PT-2026-52359 · Linux · Linux
Publicado
2026-06-25
·
Atualizado
2026-06-25
·
CVE-2026-53264
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act api: use RCU with deferred freeing for action lifecycle
When NEWTFILTER and DELFILTER are run concurrently it is possible to create a
race with an associated action.
Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:
0: mutex lock() <-- holds the idr lock
0: rcu read lock()
0: p = idr find(idr, index) <-- action p is valid (RCU protects IDR)
0: mutex unlock() <-- releases the idr lock
1: refcount dec and mutex lock() <-- refcnt 1->0, mutex held
1: idr remove(idr, index) <-- Action removed from IDR
1: mutex unlock() <-- mutex released allowing us to delete the action
1: tcf action cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral
0: refcount inc not zero(&p->tcfa refcnt) <-- ouch, UAF p points to freed memory
This patch fixes the race condition between NEWTFILTER and DELFILTER by
adding struct rcu head to tc action used in the deferral and introducing a
call rcu() in the delete path to defer the final kfree().
Note: this is a revert of commit d7fb60b9cafb ("net sched: get rid of tcfa rcu")
but also modernization/simplification to directly use kfree rcu().
Let's illustrate the new restored code path:
0: rcu read lock()
1: refcount dec and mutex lock() <-- refcnt 1->0, mutex held
1: idr remove(idr, index)
1: mutex unlock()
1: call rcu(&p->tcfa rcu, tcf action rcu free) <-- defer kfree after grace period
0: p = idr find(idr, index)
0: refcount inc not zero(&p->tcfa refcnt) <-- fails, refcnt already 0
1: rcu read unlock() <-- release so freeing can run after grace period
After CPU1 calls idr remove(), the object is no longer reachable through the IDR.
CPU0's subsequent idr find() will return NULL, and even if it still held a
stale pointer, the immediate kfree() is now deferred until after the RCU grace
period, so no UAF can occur.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux