In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix use-after-free when volume resizing failed
There is an use-after-free problem reported by KASAN: ================================================================== BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735
CPU: 2 PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi] ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK>
When ubi_change_vtbl_record() returns an error in ubi_resize_volume(), "new_eba_tbl" will be freed on error handing path, but it is holded by "vol->eba_tbl" in ubi_eba_replace_table(). It means that the liftcycle of "vol->eba_tbl" and "vol" are different, so when resizing volume in next time, it causing an use-after-free fault.
Fix it by not freeing "new_eba_tbl" after it replaced in ubi_eba_replace_table(), while will be freed in next volume resizing.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-4.14.309-231.529Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.173-154.642Upgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade bpftoolUpgrade python-perfUpgrade kernel-headers | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Dec 10, 2025 | Dec 10, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Mar 17, 2026 | Mar 16, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 9, 2025 |
| Ubuntu | — | Upgrade linux-gkeopUpgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linux-kvmUpgrade linux-gcp-fipsUpgrade linux-raspiUpgrade linux-intel-iotg-5.15Upgrade linux-hwe-5.4Upgrade linux-oracleUpgrade linux-xilinx-zynqmpUpgrade linux-azure-5.15Upgrade linux-aws-fipsUpgrade linux-aws-5.4Upgrade linux-bluefieldUpgrade linux-gcp-5.15Upgrade linux-realtimeUpgrade linux-iotUpgrade linux-raspi-5.4Upgrade linux-azureUpgrade linux-azure-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-ibmUpgrade linux-lowlatencyUpgrade linuxUpgrade linux-oracle-5.15Upgrade linux-awsUpgrade linux-riscv-5.15Upgrade linux-ibm-5.15Upgrade linux-gcpUpgrade linux-nvidia-tegra-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-gcp-5.4Upgrade linux-ibm-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-gkeUpgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-intel-iotgUpgrade linux-aws-5.15Upgrade linux-nvidia-tegraUpgrade linux-azure-fips | Dec 11, 2025 | Dec 9, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub