In the Linux kernel, the following vulnerability has been resolved:
keys: Fix UAF in key_put()
Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after that point. The most key_put() is normally allowed to do is to touch key_gc_work as that's a static global variable.
However, in an effort to speed up the reclamation of quota, this is now done in key_put() once the key's usage is reduced to 0 - but now the code is looking at the key after the deadline, which is forbidden.
Fix this by using a flag to indicate that a key can be gc'd now rather than looking at the key's refcount in the garbage collector.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-libbpfUpgrade kernel-livepatch-6.12.22-27.96Upgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade kernel6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade python3-perf6.12Upgrade perf6.12Upgrade kernel-libbpf-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel-toolsUpgrade kernel-libbpf-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-modules-extra-common | Apr 15, 2025 | Mar 31, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jul 1, 2025 | Mar 31, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 10, 2025 | Mar 31, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 9, 2025 | Mar 31, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-debug-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdump-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade rvUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modulesUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debugUpgrade kernel-debug-debuginfoUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-cross-headersUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade kernel-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-develUpgrade kernel-modules-coreUpgrade rtlaUpgrade kernel-rt-debuginfoUpgrade kernel-uki-virtUpgrade python3-perfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade perfUpgrade kernel-modulesUpgrade kernel-debuginfoUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade libperfUpgrade kernel-rt-coreUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade kernel-debug-devel-matchedUpgrade perf-debuginfo | Oct 6, 2025 | Oct 3, 2025 |
| Suse | — | Upgrade kernel-kvmsmall-vdsoUpgrade kernel-develUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-docs-htmlUpgrade kernel-source-vanillaUpgrade kernel-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-default-vdsoUpgrade kernel-azure-extraUpgrade kernel-default-baseUpgrade kernel-default-livepatchUpgrade kernel-devel-azureUpgrade kernel-azure-vdsoUpgrade kernel-syms-azureUpgrade kernel-default-extraUpgrade kernel-default-develUpgrade kernel-kvmsmallUpgrade kernel-zfcpdumpUpgrade kernel-64kb-develUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade kernel-azure-develUpgrade kernel-symsUpgrade kernel-64kbUpgrade kernel-macrosUpgrade kernel-docs | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-28-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-realtimeUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.11.0-1018-azureUpgrade linux-image-awsUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-azure-6.11Upgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-genericUpgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-lowlatency-6.11Upgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-azure-fde-edgeUpgrade linux-image-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-azure-fde-6.11Upgrade linux-image-azure-fdeUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-raspiUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-azureUpgrade linux-image-generic-64kUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.11.0-1017-oracle-64k | Jun 26, 2025 | Mar 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub