In the Linux kernel, the following vulnerability has been resolved:
net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason [1]
This patch returns early from smc_pnet_net_init() if there is no netdevice yet.
I am not even sure why smc_pnet_create_pnetids_list() even exists, because smc_pnet_netdev_event() is also calling smc_pnet_add_base_pnetid() when handling NETDEV_UP event.
[1] extract of typical syzbot reports
2 locks held by syz-executor.3/12252: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12253: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12257: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12261: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.0/12265: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.3/12268: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12271: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12274: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12280: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jun 27, 2024 | May 19, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | May 15, 2025 | May 19, 2024 |
| Suse | — | Upgrade kselftests-kmp-64kbUpgrade dtb-caviumUpgrade kernel-sourceUpgrade kernel-default-vdsoUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade kernel-default-optionalUpgrade dlm-kmp-64kbUpgrade kernel-rtUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade dtb-amazonUpgrade kernel-develUpgrade gfs2-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-extraUpgrade dtb-broadcomUpgrade kernel-source-vanillaUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-azureUpgrade dtb-lgUpgrade kernel-rt-develUpgrade kernel-default-base-rebuildUpgrade kernel-default-livepatchUpgrade dtb-xilinxUpgrade dtb-alteraUpgrade kernel-docs-htmlUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-azureUpgrade kernel-default-develUpgrade gfs2-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade dtb-freescaleUpgrade kernel-source-rtUpgrade kernel-azureUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-rt-optionalUpgrade kernel-zfcpdumpUpgrade dtb-exynosUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-develUpgrade dtb-qcomUpgrade kernel-kvmsmallUpgrade kernel-debug-vdsoUpgrade dtb-renesasUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-defaultUpgrade kernel-docsUpgrade dtb-marvellUpgrade dtb-armUpgrade dtb-hisiliconUpgrade kernel-default-manUpgrade kernel-rt-extraUpgrade kernel-64kb-extraUpgrade dtb-apmUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt_debugUpgrade kernel-obs-qaUpgrade kernel-macrosUpgrade dtb-socionextUpgrade kernel-debugUpgrade dtb-amdUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-vdsoUpgrade dlm-kmp-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-baseUpgrade dtb-appleUpgrade dtb-amlogicUpgrade kernel-syms-rtUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade reiserfs-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-debug-develUpgrade kernel-default-extraUpgrade dtb-mediatekUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-symsUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-baseUpgrade dtb-sprdUpgrade dtb-nvidiaUpgrade ocfs2-kmp-rt | Aug 8, 2024 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-1011-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-azureUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-genericUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-ibmUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1008-oemUpgrade linux-image-nvidiaUpgrade linux-image-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-generic-64kUpgrade linux-image-lowlatencyUpgrade linux-image-intelUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-64kUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-oem-20.04cUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1007-intelUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-oem-20.04dUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-kvmUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gcpUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-gkeop-5.15Upgrade linux-image-gkeUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-oem-20.04 | Jul 12, 2024 | May 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub