In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: Fix UAF in blkcg_unpin_online()
blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF:
================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117
CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> ... Freed by task 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30
Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online().
Fix it by reading the parent pointer before destroying the blkcg's blkg's.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-rt-64k-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-coreUpgrade rvUpgrade kernel-64k-debug-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-64k-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64kUpgrade kernel-64k-debugUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-modulesUpgrade libperfUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-modules-extraUpgrade kernel-docUpgrade kernel-rtUpgrade kernel-rt-64k-debug-develUpgrade kernel-toolsUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-debug-coreUpgrade kernelUpgrade kernel-64k-debug-modulesUpgrade kernel-modulesUpgrade kernel-rt-64k-develUpgrade rtlaUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-debug-develUpgrade perfUpgrade kernel-debug-uki-virtUpgrade kernel-rt-develUpgrade kernel-64k-modulesUpgrade kernel-rt-debugUpgrade kernel-cross-headersUpgrade kernel-debug-modules-coreUpgrade kernel-coreUpgrade kernel-headersUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade python3-perfUpgrade kernel-develUpgrade kernel-modules-extraUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-coreUpgrade kernel-modules-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-modulesUpgrade kernel-64k-develUpgrade kernel-zfcpdumpUpgrade kernel-64k | Nov 20, 2025 | Nov 11, 2025 |
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.234-225.895Upgrade kernelUpgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade perfUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-5.15.178-120.178Upgrade kernel-debuginfo-common-aarch64Upgrade python-perf | Feb 26, 2025 | Dec 27, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-tools-develUpgrade kernelUpgrade kernel-develUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-6.1.124-134.200Upgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade perfUpgrade python3-perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade kernel-libbpf | Feb 26, 2025 | Dec 27, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jan 13, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade bpftool | Apr 11, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade bpftool | Mar 19, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade bpftool | Apr 1, 2025 | Dec 27, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Mar 12, 2025 | Dec 27, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 9, 2025 | Dec 27, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-rt-debugUpgrade kernel-debug-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-coreUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade rvUpgrade kernel-zfcpdump-modules-extraUpgrade python3-perf-debuginfoUpgrade kernelUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-coreUpgrade kernel-rt-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-debug-develUpgrade libperfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-debuginfo-common-s390xUpgrade python3-perfUpgrade kernel-rt-debuginfoUpgrade libperf-debuginfoUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-develUpgrade perfUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modulesUpgrade rtlaUpgrade perf-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-modulesUpgrade kernel-zfcpdump-core | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1010-gcpUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-6.8.0-1009-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-ibmUpgrade linux-image-aws-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1025-oemUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-awsUpgrade linux-image-raspiUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1022-gkeUpgrade linux-image-6.8.0-1023-ibmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1025-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1071-ibmUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-5.15.0-134-generic-lpaeUpgrade linux-image-gcp-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-azureUpgrade linux-image-5.15.0-1073-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-raspi-nolpaeUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.8.0-1027-gcpUpgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-6.8.0-1025-nvidia-lowlatency-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-5.15.0-1076-gkeUpgrade linux-image-6.11.0-1009-raspiUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-134-lowlatencyUpgrade linux-image-gkeop-6.8Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1026-azureUpgrade linux-image-6.11.0-1012-oracleUpgrade linux-image-azure-fdeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1025-nvidia-64kUpgrade linux-image-6.8.0-1023-oracleUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1025-nvidiaUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-kvmUpgrade linux-image-6.11.0-1010-awsUpgrade linux-image-5.15.0-134-genericUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-57-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-oem-24.04bUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.1-1019-realtimeUpgrade linux-image-6.8.0-1026-azure-fdeUpgrade linux-image-5.15.0-134-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1080-awsUpgrade linux-image-genericUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-5.15.0-1073-nvidiaUpgrade linux-image-6.11.0-1012-oracle-64kUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-oem-20.04dUpgrade linux-image-6.11.0-1006-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1082-azureUpgrade linux-image-6.8.0-1023-oracle-64kUpgrade linux-image-oem-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-5.15.0-1061-gkeopUpgrade linux-image-nvidia-tegraUpgrade linux-image-oem-20.04bUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-raspi-realtimeUpgrade linux-image-realtimeUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1026-awsUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-6.11.0-19-generic-64kUpgrade linux-image-6.11.0-1010-azureUpgrade linux-image-6.8.0-57-lowlatency-64kUpgrade linux-image-6.8.0-57-genericUpgrade linux-image-intelUpgrade linux-image-generic-64kUpgrade linux-image-virtualUpgrade linux-image-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-134-generic-64kUpgrade linux-image-6.11.0-1016-oemUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1027-gcp-64kUpgrade linux-image-6.11.0-1010-azure-fdeUpgrade linux-image-5.15.0-1079-awsUpgrade linux-image-5.15.0-1078-gcpUpgrade linux-image-5.15.0-1074-intel-iotgUpgrade linux-image-5.15.0-1073-nvidia-lowlatencyUpgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-intel-iotgUpgrade linux-image-6.11.0-19-genericUpgrade linux-image-5.15.0-1076-oracleUpgrade linux-image-nvidia-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-20.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-1082-azure-fdeUpgrade linux-image-oem-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-xilinx-zynqmp | Mar 6, 2025 | Dec 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 29, 2025 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub