In the Linux kernel, the following vulnerability has been resolved:
ax25: Fix netdev refcount issue
The dev_tracker is added to ax25_cb in ax25_bind(). When the ax25 device is detaching, the dev_tracker of ax25_cb should be deallocated in ax25_kill_by_device() instead of the dev_tracker of ax25_dev. The log reported by ref_tracker is shown below:
[ 80.884935] ref_tracker: reference already released. [ 80.885150] ref_tracker: allocated in: [ 80.885349] ax25_dev_device_up+0x105/0x540 [ 80.885730] ax25_device_event+0xa4/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] __dev_notify_flags+0x138/0x280 [ 80.885730] dev_change_flags+0xd7/0x180 [ 80.885730] dev_ifsioc+0x6a9/0xa30 [ 80.885730] dev_ioctl+0x4d8/0xd90 [ 80.885730] sock_do_ioctl+0x1c2/0x2d0 [ 80.885730] sock_ioctl+0x38b/0x4f0 [ 80.885730] __se_sys_ioctl+0xad/0xf0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 80.885730] ref_tracker: freed in: [ 80.885730] ax25_device_event+0x272/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] dev_close_many+0x272/0x370 [ 80.885730] unregister_netdevice_many_notify+0x3b5/0x1180 [ 80.885730] unregister_netdev+0xcf/0x120 [ 80.885730] sixpack_close+0x11f/0x1b0 [ 80.885730] tty_ldisc_kill+0xcb/0x190 [ 80.885730] tty_ldisc_hangup+0x338/0x3d0 [ 80.885730] __tty_hangup+0x504/0x740 [ 80.885730] tty_release+0x46e/0xd80 [ 80.885730] __fput+0x37f/0x770 [ 80.885730] __x64_sys_close+0x7b/0xb0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 80.893739] ------------[ cut here ]------------ [ 80.894030] WARNING: CPU: 2 PID: 140 at lib/ref_tracker.c:255 ref_tracker_free+0x47b/0x6b0 [ 80.894297] Modules linked in: [ 80.894929] CPU: 2 PID: 140 Comm: ax25_conn_rel_6 Not tainted 6.9.0-rc4-g8cd26fd90c1a #11 [ 80.895190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4 [ 80.895514] RIP: 0010:ref_tracker_free+0x47b/0x6b0 [ 80.895808] Code: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9 [ 80.896171] RSP: 0018:ffff888009edf8c0 EFLAGS: 00000286 [ 80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000 [ 80.896502] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff88800a0d6518 [ 80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a [ 80.897212] R10: dffffc0000000000 R11: ffffed100da6511b R12: ffff88800a4a31d4 [ 80.897859] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518 [ 80.898279] FS: 00007fd88b7fe700(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000 [ 80.899436] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.900181] CR2: 00007fd88c001d48 CR3: 000000000993e000 CR4: 00000000000006f0 ... [ 80.935774] ref_tracker: sp%d@000000000bb9df3d has 1/1 users at [ 80.935774] ax25_bind+0x424/0x4e0 [ 80.935774] __sys_bind+0x1d9/0x270 [ 80.935774] __x64_sys_bind+0x75/0x80 [ 80.935774] do_syscall_64+0xc4/0x1b0 [ 80.935774] entry_SYSCALL_64_after_hwframe+0x67/0x6f
Change ax25_dev->dev_tracker to the dev_tracker of ax25_cb in order to mitigate the bug.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 20, 2024 |
| Suse | — | Upgrade gfs2-kmp-64kbUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-azureUpgrade dtb-hisiliconUpgrade dtb-xilinxUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-64kb-extraUpgrade kernel-azure-extraUpgrade kernel-default-develUpgrade dtb-renesasUpgrade kernel-develUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dtb-amazonUpgrade dtb-apmUpgrade ocfs2-kmp-azureUpgrade dtb-marvellUpgrade dtb-amdUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-default-baseUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-docsUpgrade dlm-kmp-azureUpgrade gfs2-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt_debugUpgrade kernel-rt_debug-develUpgrade dtb-lgUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade dtb-caviumUpgrade dtb-freescaleUpgrade dtb-socionextUpgrade kernel-source-azureUpgrade dtb-allwinnerUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-rtUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-rtUpgrade kernel-source-rtUpgrade kernel-macrosUpgrade kernel-default-vdsoUpgrade kernel-default-extraUpgrade kernel-defaultUpgrade kernel-azureUpgrade dtb-sprdUpgrade kernel-azure-develUpgrade cluster-md-kmp-defaultUpgrade dtb-armUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-64kbUpgrade dtb-amlogicUpgrade dtb-exynosUpgrade dtb-mediatekUpgrade kernel-azure-vdsoUpgrade kernel-azure-optionalUpgrade kernel-syms-azureUpgrade kernel-obs-qaUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-develUpgrade dtb-alteraUpgrade kernel-sourceUpgrade kernel-obs-buildUpgrade kernel-kvmsmallUpgrade dtb-rockchipUpgrade kernel-devel-azureUpgrade kernel-rt-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-rt-optionalUpgrade kernel-source-vanillaUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-default-optional | Jun 24, 2024 | May 20, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-genericUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-oem-24.04Upgrade linux-image-oracleUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-ibm-classicUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-gcpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-awsUpgrade linux-image-raspiUpgrade linux-image-kvmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1013-awsUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-nvidiaUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-azureUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-generic-hwe-24.04 | Aug 9, 2024 | May 20, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 10, 2025 | May 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub