PT-2026-51841 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-52947
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: fix refcount saturation and potential UAF in qrtr port remove
In qrtr port remove(), the socket reference count is decremented via
sock put() before the port is removed from the qrtr ports XArray and
before the RCU grace period elapses.
This breaks the fundamental RCU update paradigm. It exposes a race
window where a concurrent RCU reader (such as qrtr reset ports() or
qrtr port lookup()) can obtain a pointer to the socket from the XArray,
and attempt to call sock hold() on a socket whose reference count has
already dropped to zero.
This exact race condition was hit during syzkaller fuzzing, leading to
the following refcount saturation warning and a potential Use-After-Free:
refcount t: saturated; leaking memory.
WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount warn saturate+0xae/0x1d0
Modules linked in: qrtr(+) bochs drm shmem helper ...
Call Trace:
qrtr reset ports net/qrtr/af qrtr.c:768 [inline] [qrtr]
qrtr bind.isra.0+0x48b/0x570 net/qrtr/af qrtr.c:805 [qrtr]
qrtr bind+0x17d/0x210 net/qrtr/af qrtr.c:901 [qrtr]
kernel bind+0xe4/0x120 net/socket.c:3592
qrtr ns init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]
qrtr proto init+0x3b/0xff0 net/qrtr/af qrtr.c:169 [qrtr]
do one initcall+0xf5/0x5e0 init/main.c:1283
...
Fix this by deferring the reference count decrement until after the
xa erase() and the synchronize rcu() complete.
(Note: The v1 of this patch incorrectly replaced sock put() with
sock put(). As Simon Horman pointed out, the callers of qrtr port remove()
still hold a reference to the socket, so freeing the socket memory here
would lead to a subsequent UAF in the caller. Thus, the sock put() is
kept, but only repositioned to close the RCU race.)
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux