In the Linux kernel, the following vulnerability has been resolved:
netns: Make get_net_ns() handle zero refcount net
Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0xdf/0x1d0 Code: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1 RSP: 0018:ffff8881067b7da0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac RDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001 RBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139 R10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4 R13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040 FS: 00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0xa3/0xc0 ? __warn+0xa5/0x1c0 ? refcount_warn_saturate+0xdf/0x1d0 ? report_bug+0x1fc/0x2d0 ? refcount_warn_saturate+0xdf/0x1d0 ? handle_bug+0xa1/0x110 ? exc_invalid_op+0x3c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? __warn_printk+0xcc/0x140 ? __warn_printk+0xd5/0x140 ? refcount_warn_saturate+0xdf/0x1d0 get_net_ns+0xa4/0xc0 ? __pfx_get_net_ns+0x10/0x10 open_related_ns+0x5a/0x130 __tun_chr_ioctl+0x1616/0x2370 ? __sanitizer_cov_trace_switch+0x58/0xa0 ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30 ? __pfx_tun_chr_ioctl+0x10/0x10 tun_chr_ioctl+0x2f/0x40 __x64_sys_ioctl+0x11b/0x160 x64_sys_call+0x1211/0x20d0 do_syscall_64+0x9e/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b28f165d7 Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8 RSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7 RDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003 RBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0 R10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730 R13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ...
This is trigger as below: ns0 ns1 tun_set_iff() //dev is tun0 tun->dev = dev //ip link set tun0 netns ns1 put_net() //ref is 0 __tun_chr_ioctl() //TUNGETDEVNETNS net = dev_net(tun->dev); open_related_ns(&net->ns, get_net_ns); //ns1 get_net_ns() get_net() //addition on 0
Use maybe_get_net() in get_net_ns in case net's ref is zero to fix this
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-toolsUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-develUpgrade kernel-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade rvUpgrade kernel-rt-debugUpgrade kernel-zfcpdumpUpgrade kernel-rt-develUpgrade kernel-64k-debug-develUpgrade perfUpgrade kernel-64k-develUpgrade kernel-docUpgrade kernel-coreUpgrade kernel-rt-coreUpgrade kernel-64k-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-devel-matchedUpgrade libperfUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-abi-stablelistsUpgrade kernel-64k-modules-coreUpgrade kernel-debug-develUpgrade kernel-tools-libs-develUpgrade kernel-64k-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-kvmUpgrade rtlaUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debugUpgrade kernel-debugUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modulesUpgrade bpftoolUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-coreUpgrade kernel-headersUpgrade kernel-debug-devel-matchedUpgrade kernelUpgrade kernel-64kUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-cross-headersUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debug-core | Sep 26, 2024 | Jul 12, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-develUpgrade perfUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.15.162-107.160Upgrade bpftoolUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.223-211.872Upgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernelUpgrade python-perfUpgrade kernel-tools-debuginfoUpgrade kernel-headers | Mar 4, 2025 | Jul 12, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-tools-develUpgrade kernel-livepatch-6.1.96-102.177Upgrade kernel-modules-extra-commonUpgrade python3-perfUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-libbpf-develUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernelUpgrade kernel-libbpfUpgrade bpftool-debuginfoUpgrade kernel-modules-extraUpgrade bpftool | Mar 27, 2025 | Jul 12, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 17, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Dec 12, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perf | Dec 12, 2024 | Jul 12, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 16, 2024 | Jul 12, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Sep 25, 2024 | Jul 12, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-modulesUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-coreUpgrade perfUpgrade kernel-rt-modulesUpgrade kernel-rt-modules-coreUpgrade rvUpgrade bpftool-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rtUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libsUpgrade libperf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-develUpgrade kernel-toolsUpgrade kernel-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfoUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-tools-debuginfoUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade libperfUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade kernel-cross-headersUpgrade kernel-uki-virtUpgrade kernelUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-coreUpgrade kernel-rt-debuginfo-common-x86_64Upgrade rtlaUpgrade perf-debuginfoUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-debug-modules-coreUpgrade kernel-debug-debuginfo | Aug 22, 2024 | Jul 12, 2024 |
| Suse | — | Upgrade kselftests-kmp-rtUpgrade dtb-mediatekUpgrade kernel-kvmsmall-develUpgrade dtb-freescaleUpgrade kernel-default-extraUpgrade kernel-develUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-default-develUpgrade dtb-renesasUpgrade kernel-source-azureUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade dtb-lgUpgrade gfs2-kmp-azureUpgrade dtb-apmUpgrade kernel-azure-extraUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-livepatch-develUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-debug-develUpgrade dtb-armUpgrade dtb-socionextUpgrade dtb-amazonUpgrade dlm-kmp-64kbUpgrade kernel-rt-develUpgrade kernel-64kb-develUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-default-baseUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade dtb-amdUpgrade kernel-debugUpgrade dlm-kmp-azureUpgrade dtb-hisiliconUpgrade gfs2-kmp-64kbUpgrade dtb-caviumUpgrade kernel-devel-rtUpgrade dtb-appleUpgrade kernel-obs-qaUpgrade kernel-rt-livepatchUpgrade dtb-allwinnerUpgrade kernel-64kbUpgrade dtb-xilinxUpgrade dtb-marvellUpgrade kernel-rtUpgrade kernel-syms-azureUpgrade kernel-source-vanillaUpgrade kernel-default-base-rebuildUpgrade kernel-rt-vdsoUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-macrosUpgrade kernel-kvmsmallUpgrade kernel-sourceUpgrade kernel-obs-buildUpgrade dtb-rockchipUpgrade kernel-docsUpgrade kernel-syms-rtUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-rt-extraUpgrade kernel-rt-livepatch-develUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-azureUpgrade kernel-rt_debugUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade dtb-sprdUpgrade dtb-qcomUpgrade dtb-exynosUpgrade kernel-rt_debug-develUpgrade kernel-debug-livepatch-develUpgrade dtb-amlogicUpgrade dtb-broadcomUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-default-livepatchUpgrade kernel-docs-htmlUpgrade kernel-default-vdsoUpgrade kernel-azure-optionalUpgrade dtb-nvidiaUpgrade dtb-alteraUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-rt | Aug 14, 2024 | Jul 12, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-121-generic-lpaeUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1066-gkeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-121-genericUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1062-raspiUpgrade linux-image-bluefieldUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-intel-iotgUpgrade linux-image-gkeUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-raspi2-hwe-18.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-awsUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-raspi2Upgrade linux-image-5.4.0-195-lowlatencyUpgrade linux-image-5.4.0-195-generic-lpaeUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-5.4.0-1137-azureUpgrade linux-image-5.15.0-1064-nvidiaUpgrade linux-image-5.15.0-1052-gkeopUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtualUpgrade linux-image-5.4.0-1136-gcpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1067-oracleUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-azure-cvmUpgrade linux-image-oracleUpgrade linux-image-5.4.0-1120-kvmUpgrade linux-image-oemUpgrade linux-image-5.4.0-1132-awsUpgrade linux-image-oem-20.04dUpgrade linux-image-kvmUpgrade linux-image-5.4.0-195-genericUpgrade linux-image-5.15.0-1068-gcpUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-ibmUpgrade linux-image-5.15.0-1064-nvidia-lowlatencyUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1043-iotUpgrade linux-image-gkeop-5.4Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-44-genericUpgrade linux-image-5.15.0-121-generic-64kUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-nvidiaUpgrade linux-image-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-5.4.0-1092-bluefieldUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.4.0-1051-xilinx-zynqmpUpgrade linux-image-azureUpgrade linux-image-oem-20.04bUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1072-azureUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1062-ibmUpgrade linux-image-5.15.0-1072-azure-fdeUpgrade linux-image-5.15.0-121-lowlatencyUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-oracle-64kUpgrade linux-image-5.4.0-1099-gkeopUpgrade linux-image-5.4.0-1116-raspiUpgrade linux-image-5.15.0-1064-intel-iotgUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-oem-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oem-22.04bUpgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-azure-lts-20.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-azure-fdeUpgrade linux-image-intelUpgrade linux-image-5.15.0-1066-kvmUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-5.4.0-1131-oracleUpgrade linux-image-aws-lts-20.04Upgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1069-awsUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-raspiUpgrade linux-image-5.15.0-121-lowlatency-64kUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-5.4.0-1079-ibm | Sep 12, 2024 | Jul 12, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub