In the Linux kernel, the following vulnerability has been resolved:
keys: Fix UAF in key_put()
Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after that point. The most key_put() is normally allowed to do is to touch key_gc_work as that's a static global variable.
However, in an effort to speed up the reclamation of quota, this is now done in key_put() once the key's usage is reduced to 0 - but now the code is looking at the key after the deadline, which is forbidden.
Fix this by using a flag to indicate that a key can be gc'd now rather than looking at the key's refcount in the garbage collector.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf6.12-debuginfoUpgrade kernel-toolsUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-modules-extra-commonUpgrade bpftoolUpgrade kernel-libbpf-debuginfoUpgrade kernel-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade kernel-headersUpgrade kernel-libbpfUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.12.22-27.96Upgrade python3-perf6.12-debuginfoUpgrade python3-perf6.12Upgrade perf6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfoUpgrade kernel-tools-debuginfo | Apr 15, 2025 | Mar 31, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jul 1, 2025 | Mar 31, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 10, 2025 | Mar 31, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Mar 31, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-coreUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-devel-matchedUpgrade rvUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-cross-headersUpgrade kernel-debugUpgrade kernel-debug-debuginfoUpgrade kernel-debuginfo-common-s390xUpgrade libperfUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-coreUpgrade rtlaUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade libperf-debuginfoUpgrade kernel-debug-develUpgrade perfUpgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade python3-perfUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-modules-coreUpgrade kernel-rtUpgrade perf-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rt-coreUpgrade kernel-devel | Oct 6, 2025 | Oct 3, 2025 |
| Suse | — | Upgrade kernel-default-livepatchUpgrade kernel-develUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-defaultUpgrade kernel-azureUpgrade kernel-default-vdsoUpgrade kernel-source-vanillaUpgrade kernel-azure-extraUpgrade kernel-docs-htmlUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-64kb-extraUpgrade kernel-obs-buildUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade kernel-symsUpgrade kernel-default-develUpgrade kernel-kvmsmall-develUpgrade kernel-macrosUpgrade kernel-sourceUpgrade kernel-obs-qaUpgrade kernel-source-azureUpgrade kernel-docsUpgrade kernel-azure-vdsoUpgrade kernel-azure-develUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-default-extraUpgrade kernel-zfcpdump | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade linux-image-lowlatency-6.11Upgrade linux-image-oracleUpgrade linux-image-genericUpgrade linux-image-oem-24.04bUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-azure-6.11Upgrade linux-image-azure-fde-edgeUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-azure-fde-6.11Upgrade linux-image-virtualUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-awsUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-lowlatency-64kUpgrade linux-image-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-28-genericUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-azureUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-6.11.0-1015-awsUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-raspiUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-generic-64kUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-6.11.0-1017-oracle-64k | Jun 26, 2025 | Mar 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub