vulnerability

Oracle Linux: CVE-2021-47321: ELSA-2024-7000: kernel security update (IMPORTANT)

Severity
4
CVSS
(AV:L/AC:L/Au:M/C:N/I:N/A:C)
Published
May 21, 2024
Added
Oct 16, 2024
Modified
Jul 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:
watchdog: Fix possible use-after-free by calling del_timer_sync()
This driver's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.
Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.
A vulnerability was found in the del_timer() function in the Linux kernel's watchdog driver. This issue occurs because the function does not wait for the timer handler to finish, which may lead to a situation where the handler runs after the driver that has been removed, causing a use-after-free issue.

Solution

oracle-linux-upgrade-kernel
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.