolUpgrade kernel-libbpf-develUpgrade python3-perf-debuginfo | Oct 16, 2025 | Sep 18, 2025 |
| Debian | — | Upgrade linux | Sep 22, 2025 | Sep 22, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools | Dec 12, 2025 | Dec 11, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Jan 15, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel | Dec 12, 2025 | Dec 11, 2025 |
| Oracle_linux | — | Upgrade kernel | Dec 10, 2025 | Sep 18, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Nov 7, 2025 | Sep 18, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rtUpgrade kernel-debug-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-debugUpgrade kernel-modulesUpgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-rt-debug-debuginfoUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade bpftoolUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade python3-perfUpgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-tools-libs | Feb 5, 2026 | Dec 13, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub