Description
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix use-after-free in taprio_change() In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section protected by 'q->current_entry_lock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update 'admin' immediately before an attempt to schedule freeing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to < 2f868ce6013548a713c431c679ef73747a66fcf3affecteda3d43c0d56f1b94e74963a2fbadfb70126d92213 to < 8a283a19026aaae8a773fd8061263cfa315b127faffecteda3d43c0d56f1b94e74963a2fbadfb70126d92213 to < 999612996df28d81f163dad530d7f8026e03aec6affecteda3d43c0d56f1b94e74963a2fbadfb70126d92213 to < fe371f084073e8672a2d7d46b335c3c060d1e301affecteda3d43c0d56f1b94e74963a2fbadfb70126d92213 to < 0d4c0d2844e4eac3aed647f948fd7e60eea56a61affecteda3d43c0d56f1b94e74963a2fbadfb70126d92213 to < 2240f9376f20f8b6463232b4ca7292569217237faffecteda3d43c0d56f1b94e74963a2fbadfb70126d92213 to < f504465970aebb2467da548f7c1efbbf36d0f44baffected
Linux Linux
Default version status: affected
5.2affected0 to < 5.2unaffected5.4.285 to ≤ 5.4.*unaffected5.10.229 to ≤ 5.10.*unaffected5.15.170 to ≤ 5.15.*unaffected6.1.115 to ≤ 6.1.*unaffected6.6.59 to ≤ 6.6.*unaffected6.11.6 to ≤ 6.11.*unaffected6.12 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2f868ce6013548a713c431c679ef73747a66fcf3 ↗
- https://git.kernel.org/stable/c/8a283a19026aaae8a773fd8061263cfa315b127f ↗
- https://git.kernel.org/stable/c/999612996df28d81f163dad530d7f8026e03aec6 ↗
- https://git.kernel.org/stable/c/fe371f084073e8672a2d7d46b335c3c060d1e301 ↗
- https://git.kernel.org/stable/c/0d4c0d2844e4eac3aed647f948fd7e60eea56a61 ↗
- https://git.kernel.org/stable/c/2240f9376f20f8b6463232b4ca7292569217237f ↗
- https://git.kernel.org/stable/c/f504465970aebb2467da548f7c1efbbf36d0f44b ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗