Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix addr_wq_timer race in sctp_free_addr_wq() sctp_free_addr_wq() previously removed addr_wq_timer using timer_delete() while holding addr_wq_lock. However, timer_delete() does not guarantee that a currently running timer handler has completed. This allows a race with sctp_addr_wq_timeout_handler(), where the handler may still run after addr_waitq has been freed, acquire addr_wq_lock, and access freed memory, leading to a use-after-free. Fix this by calling timer_shutdown_sync() before taking addr_wq_lock. This guarantees that any in-flight timer handler has finished and prevents the timer from being re-armed during teardown, making subsequent cleanup safe.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
4db67e808640e3934d82ce61ee8e2e89fd877ba8 to < fb6117713abef8646fdbf58256532451bcf26c47affected4db67e808640e3934d82ce61ee8e2e89fd877ba8 to < 5098308ad72f83f3b1a48c247dddab1695114baeaffected4db67e808640e3934d82ce61ee8e2e89fd877ba8 to < d49eff15261dd62e4fa3a316c26cb1f537a60464affected4db67e808640e3934d82ce61ee8e2e89fd877ba8 to < a8323fb2ab6cd6978f359daeed6688e0cadf32baaffected4db67e808640e3934d82ce61ee8e2e89fd877ba8 to < c3e5cac47519d77ad36b9c03a1df1536aaa0c4a1affected4db67e808640e3934d82ce61ee8e2e89fd877ba8 to < 976c19de0f22a857ba0112f39635f8fd7a257568affected
Linux Linux
Default version status: affected
3.7affected0 to < 3.7unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.114 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fb6117713abef8646fdbf58256532451bcf26c47 ↗
- https://git.kernel.org/stable/c/5098308ad72f83f3b1a48c247dddab1695114bae ↗
- https://git.kernel.org/stable/c/d49eff15261dd62e4fa3a316c26cb1f537a60464 ↗
- https://git.kernel.org/stable/c/a8323fb2ab6cd6978f359daeed6688e0cadf32ba ↗
- https://git.kernel.org/stable/c/c3e5cac47519d77ad36b9c03a1df1536aaa0c4a1 ↗
- https://git.kernel.org/stable/c/976c19de0f22a857ba0112f39635f8fd7a257568 ↗