In the Linux kernel, the following vulnerability has been resolved:
net: rswitch: Avoid use-after-free in rswitch_poll()
The use-after-free is actually in rswitch_tx_free(), which is inlined in rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the same pointer, the skb is first freed using dev_kfree_skb_any(), then the value in skb->len is used to update the interface statistics.
Let's move around the instructions to use skb->len before the skb is freed.
This bug is trivial to reproduce using KFENCE. It will trigger a splat every few packets. A simple ARP request or ICMP echo request is enough.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1017-azure-fdeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1016-azure-fdeUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1017-azureUpgrade linux-image-6.8.0-1017-nvidia-lowlatencyUpgrade linux-image-azureUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1016-azureUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1013-gkeUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1016-gcpUpgrade linux-image-oem-22.04Upgrade linux-image-awsUpgrade linux-image-6.8.0-1017-nvidiaUpgrade linux-image-6.8.0-48-lowlatencyUpgrade linux-image-6.8.0-48-genericUpgrade linux-image-oem-24.04aUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1017-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1017-nvidia-lowlatency-64kUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1018-awsUpgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1014-raspiUpgrade linux-image-nvidia-64kUpgrade linux-image-genericUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-6.8.0-1015-oracle-64kUpgrade linux-image-kvmUpgrade linux-image-gkeop-6.8Upgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1015-oracleUpgrade linux-image-6.8.0-1014-ibmUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1017-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-virtualUpgrade linux-image-gcpUpgrade linux-image-6.8.0-48-generic-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-48-lowlatency-64kUpgrade linux-image-6.8.0-1016-oemUpgrade linux-image-ibm | Nov 4, 2024 | Jul 30, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub