In the Linux kernel, the following vulnerability has been resolved:
netns: Make get_net_ns() handle zero refcount net
Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0xdf/0x1d0 Code: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1 RSP: 0018:ffff8881067b7da0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac RDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001 RBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139 R10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4 R13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040 FS: 00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0xa3/0xc0 ? __warn+0xa5/0x1c0 ? refcount_warn_saturate+0xdf/0x1d0 ? report_bug+0x1fc/0x2d0 ? refcount_warn_saturate+0xdf/0x1d0 ? handle_bug+0xa1/0x110 ? exc_invalid_op+0x3c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? __warn_printk+0xcc/0x140 ? __warn_printk+0xd5/0x140 ? refcount_warn_saturate+0xdf/0x1d0 get_net_ns+0xa4/0xc0 ? __pfx_get_net_ns+0x10/0x10 open_related_ns+0x5a/0x130 __tun_chr_ioctl+0x1616/0x2370 ? __sanitizer_cov_trace_switch+0x58/0xa0 ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30 ? __pfx_tun_chr_ioctl+0x10/0x10 tun_chr_ioctl+0x2f/0x40 __x64_sys_ioctl+0x11b/0x160 x64_sys_call+0x1211/0x20d0 do_syscall_64+0x9e/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b28f165d7 Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8 RSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7 RDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003 RBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0 R10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730 R13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ...
This is trigger as below: ns0 ns1 tun_set_iff() //dev is tun0 tun->dev = dev //ip link set tun0 netns ns1 put_net() //ref is 0 __tun_chr_ioctl() //TUNGETDEVNETNS net = dev_net(tun->dev); open_related_ns(&net->ns, get_net_ns); //ns1 get_net_ns() get_net() //addition on 0
Use maybe_get_net() in get_net_ns in case net's ref is zero to fix this
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libsUpgrade kernel-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-rt-kvmUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debugUpgrade kernel-64k-coreUpgrade kernel-debugUpgrade rtlaUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-coreUpgrade kernel-debug-devel-matchedUpgrade bpftoolUpgrade kernelUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-64kUpgrade kernel-abi-stablelistsUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-headersUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-64k-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade python3-perfUpgrade kernel-rt-debugUpgrade kernel-64k-debug-modules-coreUpgrade rvUpgrade perfUpgrade kernel-rt-modulesUpgrade kernel-uki-virtUpgrade kernel-develUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-64k-debug-develUpgrade kernel-rt-coreUpgrade kernel-toolsUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-develUpgrade kernel-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-64k-develUpgrade libperfUpgrade kernel-docUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-devel-matched | Sep 26, 2024 | Jul 12, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade perfUpgrade kernel-livepatch-5.15.162-107.160Upgrade kernel-livepatch-5.10.223-211.872Upgrade python-perfUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade bpftoolUpgrade kernelUpgrade bpftool-debuginfo | Mar 4, 2025 | Jul 12, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade bpftoolUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-libbpfUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade perfUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfoUpgrade python3-perfUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-6.1.96-102.177 | Mar 27, 2025 | Jul 12, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 17, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Dec 12, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Dec 12, 2024 | Jul 12, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 16, 2024 | Jul 12, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Sep 25, 2024 | Jul 12, 2024 |
| Rocky_linux | — | Upgrade kernel-cross-headersUpgrade kernel-uki-virtUpgrade kernel-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-develUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-debug-modules-coreUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-coreUpgrade kernel-rt-debugUpgrade kernel-debug-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-debuginfoUpgrade kernel-modulesUpgrade python3-perfUpgrade rtlaUpgrade libperfUpgrade kernel-tools-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modules-coreUpgrade libperf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-modulesUpgrade bpftoolUpgrade kernel-rt-develUpgrade perfUpgrade kernel-rtUpgrade kernel-debug-modules-extraUpgrade rvUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade python3-perf-debuginfo | Aug 22, 2024 | Jul 12, 2024 |
| Suse | — | Upgrade dlm-kmp-64kbUpgrade kernel-azure-extraUpgrade dtb-armUpgrade dtb-lgUpgrade dtb-renesasUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-develUpgrade kernel-default-develUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-rt-livepatchUpgrade dtb-apmUpgrade kernel-source-azureUpgrade ocfs2-kmp-rtUpgrade dtb-socionextUpgrade gfs2-kmp-azureUpgrade kernel-64kb-optionalUpgrade dtb-mediatekUpgrade kernel-debugUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-devel-rtUpgrade dlm-kmp-azureUpgrade dtb-appleUpgrade cluster-md-kmp-rtUpgrade dtb-caviumUpgrade kernel-64kb-develUpgrade dtb-hisiliconUpgrade kernel-default-baseUpgrade kernel-kvmsmall-develUpgrade kernel-obs-qaUpgrade kernel-debug-develUpgrade kselftests-kmp-defaultUpgrade dtb-amazonUpgrade dtb-amdUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade dtb-allwinnerUpgrade reiserfs-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-zfcpdumpUpgrade kernel-default-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-default-extraUpgrade reiserfs-kmp-rtUpgrade kernel-develUpgrade kernel-source-vanillaUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade kernel-default-vdsoUpgrade dtb-nvidiaUpgrade dtb-amlogicUpgrade dtb-alteraUpgrade dlm-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-default-base-rebuildUpgrade kernel-syms-azureUpgrade kernel-docsUpgrade kernel-sourceUpgrade kernel-default-livepatchUpgrade kernel-azureUpgrade dtb-rockchipUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-develUpgrade dtb-broadcomUpgrade kernel-devel-azureUpgrade gfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-extraUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-rtUpgrade kernel-rt_debug-develUpgrade dtb-qcomUpgrade dtb-exynosUpgrade kernel-azure-vdsoUpgrade kernel-macrosUpgrade kernel-obs-buildUpgrade kernel-kvmsmallUpgrade dtb-marvellUpgrade dtb-sprdUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-syms-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-optional | Aug 14, 2024 | Jul 12, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1064-intel-iotgUpgrade linux-image-5.15.0-1072-azure-fdeUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1012-oemUpgrade linux-image-5.15.0-121-generic-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1062-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.4.0-1079-ibmUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.4.0-1131-oracleUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-nvidia-6.8Upgrade linux-image-5.4.0-1043-iotUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-5.15.0-1064-nvidia-lowlatencyUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-121-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-intelUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-20.04cUpgrade linux-image-5.4.0-1116-raspiUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-azure-fdeUpgrade linux-image-ibm-classicUpgrade linux-image-azure-lts-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-nvidiaUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1069-awsUpgrade linux-image-5.15.0-1072-azureUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-5.4.0-1099-gkeopUpgrade linux-image-5.15.0-1066-kvmUpgrade linux-image-generic-lpaeUpgrade linux-image-ibmUpgrade linux-image-nvidia-64kUpgrade linux-image-gke-5.15Upgrade linux-image-genericUpgrade linux-image-azureUpgrade linux-image-generic-64kUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-121-lowlatency-64kUpgrade linux-image-5.4.0-1092-bluefieldUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-raspiUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.4.0-1051-xilinx-zynqmpUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-1067-oracleUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1052-gkeopUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-5.4.0-1132-awsUpgrade linux-image-kvmUpgrade linux-image-azure-cvmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-virtualUpgrade linux-image-oem-22.04dUpgrade linux-image-5.4.0-1120-kvmUpgrade linux-image-oemUpgrade linux-image-raspi2-hwe-18.04Upgrade linux-image-5.4.0-195-generic-lpaeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-raspi2Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-osp1Upgrade linux-image-oem-20.04dUpgrade linux-image-5.4.0-1137-azureUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.4.0-1136-gcpUpgrade linux-image-awsUpgrade linux-image-5.15.0-1064-nvidiaUpgrade linux-image-bluefieldUpgrade linux-image-5.15.0-121-genericUpgrade linux-image-gkeUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-5.15.0-1062-raspiUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-195-genericUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1066-gkeUpgrade linux-image-gkeop-5.15Upgrade linux-image-raspi-nolpaeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1068-gcpUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-5.4.0-195-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-oem-20.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-121-generic-lpaeUpgrade linux-image-6.8.0-1012-oracle | Sep 12, 2024 | Jul 12, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub