In the Linux kernel, the following vulnerability has been resolved:
macsec: Fix use-after-free while sending the offloading packet
KASAN reports the following UAF. The metadata_dst, which is used to store the SCI value for macsec offload, is already freed by metadata_dst_free() in macsec_free_netdev(), while driver still use it for sending the packet.
To fix this issue, dst_release() is used instead to release metadata_dst. So it is not freed instantly in macsec_free_netdev() if still referenced by skb.
BUG: KASAN: slab-use-after-free in mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] Read of size 2 at addr ffff88813e42e038 by task kworker/7:2/714 [...] Workqueue: mld mld_ifc_work Call Trace: <TASK> dump_stack_lvl+0x51/0x60 print_report+0xc1/0x600 kasan_report+0xab/0xe0 mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] dev_hard_start_xmit+0x120/0x530 sch_direct_xmit+0x149/0x11e0 __qdisc_run+0x3ad/0x1730 __dev_queue_xmit+0x1196/0x2ed0 vlan_dev_hard_start_xmit+0x32e/0x510 [8021q] dev_hard_start_xmit+0x120/0x530 __dev_queue_xmit+0x14a7/0x2ed0 macsec_start_xmit+0x13e9/0x2340 dev_hard_start_xmit+0x120/0x530 __dev_queue_xmit+0x14a7/0x2ed0 ip6_finish_output2+0x923/0x1a70 ip6_finish_output+0x2d7/0x970 ip6_output+0x1ce/0x3a0 NF_HOOK.constprop.0+0x15f/0x190 mld_sendpack+0x59a/0xbd0 mld_ifc_work+0x48a/0xa80 process_one_work+0x5aa/0xe50 worker_thread+0x79c/0x1290 kthread+0x28f/0x350 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x11/0x20 </TASK>
Allocated by task 3922: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x77/0x90 __kmalloc_noprof+0x188/0x400 metadata_dst_alloc+0x1f/0x4e0 macsec_newlink+0x914/0x1410 __rtnl_newlink+0xe08/0x15b0 rtnl_newlink+0x5f/0x90 rtnetlink_rcv_msg+0x667/0xa80 netlink_rcv_skb+0x12c/0x360 netlink_unicast+0x551/0x770 netlink_sendmsg+0x72d/0xbd0 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x52e/0x6a0 ___sys_sendmsg+0xeb/0x170 __sys_sendmsg+0xb5/0x140 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 4011: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x50 poison_slab_object+0x10c/0x190 __kasan_slab_free+0x11/0x30 kfree+0xe0/0x290 macsec_free_netdev+0x3f/0x140 netdev_run_todo+0x450/0xc70 rtnetlink_rcv_msg+0x66f/0xa80 netlink_rcv_skb+0x12c/0x360 netlink_unicast+0x551/0x770 netlink_sendmsg+0x72d/0xbd0 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x52e/0x6a0 ___sys_sendmsg+0xeb/0x170 __sys_sendmsg+0xb5/0x140 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | Dec 2, 2024 | Nov 9, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Jan 28, 2025 | Nov 9, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | May 15, 2025 | Nov 9, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-22.04dUpgrade linux-image-awsUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-kvmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-oem-24.04bUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-6.8.0-58-genericUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-azureUpgrade linux-image-ibm-classicUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azure-nvidiaUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-raspiUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-aws-lts-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1027-awsUpgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-gcpUpgrade linux-image-6.8.0-58-lowlatency-64kUpgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-lowlatencyUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-gkeUpgrade linux-image-nvidiaUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1027-azureUpgrade linux-image-6.8.0-1026-oemUpgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-virtualUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-24.04aUpgrade linux-image-6.11.0-1010-lowlatency | Feb 20, 2025 | Nov 9, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Nov 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub