PT-2026-61268 · Linux · Linux
CVE-2026-63951
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
zram: fix use-after-free in zram writeback endio
A crash was observed in zram writeback endio due to a NULL pointer
dereference in wake up. The root cause is a race condition between the
bio completion handler (zram writeback endio) and the writeback task.
In zram writeback endio, wake up() is called on &wb ctl->done wait after
releasing wb ctl->done lock. This creates a race window where the
writeback task can see num inflight become 0, return, and free wb ctl
before zram writeback endio calls wake up().
CPU 0 (zram writeback endio) CPU 1 (writeback store)
============================ ============================
zram writeback slots
zram submit wb request
zram submit wb request
wait event(wb ctl->done wait)
spin lock(&wb ctl->done lock);
list add(&req->entry, &wb ctl->done reqs);
spin unlock(&wb ctl->done lock);
wake up(&wb ctl->done wait);
zram complete done reqs
spin lock(&wb ctl->done lock);
list add(&req->entry, &wb ctl->done reqs);
spin unlock(&wb ctl->done lock);
while (num inflight) > 0)
spin lock(&wb ctl->done lock);
list del(&req->entry);
spin unlock(&wb ctl->done lock);
// num inflight becomes 0
atomic dec(num inflight);
// Leave zram writeback slots
// Free wb ctl
release wb ctl(wb ctl);// UAF crash!
wake up(&wb ctl->done wait);
This patch fixes this race by using RCU. By protecting wb ctl with
rcu read lock() in zram writeback endio and using kfree rcu() to free it,
we ensure that wb ctl remains valid during the execution of
zram writeback endio.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux