In the Linux kernel, the following vulnerability has been resolved:
alloc_tag: allocate percpu counters for module tags dynamically
When a module gets unloaded it checks whether any of its tags are still in use and if so, we keep the memory containing module's allocation tags alive until all tags are unused. However percpu counters referenced by the tags are freed by free_module(). This will lead to UAF if the memory allocated by a module is accessed after module was unloaded.
To fix this we allocate percpu counters for module allocation tags dynamically and we keep it alive for tags which are still in use after module unloading. This also removes the requirement of a larger PERCPU_MODULE_RESERVE when memory allocation profiling is enabled because percpu memory for counters does not need to be reserved anymore.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-azureUpgrade linux-image-oracle-64kUpgrade linux-image-genericUpgrade linux-image-realtime-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-6.14.0-1013-awsUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-aws-64kUpgrade linux-image-gcpUpgrade linux-image-oem-24.04aUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-virtual-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-generic-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-raspiUpgrade linux-image-aws-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-generic-64k-6.14Upgrade linux-image-realtimeUpgrade linux-image-oracleUpgrade linux-image-6.14.0-32-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1012-azureUpgrade linux-image-oem-6.14Upgrade linux-image-awsUpgrade linux-image-oem-24.04cUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-24.04 | Jun 26, 2025 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub