In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not change while the driver periodically traverses it in order to update the kernel about multicast route stats that were queried from the device.
One instance of list entry deletion (during route replace) was missed and it can result in a use-after-free [1].
Fix by acquiring the mutex before deleting the entry from the list and releasing it afterwards.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] Read of size 8 at addr ffff8881523c2fa8 by task kworker/2:5/22043
CPU: 2 UID: 0 PID: 22043 Comm: kworker/2:5 Not tainted 6.18.0-rc1-custom-g1a3d6d7cd014 #1 PREEMPT(full) Hardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017 Workqueue: mlxsw_core mlxsw_sp_mr_stats_update [mlxsw_spectrum] Call Trace: <TASK> dump_stack_lvl+0xba/0x110 print_report+0x174/0x4f5 kasan_report+0xdf/0x110 mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 mlxsw_sp_mr_route_add+0xd8/0x4770 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30
Freed by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x43/0x70 kfree+0x14e/0x700 mlxsw_sp_mr_route_add+0x2dea/0x4770 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:444 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-uki-virtUpgrade libperfUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-64k-debug-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-uki-virt-addonsUpgrade kernel-headersUpgrade kernel-rt-64kUpgrade kernel-rt-64k-modulesUpgrade python3-perfUpgrade kernel-64k-coreUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-docUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-extraUpgrade rvUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade perfUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-debugUpgrade kernel-rt-64k-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-develUpgrade kernel-rt-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-64k-develUpgrade kernelUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-rt-64k-coreUpgrade kernel-coreUpgrade kernel-64k-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debugUpgrade kernel-64k-debug-coreUpgrade rtlaUpgrade kernel-debug-coreUpgrade kernel-64kUpgrade kernel-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-debug-develUpgrade kernel-64k-modules-extraUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-cross-headers | Feb 25, 2026 | Feb 23, 2026 |
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.248-247.988Upgrade bpftool-debuginfoUpgrade kernel-develUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-tools | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Feb 11, 2026 | Feb 11, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libs | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade kernel | Feb 26, 2026 | Jan 13, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Feb 26, 2026 | Jan 13, 2026 |
| Rocky_linux | — | Upgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-rtUpgrade kernel-rt-debugUpgrade kernel-uki-virtUpgrade kernel-uki-virt-addonsUpgrade rvUpgrade python3-perf-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-toolsUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-coreUpgrade python3-perfUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debugUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernelUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade libperfUpgrade kernel-debug-devel-matchedUpgrade kernel-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modules-coreUpgrade kernel-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade rtlaUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade kernel-devel-matchedUpgrade libperf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-debuginfo | Mar 31, 2026 | Mar 26, 2026 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-oracle-64k-6.17Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-5.15Upgrade linux-image-5.15.0-1099-gkeUpgrade linux-image-aws-64k-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1051-nvidia-lowlatency-64kUpgrade linux-image-oracle-64kUpgrade linux-image-azureUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-oem-22.04dUpgrade linux-image-gke-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1103-gcp-fipsUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-2042-raspi-realtimeUpgrade linux-image-5.15.0-173-lowlatency-64kUpgrade linux-image-aws-fips-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1052-raspiUpgrade linux-image-6.17.0-1012-gcpUpgrade linux-image-azure-fipsUpgrade linux-image-nvidia-6.8Upgrade linux-image-intelUpgrade linux-image-6.17.0-22-generic-64kUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-gkeUpgrade linux-image-aws-5.15Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-110-fipsUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-raspi-5.15Upgrade linux-image-5.15.0-1102-realtimeUpgrade linux-image-gke-64kUpgrade linux-image-5.15.0-1098-nvidia-lowlatencyUpgrade linux-image-aws-64k-6.17Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.17.0-1010-realtimeUpgrade linux-image-6.17.0-1011-oracleUpgrade linux-image-6.17.0-22-genericUpgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-5.15.0-1086-gkeopUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-5.15.0-1103-gcpUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.1-1047-realtimeUpgrade linux-image-oracle-6.8Upgrade linux-image-realtime-6.17Upgrade linux-image-virtual-5.15Upgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1054-azureUpgrade linux-image-6.8.0-1054-gcp-fipsUpgrade linux-image-gcp-5.15Upgrade linux-image-gcp-64k-6.17Upgrade linux-image-oem-20.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.17.0-1012-aws-64kUpgrade linux-image-kvmUpgrade linux-image-raspi-6.17Upgrade linux-image-oem-22.04bUpgrade linux-image-raspi-6.8Upgrade linux-image-5.15.0-1110-azureUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-1094-intel-iot-realtimeUpgrade linux-image-6.17.0-1013-azureUpgrade linux-image-6.8.0-1054-gcpUpgrade linux-image-6.8.0-1054-azure-fipsUpgrade linux-image-6.8.0-110-lowlatencyUpgrade linux-image-awsUpgrade linux-image-6.8.0-1054-gcp-64kUpgrade linux-image-5.15.0-1109-azure-fipsUpgrade linux-image-generic-64k-6.17Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oem-24.04dUpgrade linux-image-virtual-6.17Upgrade linux-image-oem-22.04cUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-5.15Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-6.17.0-1014-raspiUpgrade linux-image-6.8.0-1051-ibmUpgrade linux-image-5.15.0-173-genericUpgrade linux-image-6.8.0-110-lowlatency-64kUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-110-generic-64kUpgrade linux-image-realtime-5.15Upgrade linux-image-ibm-5.15Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1037-gkeopUpgrade linux-image-oem-24.04cUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-raspiUpgrade linux-image-gcp-6.17Upgrade linux-image-generic-64k-5.15Upgrade linux-image-5.15.0-1067-xilinx-zynqmpUpgrade linux-image-6.8.0-1052-awsUpgrade linux-image-aws-fips-5.15Upgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1103-aws-64kUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-xilinx-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-intel-iotgUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-lowlatency-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-6.17Upgrade linux-image-oracle-5.15Upgrade linux-image-oem-20.04dUpgrade linux-image-realtimeUpgrade linux-image-5.15.0-1098-intel-iotgUpgrade linux-image-oem-20.04cUpgrade linux-image-generic-64kUpgrade linux-image-fipsUpgrade linux-image-oem-20.04bUpgrade linux-image-generic-6.17Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-azure-fips-5.15Upgrade linux-image-azure-6.17Upgrade linux-image-aws-fipsUpgrade linux-image-6.17.0-1011-oracle-64kUpgrade linux-image-aws-6.17Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-ibmUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-5.15.0-1103-aws-fipsUpgrade linux-image-gke-5.15Upgrade linux-image-aws-64kUpgrade linux-image-nvidia-tegraUpgrade linux-image-virtualUpgrade linux-image-gcpUpgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1051-nvidia-64kUpgrade linux-image-5.15.0-173-lowlatencyUpgrade linux-image-5.15.0-1055-nvidia-tegraUpgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-6.8Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1022-nvidia-tegra-rtUpgrade linux-image-kvm-5.15Upgrade linux-image-oracle-6.17Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.17.0-1012-awsUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.8.0-1059-azureUpgrade linux-image-6.8.0-1052-aws-fipsUpgrade linux-image-6.8.0-1051-nvidiaUpgrade linux-image-5.15.0-173-generic-lpaeUpgrade linux-image-6.17.0-1012-gcp-64kUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.0-1052-aws-64kUpgrade linux-image-oem-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-6.17.0-1020-oemUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-ibm-classicUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-5.15.0-1044-nvidia-tegra-igx-rtUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1050-gkeUpgrade linux-image-5.15.0-1109-azureUpgrade linux-image-lowlatency-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-6.8Upgrade linux-image-genericUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-5.15.0-1097-raspiUpgrade linux-image-oem-24.04bUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-5.15Upgrade linux-image-fips-5.15Upgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1049-oracle-64kUpgrade linux-image-gkeopUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1049-oracleUpgrade linux-image-5.15.0-1098-nvidiaUpgrade linux-image-azure-6.8Upgrade linux-image-nvidiaUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-6.8.0-1051-nvidia-lowlatencyUpgrade linux-image-5.15.0-1055-nvidia-tegra-rtUpgrade linux-image-6.8.0-1050-gke-64kUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-5.15.0-1100-oracleUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1103-awsUpgrade linux-image-6.8.0-1022-nvidia-tegraUpgrade linux-image-5.15.0-1044-nvidia-tegra-igxUpgrade linux-image-aws-lts-22.04Upgrade linux-image-aws-64k-5.15Upgrade linux-image-6.8.0-110-genericUpgrade linux-image-5.15.0-173-generic-64kUpgrade linux-image-5.15.0-173-fipsUpgrade linux-image-5.15.0-1097-ibmUpgrade linux-image-5.15.0-1095-kvmUpgrade linux-image-xilinxUpgrade linux-image-raspi-realtimeUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04 | Mar 17, 2026 | Jan 13, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub