In the Linux kernel, the following vulnerability has been resolved:
xfrm: interface: fix use-after-free after changing collect_md xfrm interface
collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.
The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.
Calling changelink would thus errornously place the special interface xi in the xfrmi_net->xfrmi hash, but since it also exists in the xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when the net namespace was taken down [1].
Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.
[1] resulting oops: [ 8.516540] kernel BUG at net/core/dev.c:12029! [ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary) [ 8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 8.516569] Workqueue: netns cleanup_net [ 8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0 [ 8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24 [ 8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206 [ 8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60 [ 8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122 [ 8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100 [ 8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00 [ 8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00 [ 8.516615] FS: 0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000 [ 8.516619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0 [ 8.516625] PKRU: 55555554 [ 8.516627] Call Trace: [ 8.516632] <TASK> [ 8.516635] ? rtnl_is_locked+0x15/0x20 [ 8.516641] ? unregister_netdevice_queue+0x29/0xf0 [ 8.516650] ops_undo_list+0x1f2/0x220 [ 8.516659] cleanup_net+0x1ad/0x2e0 [ 8.516664] process_one_work+0x160/0x380 [ 8.516673] worker_thread+0x2aa/0x3c0 [ 8.516679] ? __pfx_worker_thread+0x10/0x10 [ 8.516686] kthread+0xfb/0x200 [ 8.516690] ? __pfx_kthread+0x10/0x10 [ 8.516693] ? __pfx_kthread+0x10/0x10 [ 8.516697] ret_from_fork+0x82/0xf0 [ 8.516705] ? __pfx_kthread+0x10/0x10 [ 8.516709] ret_from_fork_asm+0x1a/0x30 [ 8.516718] </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-kvmUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-modules-extraUpgrade rtlaUpgrade kernel-develUpgrade kernel-64k-modules-extraUpgrade kernel-coreUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-modulesUpgrade kernel-modules-coreUpgrade kernelUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-debugUpgrade perfUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-rt-64k-develUpgrade kernel-cross-headersUpgrade kernel-64k-develUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-develUpgrade kernel-debug-coreUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-debug-develUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rtUpgrade kernel-rt-64k-debugUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-modulesUpgrade kernel-uki-virtUpgrade kernel-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-headersUpgrade kernel-rt-64k-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-tools-libs-develUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debugUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-modules-extraUpgrade libperfUpgrade kernel-rt-64k-debug-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-debug-coreUpgrade rvUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-64k-coreUpgrade kernel-64kUpgrade kernel-rt-64kUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-extra | Sep 30, 2025 | Sep 2, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfoUpgrade kernel6.12-headersUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-x86_64Upgrade perf6.12Upgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel6.12Upgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel6.12-develUpgrade kernel-libbpf-develUpgrade kernel-libbpfUpgrade kernelUpgrade kernel-modules-extraUpgrade kernel-livepatch-6.1.148-173.267Upgrade bpftool6.12-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-tools-develUpgrade kernel6.12-toolsUpgrade kernel6.12-modules-extraUpgrade kernel6.12-libbpfUpgrade kernel-libbpf-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel-headersUpgrade bpftool6.12Upgrade kernel6.12-libbpf-develUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-tools-develUpgrade kernel-livepatch-6.12.46-66.121Upgrade perfUpgrade python3-perf6.12Upgrade perf-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade kernel-develUpgrade perf6.12-debuginfo | Sep 9, 2025 | Aug 12, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Sep 8, 2025 | Sep 8, 2025 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Sep 4, 2025 | Aug 12, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Sep 3, 2025 | Aug 12, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modules-coreUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-modules-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-develUpgrade kernel-coreUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade kernel-rt-modulesUpgrade python3-perf-debuginfoUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade kernel-rt-modules-coreUpgrade kernel-tools-debuginfoUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade rtlaUpgrade kernel-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-coreUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-devel-matchedUpgrade rvUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade libperfUpgrade kernelUpgrade kernel-rtUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade libperf-debuginfoUpgrade python3-perfUpgrade perfUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-debuginfo | Feb 5, 2026 | Oct 10, 2025 |
| Suse | — | Upgrade kernel-develUpgrade dtb-apmUpgrade kernel-debugUpgrade kernel-defaultUpgrade dtb-renesasUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatch-develUpgrade dtb-armUpgrade kernel-docsUpgrade kernel-zfcpdumpUpgrade dtb-caviumUpgrade kernel-devel-rtUpgrade kernel-sourceUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-defaultUpgrade dtb-xilinxUpgrade gfs2-kmp-rtUpgrade dtb-amdUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade reiserfs-kmp-azureUpgrade dtb-exynosUpgrade gfs2-kmp-64kbUpgrade kernel-default-extraUpgrade dtb-hisiliconUpgrade kernel-rt-livepatchUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade dtb-rockchipUpgrade kernel-kvmsmall-develUpgrade kernel-default-optionalUpgrade ocfs2-kmp-defaultUpgrade dtb-mediatekUpgrade reiserfs-kmp-defaultUpgrade kernel-default-vdsoUpgrade dtb-qcomUpgrade kernel-obs-qaUpgrade ocfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-default-baseUpgrade kernel-source-rtUpgrade kernel-rt-optionalUpgrade dtb-lgUpgrade kernel-source-vanillaUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade kernel-default-livepatchUpgrade dtb-appleUpgrade dtb-amazonUpgrade kernel-64kbUpgrade gfs2-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-rt_debug-vdsoUpgrade kernel-azureUpgrade kernel-source-azureUpgrade reiserfs-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-default-develUpgrade gfs2-kmp-defaultUpgrade dtb-marvellUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-base-rebuildUpgrade dtb-broadcomUpgrade kernel-azure-vdsoUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-extraUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade dtb-freescaleUpgrade kernel-macrosUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-syms-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-rtUpgrade dtb-nvidiaUpgrade dtb-amlogicUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmallUpgrade dtb-socionext | Dec 5, 2025 | Sep 5, 2025 |
| Ubuntu | — | Upgrade linux-image-generic-64k-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-gcpUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1040-nvidia-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-85-genericUpgrade linux-image-virtual-6.14Upgrade linux-image-oem-24.04aUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1038-ibmUpgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1013-realtimeUpgrade linux-image-azureUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-85-lowlatencyUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-aws-64k-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-1040-nvidia-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-realtime-6.14Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-oem-24.04cUpgrade linux-image-6.8.0-1040-raspiUpgrade linux-image-raspi-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1040-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-oracle-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-6.8.0-1041-gcpUpgrade linux-image-6.8.1-1035-realtimeUpgrade linux-image-6.8.0-1037-gkeUpgrade linux-image-oracle-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.14.0-1017-gcpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-aws-64kUpgrade linux-image-azure-6.8Upgrade linux-image-azure-fde-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1040-nvidiaUpgrade linux-image-aws-6.8Upgrade linux-image-gcp-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1024-gkeopUpgrade linux-image-aws-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1040-azureUpgrade linux-image-6.14.0-33-genericUpgrade linux-image-6.14.0-1014-oracleUpgrade linux-image-oem-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1015-raspiUpgrade linux-image-6.14.0-1014-oracle-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-gke-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-azure-6.14Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-ibmUpgrade linux-image-6.8.0-85-lowlatency-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.14.0-1017-gcp-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.14.0-33-generic-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-lowlatency-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-gkeUpgrade linux-image-generic-64k-6.14Upgrade linux-image-6.8.0-1040-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1037-gke-64kUpgrade linux-image-azure-nvidiaUpgrade linux-image-oem-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidiaUpgrade linux-image-6.14.0-1014-aws-64kUpgrade linux-image-6.8.0-1041-gcp-64kUpgrade linux-image-6.14.0-1013-azureUpgrade linux-image-oem-24.04bUpgrade linux-image-genericUpgrade linux-image-6.8.0-1040-aws-64kUpgrade linux-image-6.8.0-1040-awsUpgrade linux-image-generic-64kUpgrade linux-image-oem-6.14Upgrade linux-image-virtualUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.14.0-1014-awsUpgrade linux-image-6.14.0-1013-oemUpgrade linux-image-oracle | Oct 2, 2025 | Aug 12, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 3, 2025 | Aug 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub