Description
In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same manner.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3f61631d47f115b83c935d0039f95cb68b0c8ab7 to < c35b0feb80b48720dfbbf4e33759c7be3faaebb6affected3f61631d47f115b83c935d0039f95cb68b0c8ab7 to < 33c778ea0bd0fa62ff590497e72562ff90f82b13affected3f61631d47f115b83c935d0039f95cb68b0c8ab7 to < fc1072d934f687e1221d685cf1a49a5068318f34affected3f61631d47f115b83c935d0039f95cb68b0c8ab7 to < d136502e04d8853a9aecb335d07bbefd7a1519a8affected3f61631d47f115b83c935d0039f95cb68b0c8ab7 to < 1fccbfbae1dd36198dc47feac696563244ad81d3affected3f61631d47f115b83c935d0039f95cb68b0c8ab7 to < ff7ec8dc1b646296f8d94c39339e8d3833d16c05affected
Linux Linux
Default version status: affected
6.0affected0 to < 6.0unaffected6.1.148 to ≤ 6.1.*unaffected6.6.102 to ≤ 6.6.*unaffected6.12.42 to ≤ 6.12.*unaffected6.15.10 to ≤ 6.15.*unaffected6.16.1 to ≤ 6.16.*unaffected6.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c35b0feb80b48720dfbbf4e33759c7be3faaebb6 ↗
- https://git.kernel.org/stable/c/33c778ea0bd0fa62ff590497e72562ff90f82b13 ↗
- https://git.kernel.org/stable/c/fc1072d934f687e1221d685cf1a49a5068318f34 ↗
- https://git.kernel.org/stable/c/d136502e04d8853a9aecb335d07bbefd7a1519a8 ↗
- https://git.kernel.org/stable/c/1fccbfbae1dd36198dc47feac696563244ad81d3 ↗
- https://git.kernel.org/stable/c/ff7ec8dc1b646296f8d94c39339e8d3833d16c05 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗