Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put In mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads tt->ref_count after termtbl_mutex has been released. Two concurrent callers on the same mlx5_termtbl_handle race: one decrements ref_count to zero, removes the hash entry, and calls kfree(tt) while the other has already dropped the mutex and is about to evaluate if (!tt->ref_count), producing a use-after-free. Fix this by capturing the result of the decrement into a stack-local last variable before dropping the mutex. The cleanup decision is now made entirely under termtbl_mutex, and tt is not touched after kfree.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
10caabdaad5ace85577a453da97d1f8d3b944427 to < e3ee194a790896fa92fea20b5385a354be2f2c12affected10caabdaad5ace85577a453da97d1f8d3b944427 to < b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797affected10caabdaad5ace85577a453da97d1f8d3b944427 to < 92f581cac93a71723456ac79ef54d9f60a251b42affected10caabdaad5ace85577a453da97d1f8d3b944427 to < a5833fdf53350b8b95a558fcf0056ddb1c0fe154affected10caabdaad5ace85577a453da97d1f8d3b944427 to < 304ea40ef4561671503c36e47da44a0a31b71e36affected10caabdaad5ace85577a453da97d1f8d3b944427 to < e393789e92310d7c66f57c876101779c90816a12affected10caabdaad5ace85577a453da97d1f8d3b944427 to < 18b2969073879b9cce24e1a78b118bdad54518d1affected10caabdaad5ace85577a453da97d1f8d3b944427 to < 7ee07f601f8f507c9faf25c68a49396ab8950596affected
Linux Linux
Default version status: affected
5.3affected0 to < 5.3unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e3ee194a790896fa92fea20b5385a354be2f2c12 ↗
- https://git.kernel.org/stable/c/b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797 ↗
- https://git.kernel.org/stable/c/92f581cac93a71723456ac79ef54d9f60a251b42 ↗
- https://git.kernel.org/stable/c/a5833fdf53350b8b95a558fcf0056ddb1c0fe154 ↗
- https://git.kernel.org/stable/c/304ea40ef4561671503c36e47da44a0a31b71e36 ↗
- https://git.kernel.org/stable/c/e393789e92310d7c66f57c876101779c90816a12 ↗
- https://git.kernel.org/stable/c/18b2969073879b9cce24e1a78b118bdad54518d1 ↗
- https://git.kernel.org/stable/c/7ee07f601f8f507c9faf25c68a49396ab8950596 ↗