PT-2026-61235 · Linux · Linux
CVE-2026-63918
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
l2tp: use refcount inc not zero in l2tp session get by ifname
A reader in l2tp session get by ifname() can return a pointer to a
session whose refcount has reached zero. The getter takes its
reference with plain refcount inc(), but every other session getter
in the same file (l2tp v2 session get, l2tp v3 session get, and the
corresponding get next variants) uses refcount inc not zero()
because the IDR/RCU lookup can race with refcount dec and test() ->
l2tp session free() -> kfree rcu(). The ifname getter is the only
outlier; the inconsistency was raised on-list after 979c017803c4
("l2tp: use list del rcu in l2tp session unhash").
A reader inside rcu read lock bh() that matches session->ifname can
be preempted between the strcmp() and the refcount inc(). If the
last reference drops on another CPU in that window, the reader's
refcount inc() runs on a counter that has reached zero. refcount t
catches the addition-on-zero, prints "refcount t: addition on 0;
use-after-free", saturates the counter, and returns the saturated
pointer to the caller. Session memory is held live by the in-flight
RCU read section, but the kfree rcu() callback queued from
l2tp session free() will free it once the grace period closes; a
caller that dereferences the returned session past that point hits
a slab-use-after-free. On PREEMPT RT local bh disable() is a per-CPU
sleeping lock and the preemption window is real; on stock PREEMPT
kernels local bh disable() is a preempt count increment that closes
the cross-CPU race in practice (see below).
Use refcount inc not zero() and continue the list walk on failure,
matching the other session getters in the file. The ifname getter
is the only session getter in net/l2tp/ that still uses the bare
refcount inc() pattern; this change restores file-internal
consistency. The success path is unchanged.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux