In the Linux kernel, the following vulnerability has been resolved:
mm: list_lru: fix UAF for memory cgroup
The mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or cgroup_mutex or others which could prevent returned memcg from being freed. Fix it by adding missing rcu read lock.
Found by code inspection.
[[email protected]: only grab rcu lock when necessary, per Vlastimil]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Dec 5, 2024 | Aug 26, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-oem-22.04Upgrade linux-image-azureUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-gkeUpgrade linux-image-ibmUpgrade linux-image-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1020-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1018-oemUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-nvidia-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-awsUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-kvmUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-virtualUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-oem-22.04dUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1020-azure-fde | Dec 13, 2024 | Aug 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub