In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix use-after-free when rename device name
Syzbot reported a slab-use-after-free with the following call trace:
================================================================== BUG: KASAN: slab-use-after-free in nla_put+0xd3/0x150 lib/nlattr.c:1099 Read of size 5 at addr ffff888140ea1c60 by task syz.0.988/10025
CPU: 0 UID: 0 PID: 10025 Comm: syz.0.988 Not tainted 6.14.0-rc4-syzkaller-00859-gf77f12010f67 #0 Hardware name: Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x16e/0x5b0 mm/kasan/report.c:521 kasan_report+0x143/0x180 mm/kasan/report.c:634 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 nla_put+0xd3/0x150 lib/nlattr.c:1099 nla_put_string include/net/netlink.h:1621 [inline] fill_nldev_handle+0x16e/0x200 drivers/infiniband/core/nldev.c:265 rdma_nl_notify_event+0x561/0xef0 drivers/infiniband/core/nldev.c:2857 ib_device_notify_register+0x22/0x230 drivers/infiniband/core/device.c:1344 ib_register_device+0x1292/0x1460 drivers/infiniband/core/device.c:1460 rxe_register_device+0x233/0x350 drivers/infiniband/sw/rxe/rxe_verbs.c:1540 rxe_net_add+0x74/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:550 rxe_newlink+0xde/0x1a0 drivers/infiniband/sw/rxe/rxe.c:212 nldev_newlink+0x5ea/0x680 drivers/infiniband/core/nldev.c:1795 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x6dd/0x9e0 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:709 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:724 ____sys_sendmsg+0x53a/0x860 net/socket.c:2564 ___sys_sendmsg net/socket.c:2618 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2650 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f42d1b8d169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 ... RSP: 002b:00007f42d2960038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f42d1da6320 RCX: 00007f42d1b8d169 RDX: 0000000000000000 RSI: 00004000000002c0 RDI: 000000000000000c RBP: 00007f42d1c0e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f42d1da6320 R15: 00007ffe399344a8 </TASK>
Allocated by task 10025: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4294 [inline] __kmalloc_node_track_caller_noprof+0x28b/0x4c0 mm/slub.c:4313 __kmemdup_nul mm/util.c:61 [inline] kstrdup+0x42/0x100 mm/util.c:81 kobject_set_name_vargs+0x61/0x120 lib/kobject.c:274 dev_set_name+0xd5/0x120 drivers/base/core.c:3468 assign_name drivers/infiniband/core/device.c:1202 [inline] ib_register_device+0x178/0x1460 drivers/infiniband/core/device.c:1384 rxe_register_device+0x233/0x350 drivers/infiniband/sw/rxe/rxe_verbs.c:1540 rxe_net_add+0x74/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:550 rxe_newlink+0xde/0x1a0 drivers/infiniband/sw/rxe/rxe.c:212 nldev_newlink+0x5ea/0x680 drivers/infiniband/core/nldev.c:1795 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x6dd/0x9e0 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8de/0xcb0 net ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-cross-headersUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade kernel-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-tools-libs-develUpgrade libperfUpgrade kernel-rt-64k-modulesUpgrade kernel-develUpgrade kernel-rt-64k-debug-develUpgrade kernel-headersUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-debug-develUpgrade kernelUpgrade perfUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-develUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64kUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-debugUpgrade rtlaUpgrade kernel-rt-coreUpgrade kernel-uki-virtUpgrade rvUpgrade kernel-tools-libsUpgrade kernel-rt-64kUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debugUpgrade kernel-64k-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade kernel-uki-virt-addonsUpgrade kernel-abi-stablelistsUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-docUpgrade kernel-rt-64k-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-rtUpgrade kernel-debug-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-64k-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-core | Aug 4, 2025 | Jul 28, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpfUpgrade python3-perf6.12Upgrade kernel-tools-develUpgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel6.12-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-libbpf-develUpgrade kernel-modules-extra-commonUpgrade kernel6.12Upgrade perf6.12Upgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.12.23-29.97 | Jun 11, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel | Jul 31, 2025 | Apr 16, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Apr 16, 2025 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libs-develUpgrade rvUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-debug-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade kernel-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-uki-virt-addonsUpgrade kernel-modulesUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-kvmUpgrade libperf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modulesUpgrade kernel-modules-coreUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-rt-debug-kvmUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-cross-headersUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-debug-uki-virtUpgrade kernel-debug-coreUpgrade kernelUpgrade kernel-rt-debugUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debugUpgrade kernel-coreUpgrade kernel-debuginfoUpgrade kernel-rt-coreUpgrade kernel-headersUpgrade rtlaUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade libperfUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-devel | Feb 5, 2026 | Oct 4, 2025 |
| Suse | — | Upgrade kernel-default-vdsoUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-defaultUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade kernel-default-baseUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade kernel-develUpgrade kernel-obs-qaUpgrade kernel-syms-azureUpgrade kernel-source-vanillaUpgrade kernel-docsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade kernel-source-azureUpgrade kernel-macrosUpgrade kernel-obs-buildUpgrade kernel-azure-develUpgrade kernel-devel-azureUpgrade kernel-sourceUpgrade kernel-default-extraUpgrade kernel-azure-extraUpgrade kernel-azure-vdsoUpgrade kernel-default-livepatchUpgrade kernel-azureUpgrade kernel-kvmsmall | Dec 5, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-oracleUpgrade linux-image-realtimeUpgrade linux-image-awsUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-oracle-64kUpgrade linux-image-raspiUpgrade linux-image-azureUpgrade linux-image-genericUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-gcpUpgrade linux-image-gcp-64kUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-22-generic-64k | Jun 26, 2025 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub