In the Linux kernel, the following vulnerability has been resolved:
keys: Fix UAF in key_put()
Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after that point. The most key_put() is normally allowed to do is to touch key_gc_work as that's a static global variable.
However, in an effort to speed up the reclamation of quota, this is now done in key_put() once the key's usage is reduced to 0 - but now the code is looking at the key after the deadline, which is forbidden.
Fix this by using a flag to indicate that a key can be gc'd now rather than looking at the key's refcount in the garbage collector.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftool-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade kernel-develUpgrade kernel-toolsUpgrade perf6.12-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-modules-extra-commonUpgrade kernel-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade python3-perf6.12Upgrade kernel6.12Upgrade kernel-libbpf-develUpgrade kernel-livepatch-6.12.22-27.96Upgrade kernel-libbpf-staticUpgrade kernel-headersUpgrade kernel-libbpfUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade perf6.12 | Apr 15, 2025 | Mar 31, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jul 1, 2025 | Mar 31, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 10, 2025 | Mar 31, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Mar 31, 2025 |
| Rocky_linux | — | Upgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-modules-extraUpgrade kernel-cross-headersUpgrade kernel-rt-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernelUpgrade kernel-rt-modules-coreUpgrade kernel-tools-debuginfoUpgrade kernel-rt-develUpgrade kernel-debug-modules-extraUpgrade rvUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-debug-uki-virtUpgrade kernel-debug-modulesUpgrade kernel-coreUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade rtlaUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-debuginfoUpgrade python3-perfUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-devel-matchedUpgrade kernel-rt-modulesUpgrade libperf-debuginfoUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade perfUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade libperfUpgrade kernel-rt-debuginfoUpgrade perf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-coreUpgrade kernel-headersUpgrade kernel-devel | Oct 6, 2025 | Oct 3, 2025 |
| Suse | — | Upgrade kernel-kvmsmall-vdsoUpgrade kernel-develUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-azureUpgrade kernel-docs-htmlUpgrade kernel-azure-extraUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-source-vanillaUpgrade kernel-default-vdsoUpgrade kernel-kvmsmallUpgrade kernel-syms-azureUpgrade kernel-azure-develUpgrade kernel-zfcpdumpUpgrade kernel-default-extraUpgrade kernel-64kb-develUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-docsUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade kernel-azure-vdsoUpgrade kernel-symsUpgrade kernel-default-develUpgrade kernel-devel-azureUpgrade kernel-macrosUpgrade kernel-64kb | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.11.0-1018-azureUpgrade linux-image-oracle-64kUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-virtualUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-6.11Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-azure-6.11Upgrade linux-image-azure-fde-edgeUpgrade linux-image-azure-fde-6.11Upgrade linux-image-gcpUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-oem-24.04bUpgrade linux-image-oracleUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-azureUpgrade linux-image-generic-64kUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-raspiUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-6.11.0-1024-oemUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azure-fde | Jun 26, 2025 | Mar 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub