In the Linux kernel, the following vulnerability has been resolved:
keys: Fix UAF in key_put()
Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after that point. The most key_put() is normally allowed to do is to touch key_gc_work as that's a static global variable.
However, in an effort to speed up the reclamation of quota, this is now done in key_put() once the key's usage is reduced to 0 - but now the code is looking at the key after the deadline, which is forbidden.
Fix this by using a flag to indicate that a key can be gc'd now rather than looking at the key's refcount in the garbage collector.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade python3-perf6.12Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade perf6.12Upgrade kernel6.12-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12Upgrade kernel-libbpfUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.12.22-27.96Upgrade kernel-libbpf-develUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade perf6.12-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-develUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-libbpf-debuginfo | Apr 15, 2025 | Mar 31, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perf | Jul 1, 2025 | Mar 31, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 10, 2025 | Mar 31, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 9, 2025 | Mar 31, 2025 |
| Rocky_linux | — | Upgrade kernel-tools-libsUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-uki-virt-addonsUpgrade python3-perf-debuginfoUpgrade rvUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade kernel-rt-kvmUpgrade kernel-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel-debugUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-modules-coreUpgrade kernel-tools-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-cross-headersUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade libperfUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade rtlaUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-rtUpgrade kernel-modulesUpgrade libperf-debuginfoUpgrade kernel-debug-develUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade python3-perfUpgrade perf-debuginfo | Oct 6, 2025 | Oct 3, 2025 |
| Suse | — | Upgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade kernel-obs-qaUpgrade kernel-source-azureUpgrade kernel-64kb-develUpgrade kernel-kvmsmallUpgrade kernel-symsUpgrade kernel-64kbUpgrade kernel-devel-azureUpgrade kernel-azure-vdsoUpgrade kernel-macrosUpgrade kernel-default-develUpgrade kernel-docsUpgrade kernel-azure-develUpgrade kernel-sourceUpgrade kernel-obs-buildUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade kernel-64kb-extraUpgrade kernel-source-vanillaUpgrade kernel-default-livepatchUpgrade kernel-default-base | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1024-oemUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-azureUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-generic-64kUpgrade linux-image-raspiUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-azure-6.11Upgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-oem-24.04bUpgrade linux-image-lowlatency-6.11Upgrade linux-image-oracleUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-oracle-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-virtualUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fde-edgeUpgrade linux-image-realtimeUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-azure-fde-6.11 | Jun 26, 2025 | Mar 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub