In the Linux kernel, the following vulnerability has been resolved:
alloc_tag: allocate percpu counters for module tags dynamically
When a module gets unloaded it checks whether any of its tags are still in use and if so, we keep the memory containing module's allocation tags alive until all tags are unused. However percpu counters referenced by the tags are freed by free_module(). This will lead to UAF if the memory allocated by a module is accessed after module was unloaded.
To fix this we allocate percpu counters for module allocation tags dynamically and we keep it alive for tags which are still in use after module unloading. This also removes the requirement of a larger PERCPU_MODULE_RESERVE when memory allocation profiling is enabled because percpu memory for counters does not need to be reserved anymore.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-gcp-64kUpgrade linux-image-genericUpgrade linux-image-generic-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-raspiUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtual-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-gcpUpgrade linux-image-raspi-6.14Upgrade linux-image-azureUpgrade linux-image-6.14.0-1013-awsUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-realtime-6.14Upgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-azure-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-oracleUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-oem-6.14Upgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-oracle-6.14Upgrade linux-image-oem-24.04cUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-oem-24.04bUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-6.14.0-32-genericUpgrade linux-image-virtualUpgrade linux-image-6.14.0-1013-oracle | Jun 26, 2025 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub