In the Linux kernel, the following vulnerability has been resolved:
tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818
Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257
Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818
[Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Nov 11, 2024 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perf | Jan 14, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libs | Feb 11, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Feb 11, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Jan 15, 2025 | Oct 29, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | May 15, 2025 | Oct 29, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-realtime-5.15Upgrade linux-image-kvm-5.15Upgrade linux-image-5.15.0-151-generic-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1024-nvidia-64kUpgrade linux-image-azure-fips-5.15Upgrade linux-image-aws-lts-18.04Upgrade linux-image-5.15.0-1089-awsUpgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-4.15.0-2121-aws-fipsUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.4.0-1123-fipsUpgrade linux-image-5.4.0-1154-azureUpgrade linux-image-5.15.0-1031-nvidia-tegra-igx-rtUpgrade linux-image-intelUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-virtualUpgrade linux-image-oem-22.04Upgrade linux-image-nvidiaUpgrade linux-image-oem-22.04cUpgrade linux-image-snapdragon-5.4Upgrade linux-image-oracleUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-bluefieldUpgrade linux-image-oem-20.04cUpgrade linux-image-4.4.0-271-lowlatencyUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1024-nvidiaUpgrade linux-image-4.4.0-1116-fipsUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-nvidia-5.15Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1025-awsUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-lowlatency-5.4Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-aws-5.15Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-1008-gkeopUpgrade linux-image-fipsUpgrade linux-image-6.8.0-56-lowlatencyUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-5.15.0-1088-gcpUpgrade linux-image-gkeUpgrade linux-image-generic-lpae-5.4Upgrade linux-image-5.15.0-1042-nvidia-tegraUpgrade linux-image-5.15.0-1031-nvidia-tegra-igxUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1148-oracleUpgrade linux-image-5.15.0-145-lowlatencyUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-4.15.0-1176-gcpUpgrade linux-image-5.4.0-1132-raspiUpgrade linux-image-5.4.0-1067-xilinx-zynqmpUpgrade linux-image-xilinx-zynqmp-5.4Upgrade linux-image-5.15.0-1094-azure-fipsUpgrade linux-image-azure-4.15Upgrade linux-image-6.8.0-1024-nvidia-lowlatencyUpgrade linux-image-oem-24.04aUpgrade linux-image-4.4.0-1147-kvmUpgrade linux-image-oem-20.04bUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-5.4.0-220-genericUpgrade linux-image-gcp-4.15Upgrade linux-image-generic-lts-xenialUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-azure-lts-18.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-5.4.0-1108-bluefieldUpgrade linux-image-oracle-4.15Upgrade linux-image-5.4.0-1155-azure-fipsUpgrade linux-image-4.15.0-2084-gcp-fipsUpgrade linux-image-5.15.0-1094-azureUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.4.0-1152-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1081-ibmUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-tegraUpgrade linux-image-oem-22.04dUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-gkeopUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-oem-osp1Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-4.15.0-2100-azure-fipsUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1071-gkeopUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1147-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1024-nvidia-lowlatency-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-ibm-5.15Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-lowlatency-5.15Upgrade linux-image-nvidia-64kUpgrade linux-image-oemUpgrade linux-image-6.8.0-1024-oemUpgrade linux-image-6.8.0-1026-gcp-64kUpgrade linux-image-5.15.0-1088-gcp-fipsUpgrade linux-image-4.15.0-1166-kvmUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-220-lowlatencyUpgrade linux-image-raspi-5.15Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1085-kvmUpgrade linux-image-4.15.0-240-genericUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-fips-5.15Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-kvm-5.4Upgrade linux-image-6.8.0-57-genericUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.15.0-1183-awsUpgrade linux-image-5.15.0-1086-gkeUpgrade linux-image-5.15.0-1084-intel-iotgUpgrade linux-image-5.15.0-1089-aws-64kUpgrade linux-image-5.15.0-1083-raspiUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-6.8.0-56-generic-64kUpgrade linux-image-raspi-5.4Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1026-gcpUpgrade linux-image-ibm-classicUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-gcp-fips-4.15Upgrade linux-image-5.15.0-151-genericUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-5.15Upgrade linux-image-gcp-fips-5.15Upgrade linux-image-4.15.0-1145-oracleUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-5.15.0-1053-xilinx-zynqmpUpgrade linux-image-azure-cvmUpgrade linux-image-raspi2Upgrade linux-image-4.15.0-1191-azureUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-azure-5.15Upgrade linux-image-oracle-lts-18.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-ibm-5.4Upgrade linux-image-4.15.0-240-lowlatencyUpgrade linux-image-aws-5.4Upgrade linux-image-4.15.0-1138-fipsUpgrade linux-image-virtual-5.4Upgrade linux-image-6.8.0-1022-oracle-64kUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-145-lowlatency-64kUpgrade linux-image-aws-hweUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-aws-lts-20.04Upgrade linux-image-aws-fipsUpgrade linux-image-azure-5.4Upgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-1095-ibmUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-5.15.0-1089-aws-fipsUpgrade linux-image-6.8.0-1022-oracleUpgrade linux-image-5.15.0-145-fipsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-aws-fips-5.4Upgrade linux-image-aws-lts-24.04Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-aws-fips-5.15Upgrade linux-image-oracle-5.15Upgrade linux-image-6.8.0-1025-azureUpgrade linux-image-5.4.0-1149-awsUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-5.15.0-1089-realtimeUpgrade linux-image-aws-4.15Upgrade linux-image-gcp-fips-5.4Upgrade linux-image-5.15.0-1083-nvidiaUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-azure-fipsUpgrade linux-image-oracle-5.4Upgrade linux-image-gcp-64kUpgrade linux-image-5.4.0-1149-aws-fipsUpgrade linux-image-kvmUpgrade linux-image-5.4.0-1152-gcp-fipsUpgrade linux-image-5.4.0-1136-kvmUpgrade linux-image-gcp-fipsUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-gcp-5.15Upgrade linux-image-aws-fips-4.15Upgrade linux-image-raspiUpgrade linux-image-azure-fips-5.4Upgrade linux-image-awsUpgrade linux-image-5.4.0-220-generic-lpaeUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-5.4Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtual-5.15Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-6.8.0-56-lowlatency-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-5.4.0-1053-iotUpgrade linux-image-4.4.0-271-genericUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-aws-64k-5.15Upgrade linux-image-fips-5.4Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-6.8.0-1021-gkeUpgrade linux-image-5.15.0-1086-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1042-nvidia-tegra-rtUpgrade linux-image-gcp-5.4Upgrade linux-image-6.8.1-1018-realtimeUpgrade linux-image-6.8.0-56-genericUpgrade linux-image-4.4.0-1184-awsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-4.4.0-1146-awsUpgrade linux-image-oem-22.04aUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1083-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-64k-5.15Upgrade linux-image-ibmUpgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1082-intel-iot-realtimeUpgrade linux-image-bluefield-5.4Upgrade linux-image-azure-lts-24.04Upgrade linux-image-5.15.0-151-generic-lpaeUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-azureUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-azure-fips-4.15 | Feb 20, 2025 | Oct 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 10, 2025 | Oct 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub