In the Linux kernel, the following vulnerability has been resolved:
net: rswitch: Avoid use-after-free in rswitch_poll()
The use-after-free is actually in rswitch_tx_free(), which is inlined in rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the same pointer, the skb is first freed using dev_kfree_skb_any(), then the value in skb->len is used to update the interface statistics.
Let's move around the instructions to use skb->len before the skb is freed.
This bug is trivial to reproduce using KFENCE. It will trigger a splat every few packets. A simple ARP request or ICMP echo request is enough.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-6.8.0-1014-ibmUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1017-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1018-awsUpgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-48-generic-64kUpgrade linux-image-oracleUpgrade linux-image-oem-22.04aUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-48-lowlatency-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-nvidiaUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1017-gcpUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1016-oemUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1015-oracle-64kUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1015-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1017-nvidia-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-virtualUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1014-raspiUpgrade linux-image-6.8.0-1016-gcpUpgrade linux-image-6.8.0-1016-azureUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1017-azureUpgrade linux-image-6.8.0-48-genericUpgrade linux-image-oem-22.04dUpgrade linux-image-awsUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1017-nvidiaUpgrade linux-image-6.8.0-48-lowlatencyUpgrade linux-image-6.8.0-1013-gkeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1016-azure-fdeUpgrade linux-image-6.8.0-1017-azure-fdeUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1017-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azureUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-64k-6.8 | Nov 4, 2024 | Jul 30, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub