In the Linux kernel, the following vulnerability has been resolved:
crypto: zstd - fix double-free in per-CPU stream cleanup
The crypto/zstd module has a double-free bug that occurs when multiple tfms are allocated and freed.
The issue happens because zstd_streams (per-CPU contexts) are freed in zstd_exit() during every tfm destruction, rather than being managed at the module level. When multiple tfms exist, each tfm exit attempts to free the same shared per-CPU streams, resulting in a double-free.
This leads to a stack trace similar to:
BUG: Bad page state in process kworker/u16:1 pfn:106fd93 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106fd93 flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: nonzero entire_mapcount Modules linked in: ... CPU: 3 UID: 0 PID: 2506 Comm: kworker/u16:1 Kdump: loaded Tainted: G B Hardware name: ... Workqueue: btrfs-delalloc btrfs_work_helper Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 bad_page+0x71/0xd0 free_unref_page_prepare+0x24e/0x490 free_unref_page+0x60/0x170 crypto_acomp_free_streams+0x5d/0xc0 crypto_acomp_exit_tfm+0x23/0x50 crypto_destroy_tfm+0x60/0xc0 ...
Change the lifecycle management of zstd_streams to free the streams only once during module cleanup.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 16, 2025 |
| Ubuntu | — | Upgrade linux-image-azure-6.17Upgrade linux-image-6.17.0-1009-gcpUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-6.17.0-1008-realtimeUpgrade linux-image-aws-6.17Upgrade linux-image-6.17.0-19-genericUpgrade linux-image-genericUpgrade linux-image-generic-6.17Upgrade linux-image-virtualUpgrade linux-image-oracle-64k-6.17Upgrade linux-image-6.17.0-1009-gcp-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.17.0-19-generic-64kUpgrade linux-image-gcp-64k-6.17Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.17.0-1017-oemUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-realtime-6.17Upgrade linux-image-azureUpgrade linux-image-gcp-64kUpgrade linux-image-raspi-6.17Upgrade linux-image-oracleUpgrade linux-image-virtual-6.17Upgrade linux-image-gcpUpgrade linux-image-6.17.0-1009-oracleUpgrade linux-image-6.17.0-1009-aws-64kUpgrade linux-image-raspiUpgrade linux-image-oem-6.17Upgrade linux-image-oem-24.04cUpgrade linux-image-generic-64k-6.17Upgrade linux-image-aws-64k-6.17Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gcp-6.17Upgrade linux-image-6.17.0-1010-raspiUpgrade linux-image-oem-24.04aUpgrade linux-image-6.17.0-1010-azureUpgrade linux-image-6.17.0-1009-oracle-64kUpgrade linux-image-realtimeUpgrade linux-image-oem-24.04dUpgrade linux-image-6.17.0-1009-awsUpgrade linux-image-oracle-64kUpgrade linux-image-oracle-6.17Upgrade linux-image-aws-64kUpgrade linux-image-aws | Mar 17, 2026 | Dec 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub