Description
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown `ip6fl_seq_show()` walks the global flowlabel hash under the seq-file RCU read-side lock and prints `fl->opt->opt_nflen` when an option block is present. Exclusive flowlabels currently free `fl->opt` as soon as `fl->users` drops to zero in `fl_release()`. However, the surrounding `struct ip6_flowlabel` remains visible in the global hash table until later garbage collection removes it and `fl_free_rcu()` finally tears it down. A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that early `kfree()` and dereference freed option state, triggering a crash in `ip6fl_seq_show()`. Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches the lifetime already required for the enclosing flowlabel while readers can still reach it under RCU.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d3aedd5ebd4b0b925b0bcda548066803e1318499 to < 4b6798024f7b2d535f3db1002c760143cdbd1bd3affectedd3aedd5ebd4b0b925b0bcda548066803e1318499 to < 3c54b66c83fb8fcbde8e6a7bf90b65856e39f827affectedd3aedd5ebd4b0b925b0bcda548066803e1318499 to < 5a6b15f861b7c1304949e3350d23490a5fe429fdaffectedd3aedd5ebd4b0b925b0bcda548066803e1318499 to < 6c7fbdb8ffde6413640de7cfbd7c976c353e89f8affectedd3aedd5ebd4b0b925b0bcda548066803e1318499 to < 8027964931785cb73d520ac70a342a3dc16c249baffectedd3aedd5ebd4b0b925b0bcda548066803e1318499 to < 414726b69921fe6355ae453f5b35e68dd078342aaffectedd3aedd5ebd4b0b925b0bcda548066803e1318499 to < 572ce62778519a7d4d1c15f55dd2e45a474133c4affectedd3aedd5ebd4b0b925b0bcda548066803e1318499 to < 9ca562bb8e66978b53028fa32b1a190708e6a091affected
Linux Linux
Default version status: affected
3.9affected0 to < 3.9unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.134 to ≤ 6.6.*unaffected6.12.81 to ≤ 6.12.*unaffected6.18.22 to ≤ 6.18.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4b6798024f7b2d535f3db1002c760143cdbd1bd3 ↗
- https://git.kernel.org/stable/c/3c54b66c83fb8fcbde8e6a7bf90b65856e39f827 ↗
- https://git.kernel.org/stable/c/5a6b15f861b7c1304949e3350d23490a5fe429fd ↗
- https://git.kernel.org/stable/c/6c7fbdb8ffde6413640de7cfbd7c976c353e89f8 ↗
- https://git.kernel.org/stable/c/8027964931785cb73d520ac70a342a3dc16c249b ↗
- https://git.kernel.org/stable/c/414726b69921fe6355ae453f5b35e68dd078342a ↗
- https://git.kernel.org/stable/c/572ce62778519a7d4d1c15f55dd2e45a474133c4 ↗
- https://git.kernel.org/stable/c/9ca562bb8e66978b53028fa32b1a190708e6a091 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗