In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Sync IRQ works before buffer destruction
If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time-travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN report (or a crash without KASAN):
BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a Read of size 8 at addr 000000006d640a48 by task swapper/0
CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7 Stack: 60c4f20f 0c203d48 41b58ab3 60f224fc 600477fa 60f35687 60c4f20f 601273dd 00000008 6101eb00 6101eab0 615be548 Call Trace: [<60047a58>] show_stack+0x25e/0x282 [<60c609e0>] dump_stack_lvl+0x96/0xfd [<60c50d4c>] print_report+0x1a7/0x5a8 [<603078d3>] kasan_report+0xc1/0xe9 [<60308950>] __asan_report_load8_noabort+0x1b/0x1d [<60232844>] irq_work_run_list+0x11a/0x13a [<602328b4>] irq_work_tick+0x24/0x34 [<6017f9dc>] update_process_times+0x162/0x196 [<6019f335>] tick_sched_handle+0x1a4/0x1c3 [<6019fd9e>] tick_sched_timer+0x79/0x10c [<601812b9>] __hrtimer_run_queues.constprop.0+0x425/0x695 [<60182913>] hrtimer_interrupt+0x16c/0x2c4 [<600486a3>] um_timer+0x164/0x183 [...]
Allocated by task 411: save_stack_trace+0x99/0xb5 stack_trace_save+0x81/0x9b kasan_save_stack+0x2d/0x54 kasan_set_track+0x34/0x3e kasan_save_alloc_info+0x25/0x28 ____kasan_kmalloc+0x8b/0x97 __kasan_kmalloc+0x10/0x12 __kmalloc+0xb2/0xe8 load_elf_phdrs+0xee/0x182 [...]
The buggy address belongs to the object at 000000006d640800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 584 bytes inside of freed 1024-byte region [000000006d640800, 000000006d640c00)
Add the appropriate irq_work_sync() so the work finishes before the buffers are destroyed.
Prior to the commit in the Fixes tag below, there was only a single global IRQ work, so this issue didn't exist.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade perfUpgrade kernel-livepatch-5.10.184-174.730Upgrade kernel-livepatch-4.14.318-240.529Upgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.15.117-72.142Upgrade kernel-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-staticUpgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.29-47.49Upgrade kernelUpgrade kernel-libbpf-develUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-libbpfUpgrade kernel-develUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade python3-perf | Oct 24, 2025 | Oct 4, 2025 |
| Debian | — | Upgrade linux | Oct 6, 2025 | Oct 6, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Dec 12, 2025 | Dec 11, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 4, 2025 |
| Ubuntu | — | Upgrade linux-azure-fdeUpgrade linux-gkeopUpgrade linux-fipsUpgrade linux-ibm-5.15Upgrade linux-realtimeUpgrade linux-nvidia-tegraUpgrade linux-nvidia-tegra-5.15Upgrade linux-gkeUpgrade linux-xilinx-zynqmpUpgrade linux-nvidiaUpgrade linux-riscv-5.15Upgrade linux-lowlatencyUpgrade linux-oracle-5.15Upgrade linux-kvmUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-5.15Upgrade linux-intel-iotgUpgrade linux-oracle-5.4Upgrade linux-raspiUpgrade linux-oracleUpgrade linux-azure-fipsUpgrade linux-aws-5.15Upgrade linux-raspi-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-gcpUpgrade linux-nvidia-tegra-igxUpgrade linux-aws-5.4Upgrade linux-azure-5.15Upgrade linux-gcp-fipsUpgrade linux-ibmUpgrade linux-hwe-5.15Upgrade linux-aws-fipsUpgrade linuxUpgrade linux-iotUpgrade linux-intel-iotg-5.15Upgrade linux-gcp-5.4Upgrade linux-awsUpgrade linux-ibm-5.4Upgrade linux-bluefieldUpgrade linux-azure-5.4Upgrade linux-hwe-5.4Upgrade linux-azure | Oct 10, 2025 | Oct 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Oct 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub