In the Linux kernel, the following vulnerability has been resolved:
xfrm: interface: fix use-after-free after changing collect_md xfrm interface
collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.
The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.
Calling changelink would thus errornously place the special interface xi in the xfrmi_net->xfrmi hash, but since it also exists in the xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when the net namespace was taken down [1].
Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.
[1] resulting oops: [ 8.516540] kernel BUG at net/core/dev.c:12029! [ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary) [ 8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 8.516569] Workqueue: netns cleanup_net [ 8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0 [ 8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24 [ 8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206 [ 8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60 [ 8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122 [ 8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100 [ 8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00 [ 8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00 [ 8.516615] FS: 0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000 [ 8.516619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0 [ 8.516625] PKRU: 55555554 [ 8.516627] Call Trace: [ 8.516632] <TASK> [ 8.516635] ? rtnl_is_locked+0x15/0x20 [ 8.516641] ? unregister_netdevice_queue+0x29/0xf0 [ 8.516650] ops_undo_list+0x1f2/0x220 [ 8.516659] cleanup_net+0x1ad/0x2e0 [ 8.516664] process_one_work+0x160/0x380 [ 8.516673] worker_thread+0x2aa/0x3c0 [ 8.516679] ? __pfx_worker_thread+0x10/0x10 [ 8.516686] kthread+0xfb/0x200 [ 8.516690] ? __pfx_kthread+0x10/0x10 [ 8.516693] ? __pfx_kthread+0x10/0x10 [ 8.516697] ret_from_fork+0x82/0xf0 [ 8.516705] ? __pfx_kthread+0x10/0x10 [ 8.516709] ret_from_fork_asm+0x1a/0x30 [ 8.516718] </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-debug-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-develUpgrade kernel-debug-uki-virtUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-modulesUpgrade rtlaUpgrade kernel-64k-modules-extraUpgrade kernel-modules-extraUpgrade kernel-cross-headersUpgrade kernel-rt-develUpgrade kernel-rt-kvmUpgrade kernel-rt-debugUpgrade kernel-rt-modules-extraUpgrade kernel-64k-develUpgrade kernel-modules-coreUpgrade kernel-rt-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-coreUpgrade kernelUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-develUpgrade python3-perfUpgrade perfUpgrade kernel-rt-64k-develUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade libperfUpgrade kernel-64k-modulesUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-headersUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade rvUpgrade kernel-rt-64kUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-64k-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-tools-libs-develUpgrade kernel-rt-64k-debug-coreUpgrade kernel-docUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-uki-virtUpgrade kernel-rt-modules-coreUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-64kUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debugUpgrade kernel-rt-64k-debugUpgrade kernel-modules | Sep 30, 2025 | Sep 2, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-modules-extraUpgrade kernel6.12-develUpgrade perf6.12Upgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel6.12Upgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade kernel6.12-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel6.12-headersUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-6.1.148-173.267Upgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel6.12-modules-extraUpgrade python3-perfUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-livepatch-6.12.46-66.121Upgrade perfUpgrade python3-perf6.12Upgrade perf-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-tools-develUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-toolsUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-libbpf-debuginfoUpgrade kernel-develUpgrade kernel6.12-tools-debuginfoUpgrade kernel-tools-develUpgrade perf6.12-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-libbpfUpgrade bpftool6.12-debuginfo | Sep 9, 2025 | Aug 12, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Sep 8, 2025 | Sep 8, 2025 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Sep 4, 2025 | Aug 12, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Sep 3, 2025 | Aug 12, 2025 |
| Rocky_linux | — | Upgrade rvUpgrade kernel-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-toolsUpgrade kernel-zfcpdump-modules-coreUpgrade libperfUpgrade kernelUpgrade python3-perfUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-zfcpdump-develUpgrade kernel-develUpgrade kernel-rt-modules-coreUpgrade kernel-rt-coreUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-modules-coreUpgrade kernel-debug-coreUpgrade kernel-modulesUpgrade rtlaUpgrade kernel-modules-extraUpgrade python3-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-tools-libsUpgrade kernel-rt-debugUpgrade kernel-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-debug-uki-virt | Feb 5, 2026 | Oct 10, 2025 |
| Suse | — | Upgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-rtUpgrade dlm-kmp-64kbUpgrade dtb-alteraUpgrade kernel-kvmsmallUpgrade kernel-azure-develUpgrade kselftests-kmp-64kbUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade kernel-rtUpgrade kernel-source-vanillaUpgrade kernel-rt_debugUpgrade dtb-lgUpgrade kernel-azure-vdsoUpgrade kernel-obs-buildUpgrade kernel-default-livepatchUpgrade kernel-source-azureUpgrade dtb-nvidiaUpgrade reiserfs-kmp-rtUpgrade kernel-azureUpgrade kernel-default-base-rebuildUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-rt-extraUpgrade dtb-sprdUpgrade kernel-azure-extraUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-source-rtUpgrade dtb-marvellUpgrade dlm-kmp-rtUpgrade kernel-syms-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-vdsoUpgrade dtb-amazonUpgrade gfs2-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-develUpgrade dtb-appleUpgrade kernel-azure-optionalUpgrade kernel-syms-rtUpgrade gfs2-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-64kbUpgrade dtb-socionextUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade reiserfs-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-obs-qaUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-default-vdsoUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade kernel-kvmsmall-develUpgrade kernel-default-extraUpgrade kernel-default-optionalUpgrade dtb-apmUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-develUpgrade kernel-defaultUpgrade dtb-renesasUpgrade dtb-armUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade kernel-docsUpgrade kernel-debugUpgrade kernel-default-livepatch-develUpgrade dtb-xilinxUpgrade dtb-exynosUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade dtb-amdUpgrade gfs2-kmp-rtUpgrade dtb-hisiliconUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-sourceUpgrade kernel-devel-rtUpgrade dtb-caviumUpgrade cluster-md-kmp-defaultUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-azureUpgrade kernel-rt-livepatch | Dec 5, 2025 | Sep 5, 2025 |
| Ubuntu | — | Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1024-gkeopUpgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oracle-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-aws-64k-6.14Upgrade linux-image-generic-6.8Upgrade linux-image-raspi-6.14Upgrade linux-image-azure-fdeUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-ibm-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-raspiUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtual-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1040-nvidiaUpgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azure-fde-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-85-lowlatencyUpgrade linux-image-awsUpgrade linux-image-gcp-6.14Upgrade linux-image-6.8.0-1037-gkeUpgrade linux-image-oem-24.04aUpgrade linux-image-aws-64kUpgrade linux-image-aws-6.14Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1040-azure-fdeUpgrade linux-image-aws-64k-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-kvmUpgrade linux-image-oem-24.04cUpgrade linux-image-6.8.0-1038-ibmUpgrade linux-image-6.8.0-1040-raspiUpgrade linux-image-raspi-realtimeUpgrade linux-image-gcpUpgrade linux-image-virtual-6.14Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.14.0-1013-realtimeUpgrade linux-image-6.14.0-1017-gcpUpgrade linux-image-azureUpgrade linux-image-generic-64k-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1040-nvidia-lowlatencyUpgrade linux-image-realtime-6.14Upgrade linux-image-6.8.0-1041-gcpUpgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-lts-24.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gke-6.8Upgrade linux-image-generic-6.14Upgrade linux-image-6.8.1-1035-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1040-nvidia-64kUpgrade linux-image-6.8.0-85-genericUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1013-azureUpgrade linux-image-6.8.0-1040-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-gke-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-azure-6.14Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-oem-6.14Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-nvidiaUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-85-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracle-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-33-generic-64kUpgrade linux-image-6.8.0-1040-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1017-gcp-64kUpgrade linux-image-oem-22.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-6.8.0-1037-gke-64kUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.14.0-1015-raspiUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gkeUpgrade linux-image-ibmUpgrade linux-image-oem-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.14.0-1014-oracle-64kUpgrade linux-image-6.14.0-1014-aws-64kUpgrade linux-image-6.8.0-1041-gcp-64kUpgrade linux-image-6.14.0-1014-oracleUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1014-awsUpgrade linux-image-6.8.0-1040-azureUpgrade linux-image-6.14.0-33-genericUpgrade linux-image-6.14.0-1013-oemUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-1040-aws-64kUpgrade linux-image-generic | Oct 2, 2025 | Aug 12, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 3, 2025 | Aug 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub