Description
In the Linux kernel, the following vulnerability has been resolved: net: tun: unlink NAPI from device on destruction Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we have to del them explicitly. The current code is missing deleting the NAPI if the queue was detached first.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
943170998b200190f99d3fe7e771437e2c51f319 to < 82e729aee59acefe135fceffadcbc5b86dd4f1b9affected943170998b200190f99d3fe7e771437e2c51f319 to < a8cf919022373c97a84fe596bbea544f909c485daffected943170998b200190f99d3fe7e771437e2c51f319 to < bec1be0a745ab420718217e3e0d9542a75108989affected943170998b200190f99d3fe7e771437e2c51f319 to < 8145f77d38de4f88b8a69e1463f5c09ba189d77caffected943170998b200190f99d3fe7e771437e2c51f319 to < 8661d4b8faa2f7ee7a559969c0a7c57f077b1728affected943170998b200190f99d3fe7e771437e2c51f319 to < 3b9bc84d311104906d2b4995a9a02d7b7ddab2dbaffected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected4.19.251 to ≤ 4.19.*unaffected5.4.204 to ≤ 5.4.*unaffected5.10.129 to ≤ 5.10.*unaffected5.15.53 to ≤ 5.15.*unaffected5.18.10 to ≤ 5.18.*unaffected5.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/82e729aee59acefe135fceffadcbc5b86dd4f1b9 ↗
- https://git.kernel.org/stable/c/a8cf919022373c97a84fe596bbea544f909c485d ↗
- https://git.kernel.org/stable/c/bec1be0a745ab420718217e3e0d9542a75108989 ↗
- https://git.kernel.org/stable/c/8145f77d38de4f88b8a69e1463f5c09ba189d77c ↗
- https://git.kernel.org/stable/c/8661d4b8faa2f7ee7a559969c0a7c57f077b1728 ↗
- https://git.kernel.org/stable/c/3b9bc84d311104906d2b4995a9a02d7b7ddab2db ↗