In the Linux kernel, the following vulnerability has been resolved:
mm: list_lru: fix UAF for memory cgroup
The mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or cgroup_mutex or others which could prevent returned memcg from being freed. Fix it by adding missing rcu read lock.
Found by code inspection.
[[email protected]: only grab rcu lock when necessary, per Vlastimil]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Dec 5, 2024 | Aug 26, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-ibm-classicUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-virtualUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-raspiUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-nvidiaUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-ibmUpgrade linux-image-gkeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-genericUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1020-azure | Dec 13, 2024 | Aug 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub