In the Linux kernel, the following vulnerability has been resolved:
netns: Make get_net_ns() handle zero refcount net
Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0xdf/0x1d0 Code: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1 RSP: 0018:ffff8881067b7da0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac RDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001 RBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139 R10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4 R13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040 FS: 00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0xa3/0xc0 ? __warn+0xa5/0x1c0 ? refcount_warn_saturate+0xdf/0x1d0 ? report_bug+0x1fc/0x2d0 ? refcount_warn_saturate+0xdf/0x1d0 ? handle_bug+0xa1/0x110 ? exc_invalid_op+0x3c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? __warn_printk+0xcc/0x140 ? __warn_printk+0xd5/0x140 ? refcount_warn_saturate+0xdf/0x1d0 get_net_ns+0xa4/0xc0 ? __pfx_get_net_ns+0x10/0x10 open_related_ns+0x5a/0x130 __tun_chr_ioctl+0x1616/0x2370 ? __sanitizer_cov_trace_switch+0x58/0xa0 ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30 ? __pfx_tun_chr_ioctl+0x10/0x10 tun_chr_ioctl+0x2f/0x40 __x64_sys_ioctl+0x11b/0x160 x64_sys_call+0x1211/0x20d0 do_syscall_64+0x9e/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b28f165d7 Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8 RSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7 RDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003 RBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0 R10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730 R13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ...
This is trigger as below: ns0 ns1 tun_set_iff() //dev is tun0 tun->dev = dev //ip link set tun0 netns ns1 put_net() //ref is 0 __tun_chr_ioctl() //TUNGETDEVNETNS net = dev_net(tun->dev); open_related_ns(&net->ns, get_net_ns); //ns1 get_net_ns() get_net() //addition on 0
Use maybe_get_net() in get_net_ns in case net's ref is zero to fix this
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-develUpgrade kernel-rt-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-toolsUpgrade kernel-coreUpgrade kernel-develUpgrade perfUpgrade libperfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-docUpgrade kernel-64k-debug-develUpgrade kernel-64k-develUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade rvUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-extraUpgrade kernel-rt-modulesUpgrade python3-perfUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-uki-virtUpgrade kernel-debug-coreUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64kUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modules-extraUpgrade kernel-64k-coreUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-coreUpgrade kernel-64k-modulesUpgrade bpftoolUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-develUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-modules-coreUpgrade rtla | Sep 26, 2024 | Jul 12, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade perfUpgrade kernel-develUpgrade kernel-livepatch-5.15.162-107.160Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-5.10.223-211.872 | Mar 4, 2025 | Jul 12, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.1.96-102.177Upgrade kernel-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-modules-extra-commonUpgrade python3-perfUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-libbpfUpgrade kernel-headersUpgrade bpftoolUpgrade kernelUpgrade kernel-libbpf-staticUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-modules-extra | Mar 27, 2025 | Jul 12, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 17, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel | Dec 12, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelists | Dec 12, 2024 | Jul 12, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 16, 2024 | Jul 12, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Sep 25, 2024 | Jul 12, 2024 |
| Rocky_linux | — | Upgrade perf-debuginfoUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-coreUpgrade kernel-modules-coreUpgrade kernel-rt-debugUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernel-cross-headersUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade libperfUpgrade rtlaUpgrade kernel-uki-virtUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-modules-extraUpgrade kernel-debug-modules-extraUpgrade rvUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-coreUpgrade perfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-debug-devel-matchedUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-rtUpgrade bpftool-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-tools-libsUpgrade libperf-debuginfo | Aug 22, 2024 | Jul 12, 2024 |
| Suse | — | Upgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-develUpgrade dtb-apmUpgrade dtb-amdUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-livepatch-develUpgrade kernel-source-azureUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade dtb-appleUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade dtb-hisiliconUpgrade dtb-caviumUpgrade reiserfs-kmp-rtUpgrade kernel-64kbUpgrade dtb-xilinxUpgrade kernel-default-baseUpgrade dlm-kmp-defaultUpgrade dtb-allwinnerUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-azureUpgrade kernel-default-develUpgrade dtb-lgUpgrade gfs2-kmp-rtUpgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade dtb-renesasUpgrade kernel-develUpgrade kernel-64kb-develUpgrade kernel-debug-develUpgrade ocfs2-kmp-defaultUpgrade dtb-amazonUpgrade dlm-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-obs-qaUpgrade kernel-rt-livepatchUpgrade kselftests-kmp-rtUpgrade kernel-64kb-optionalUpgrade kernel-debugUpgrade dtb-socionextUpgrade kernel-devel-rtUpgrade kernel-kvmsmall-develUpgrade dtb-armUpgrade kernel-default-livepatch-develUpgrade dtb-mediatekUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-develUpgrade gfs2-kmp-defaultUpgrade kernel-syms-azureUpgrade dtb-sprdUpgrade reiserfs-kmp-azureUpgrade kernel-azure-optionalUpgrade dtb-nvidiaUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-vdsoUpgrade dtb-alteraUpgrade dlm-kmp-rtUpgrade kernel-devel-azureUpgrade kernel-debug-livepatch-develUpgrade dtb-broadcomUpgrade kernel-rt_debugUpgrade dtb-rockchipUpgrade kernel-rt-vdsoUpgrade kernel-sourceUpgrade kernel-macrosUpgrade kernel-azureUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade kernel-azure-vdsoUpgrade kernel-docsUpgrade reiserfs-kmp-64kbUpgrade dtb-exynosUpgrade kernel-default-base-rebuildUpgrade kernel-source-vanillaUpgrade kernel-default-livepatchUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade kernel-rt_debug-develUpgrade dtb-marvellUpgrade kselftests-kmp-azureUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-source-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade kernel-rt-optionalUpgrade dtb-amlogic | Aug 14, 2024 | Jul 12, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1079-ibmUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.4.0-1099-gkeopUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-5.15.0-121-lowlatencyUpgrade linux-image-5.4.0-1116-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1051-xilinx-zynqmpUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-oem-20.04bUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-5.4.0-1092-bluefieldUpgrade linux-image-genericUpgrade linux-image-azure-lts-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1072-azureUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-121-lowlatency-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.4.0-1043-iotUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-5.15.0-1069-awsUpgrade linux-image-ibm-classicUpgrade linux-image-gkeop-5.4Upgrade linux-image-azure-lts-20.04Upgrade linux-image-intelUpgrade linux-image-lowlatency-64kUpgrade linux-image-aws-lts-20.04Upgrade linux-image-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-121-generic-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-oem-20.04cUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-nvidia-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-5.4.0-1131-oracleUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oem-22.04cUpgrade linux-image-azure-fdeUpgrade linux-image-azureUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-5.15.0-1062-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-5.15.0-1066-kvmUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-5.15.0-1064-nvidia-lowlatencyUpgrade linux-image-5.15.0-1072-azure-fdeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.15.0-1064-intel-iotgUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1052-gkeopUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-5.15.0-121-genericUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-bluefieldUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1064-nvidiaUpgrade linux-image-awsUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-gkeUpgrade linux-image-5.15.0-1062-raspiUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.4.0-195-genericUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1136-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-121-generic-lpaeUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-5.4.0-195-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-5.4.0-1132-awsUpgrade linux-image-azure-cvmUpgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-5.4.0-1120-kvmUpgrade linux-image-virtualUpgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-1137-azureUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-gcpUpgrade linux-image-raspi2Upgrade linux-image-5.4.0-195-generic-lpaeUpgrade linux-image-raspi2-hwe-18.04Upgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-oemUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1067-oracleUpgrade linux-image-oem-20.04dUpgrade linux-image-oem-osp1Upgrade linux-image-5.15.0-1068-gcpUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1066-gke | Sep 12, 2024 | Jul 12, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub