Description
In the Linux kernel, the following vulnerability has been resolved: gve: Clear napi->skb before dev_kfree_skb_any() gve_rx_free_skb incorrectly leaves napi->skb referencing an skb after it is freed with dev_kfree_skb_any(). This can result in a subsequent call to napi_get_frags returning a dangling pointer. Fix this by clearing napi->skb before the skb is freed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 to < 75afd8724739ee5ed8165acde5f6ac3988b485ccaffected9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 to < d221284991118c0ab16480b53baecd857c0bc442affected9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 to < 2ce5341c36993b776012601921d7688693f8c037affected9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 to < a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50affected9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 to < 6f4d93b78ade0a4c2cafd587f7b429ce95abb02eaffected
Linux Linux
Default version status: affected
5.14affected0 to < 5.14unaffected5.15.162 to ≤ 5.15.*unaffected6.1.95 to ≤ 6.1.*unaffected6.6.35 to ≤ 6.6.*unaffected6.9.6 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc ↗
- https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442 ↗
- https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037 ↗
- https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50 ↗
- https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗