In the Linux kernel, the following vulnerability has been resolved:
keys: Fix UAF in key_put()
Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after that point. The most key_put() is normally allowed to do is to touch key_gc_work as that's a static global variable.
However, in an effort to speed up the reclamation of quota, this is now done in key_put() once the key's usage is reduced to 0 - but now the code is looking at the key after the deadline, which is forbidden.
Fix this by using a flag to indicate that a key can be gc'd now rather than looking at the key's refcount in the garbage collector.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.12.22-27.96Upgrade perf6.12Upgrade python3-perf6.12Upgrade kernel-headersUpgrade kernel6.12-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel6.12-modules-extraUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade kernel6.12Upgrade kernel-libbpf-develUpgrade kernel-libbpf-debuginfoUpgrade kernel-develUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade perf6.12-debuginfo | Apr 15, 2025 | Mar 31, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jul 1, 2025 | Mar 31, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 10, 2025 | Mar 31, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Mar 31, 2025 |
| Rocky_linux | — | Upgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modulesUpgrade kernel-cross-headersUpgrade kernel-tools-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-develUpgrade kernel-rt-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-coreUpgrade kernel-debug-uki-virtUpgrade kernel-tools-libsUpgrade kernel-rt-debugUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debugUpgrade kernel-debug-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade rvUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-devel-matchedUpgrade libperfUpgrade kernel-headersUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-devel-matchedUpgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-kvmUpgrade perfUpgrade libperf-debuginfoUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-debuginfoUpgrade kernel-rtUpgrade kernel-rt-debuginfoUpgrade rtlaUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extra | Oct 6, 2025 | Oct 3, 2025 |
| Suse | — | Upgrade kernel-default-livepatchUpgrade reiserfs-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-develUpgrade kernel-default-vdsoUpgrade kernel-azure-extraUpgrade kernel-source-vanillaUpgrade kernel-docs-htmlUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-obs-buildUpgrade kernel-symsUpgrade kernel-default-develUpgrade kernel-64kb-develUpgrade kernel-source-azureUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade kernel-64kbUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade kernel-docsUpgrade kernel-azure-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade kernel-azure-devel | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade linux-image-lowlatencyUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-azure-fde-edgeUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-azure-fde-6.11Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-azure-6.11Upgrade linux-image-lowlatency-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-awsUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-oracleUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-realtimeUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-lowlatency-6.11Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-raspiUpgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-6.11.0-1015-aws | Jun 26, 2025 | Mar 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub