In the Linux kernel, the following vulnerability has been resolved:
gtp: Destroy device along with udp socket's netns dismantle.
gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created.
Even when src_net is removed, the device stays alive on dev_net(dev). Then, removing src_net triggers the splat below. [0]
In this example, gtp0 is created in ns2, and the udp socket is created in ns1.
ip netns add ns1 ip netns add ns2 ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn ip netns del ns1
Let's link the device to the socket's netns instead.
Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove all gtp devices in the netns.
[0]: ref_tracker: net notrefcnt@000000003d6e7d05 has 1/2 users at sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236) inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1558) udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18) gtp_create_sock (./include/net/udp_tunnel.h:59 drivers/net/gtp.c:1423) gtp_create_sockets (drivers/net/gtp.c:1447) gtp_newlink (drivers/net/gtp.c:1507) rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012) rtnetlink_rcv_msg (net/core/rtnetlink.c:6922) netlink_rcv_skb (net/netlink/af_netlink.c:2542) netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347) netlink_sendmsg (net/netlink/af_netlink.c:1891) ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583) ___sys_sendmsg (net/socket.c:2639) __sys_sendmsg (net/socket.c:2669) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
WARNING: CPU: 1 PID: 60 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179) Modules linked in: CPU: 1 UID: 0 PID: 60 Comm: kworker/u16:2 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179) Code: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f> 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89 RSP: 0018:ff11000009a07b60 EFLAGS: 00010286 RAX: 0000000000002bd3 RBX: ff1100000f4e1aa0 RCX: 1ffffffff0e40ac6 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c RBP: ff1100000f4e1af0 R08: 0000000000000001 R09: fffffbfff0e395ae R10: 0000000000000001 R11: 0000000000036001 R12: ff1100000f4e1af0 R13: dead000000000100 R14: ff1100000f4e1af0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9b2464bd98 CR3: 0000000005286005 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn (kernel/panic.c:748) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:285) ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158) ? kfree (mm/slub.c:4613 mm/slub.c:4761) net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467) cleanup_net (net/core/net_namespace.c:664 (discriminator 3)) process_one_work (kernel/workqueue.c:3229) worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-livepatch-5.10.234-225.895Upgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.178-120.178Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernelUpgrade python-perfUpgrade kernel-debuginfoUpgrade bpftool-debuginfo | Mar 14, 2025 | Jan 31, 2025 |
| Amazon_linux_2023 | — | Upgrade python3-perfUpgrade kernel-develUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-headersUpgrade kernel-libbpfUpgrade kernel-tools-develUpgrade kernel-libbpf-staticUpgrade kernel-modules-extraUpgrade kernel-livepatch-6.1.127-135.201Upgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade bpftoolUpgrade perfUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64 | Mar 27, 2025 | Jan 31, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Feb 10, 2025 | Jan 31, 2025 |
| Suse | — | Upgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade gfs2-kmp-azureUpgrade kernel-debug-develUpgrade kselftests-kmp-azureUpgrade dtb-caviumUpgrade dtb-exynosUpgrade dtb-freescaleUpgrade kernel-rtUpgrade kernel-docs-htmlUpgrade dtb-qcomUpgrade kernel-syms-azureUpgrade kernel-default-livepatchUpgrade dlm-kmp-64kbUpgrade dtb-hisiliconUpgrade gfs2-kmp-64kbUpgrade kernel-azure-develUpgrade dtb-amlogicUpgrade kernel-symsUpgrade reiserfs-kmp-64kbUpgrade kernel-source-rtUpgrade dtb-alteraUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmallUpgrade dtb-amazonUpgrade kernel-macrosUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade dtb-marvellUpgrade kernel-64kb-develUpgrade dtb-appleUpgrade dtb-apmUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-rtUpgrade kernel-develUpgrade kernel-debugUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade kernel-obs-qaUpgrade dtb-lgUpgrade kernel-source-azureUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-extraUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-develUpgrade kernel-rt-optionalUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade dtb-broadcomUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade dtb-armUpgrade dtb-mediatekUpgrade dlm-kmp-rtUpgrade dtb-amdUpgrade dtb-xilinxUpgrade reiserfs-kmp-azureUpgrade dtb-sprdUpgrade kernel-azure-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-source-vanillaUpgrade kernel-docsUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-manUpgrade kernel-rt-develUpgrade dtb-nvidiaUpgrade kselftests-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade dtb-socionextUpgrade kselftests-kmp-rtUpgrade kernel-default-baseUpgrade kernel-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-extraUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade reiserfs-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade kernel-devel-rtUpgrade kernel-debug-vdsoUpgrade kernel-default-livepatch-develUpgrade dtb-renesasUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-devel | Feb 12, 2025 | Jan 31, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1030-azureUpgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-oem-osp1Upgrade linux-image-oem-20.04bUpgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-aws-64kUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-gkeopUpgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-azure-lts-20.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1030-azure-fdeUpgrade linux-image-6.8.0-62-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-6.8.0-64-genericUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-genericUpgrade linux-image-6.11.0-1014-oracleUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-6.11.0-1020-oemUpgrade linux-image-6.8.0-1027-ibmUpgrade linux-image-5.15.0-135-genericUpgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-6.8.0-1029-nvidia-64kUpgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-oem-24.04bUpgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-aws-fipsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-62-lowlatency-64kUpgrade linux-image-fipsUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-20.04Upgrade linux-image-6.8.1-1023-realtimeUpgrade linux-image-gcp-fipsUpgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-6.8.0-1029-nvidia-lowlatency-64kUpgrade linux-image-6.11.0-1008-realtimeUpgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-oemUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-raspiUpgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-5.15.0-136-genericUpgrade linux-image-5.15.0-1080-awsUpgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-gkeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-nvidia-tegraUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-62-genericUpgrade linux-image-intelUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-6.8.0-1030-aws-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1013-gkeopUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.15.0-1086-azureUpgrade linux-image-nvidiaUpgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-azureUpgrade linux-image-azure-lts-24.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1084-azureUpgrade linux-image-6.8.0-1029-nvidiaUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-6.8.0-1031-gcpUpgrade linux-image-6.11.0-1012-lowlatency-64kUpgrade linux-image-gke-5.15Upgrade linux-image-azure-lts-22.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.15.0-136-generic-64kUpgrade linux-image-oracleUpgrade linux-image-6.11.0-24-generic-64kUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-azure-fdeUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-oem-24.04aUpgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-6.8.0-1027-oracle-64kUpgrade linux-image-6.11.0-1013-azureUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-fipsUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-6.8.0-1029-oemUpgrade linux-image-awsUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-1018-azure-nvidiaUpgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1029-raspiUpgrade linux-image-6.11.0-1012-awsUpgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-raspi2Upgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.11.0-1014-oracle-64kUpgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-gkeop-5.15Upgrade linux-image-gcpUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-2024-raspi-realtimeUpgrade linux-image-6.11.0-1011-raspiUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-kvmUpgrade linux-image-6.8.0-62-lowlatencyUpgrade linux-image-6.11.0-1013-gcpUpgrade linux-image-6.11.0-1013-azure-fdeUpgrade linux-image-6.8.0-1030-awsUpgrade linux-image-bluefieldUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-1031-gcp-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-6.11.0-1012-lowlatencyUpgrade linux-image-5.15.0-135-fipsUpgrade linux-image-generic-6.8Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-aws-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-6.8.0-1027-oracleUpgrade linux-image-6.8.0-1029-nvidia-lowlatencyUpgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-nvidia-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azure-cvmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-20.04dUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1026-gkeUpgrade linux-image-6.11.0-24-genericUpgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-6.11.0-1013-gcp-64k | Mar 28, 2025 | Jan 31, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub