Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nto the nbpf->chan[] array. If the data in irqbuf[i] is the error IRQ then we skip it, so the iterators are not in sync. I added a check to ensure that we don't go beyond the end of the irqbuf[] array. I'm pretty sure this can't happen, but it seemed harmless to add a check. On the other hand, after the loop has ended there is a check to ensure that the "chan" iterator is where we expect it to be. In the original code we went one element beyond the end of the array so the iterator wasn't in the correct place and it would always return -EINVAL. However, now it will always be in the correct place. I deleted the check since we know the result. Additional Analyst Notes: - CVE Program Container:
in the correct place. I deleted the check since we know the result. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/84fff8e6f11b9af1407e273995b5257d99ff0cff - https://git.kernel.org/stable/c/aec396b4f736f3f8d2c28a9cd2924a4ada57ae87 - https://git.kernel.org/stable/c/24861ef8b517a309a4225f2793be0cd8fa0bec9e - https://git.kernel.org/stable/c/f366b36c5e3ce29c9a3c8eed3d1631908e4fc8bb - https://git.kernel.org/stable/c/4bb016438335ec02b01f96bf1367378c2bfe03e5 - https://git.kernel.org/stable/c/122160289adf8ebf15060f1cbf6265b55a914948 - https://git.kernel.org/stable/c/d6bbd67ab5de37a74ac85c83c5a26664b62034dd - https://git.kernel.org/stable/c/188c6ba1d
8 - https://git.kernel.org/stable/c/d6bbd67ab5de37a74ac85c83c5a26664b62034dd - https://git.kernel.org/stable/c/188c6ba1dd925849c5d94885c8bbdeb0b3dcf510
CVE ID: CVE-2025-38539 State: PUBLISHED Published: 2025-08-16T11:12:31.678Z Last Updated: 2025-11-03T17:39:34.419Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_event_sem) when adding trace event When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk formats to replace enum names with their values. If two modules are loaded at the same time, the adding of the event to the ftrace_events list can corrupt the walking of the list in the code that is modifying the printk format strings and crash the kernel. The addition of the event shou
of the list in the code that is modifying the printk format strings and crash the kernel. The addition of the event should take the trace_event_sem for write while it adds the new event. Also add a lockdep_assert_held() on that semaphore in __trace_add_event_dirs() as it iterates the list. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/e70f5ee4c8824736332351b703c46f9469ed7f6c - https://git.kernel.org/stable/c/db45632479ceecb669612ed8dbce927e3c6279fc - https://git.kernel.org/stable/c/ca60064ea03f14e06c763de018403cb56ba3207d - https://git.kernel.org/stable/c/7803b28c9aa8d8bd4e19ebcf5f0db9612b0f333b - https://git.kernel.org/stable/c/6bc94f20a4c3
https://git.kernel.org/stable/c/7803b28c9aa8d8bd4e19ebcf5f0db9612b0f333b - https://git.kernel.org/stable/c/6bc94f20a4c304997288f9a45278c9d0c06987d3 - https://git.kernel.org/stable/c/33e20747b47ddc03569b6bc27a2d6894c1428182 - https://git.kernel.org/stable/c/70fecd519caad0c1741c3379d5348c9000a5b29d - https://git.kernel.org/stable/c/b5e8acc14dcb314a9b61ff19dcd9fdd0d88f70df
CVE ID: CVE-2025-38540 State: PUBLISHED Published: 2025-08-16T11:22:14.773Z Last Updated: 2025-11-03T17:39:36.320Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. Add these 2 devices to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace. A
to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/35f1a5360ac68d9629abbb3930a0a07901cba296 - https://git.kernel.org/stable/c/7ac00f019698f614a49cce34c198d0568ab0e1c2 - https://git.kernel.org/stable/c/1b297ab6f38ca60a4ca7298b297944ec6043b2f4 - https://git.kernel.org/stable/c/2b0931eee48208c25bb77486946dea8e96aa6a36 - https://git.kernel.org/stable/c/3ce1d87d1f5d80322757aa917182deb7370963b9 - https://git.kernel.org/stable/c/c72536350e82b53a1be0f3bfdf1511bba2827102 - https://git.kernel.org/stable/c/a2a91abd19c574b598b1c69ad76ad9c7ee
g/stable/c/c72536350e82b53a1be0f3bfdf1511bba2827102 - https://git.kernel.org/stable/c/a2a91abd19c574b598b1c69ad76ad9c7eedaf062 - https://git.kernel.org/stable/c/54bae4c17c11688339eb73a04fd24203bb6e7494
CVE ID: CVE-2025-38541 State: PUBLISHED Published: 2025-08-16T11:22:15.776Z Last Updated: 2025-08-16T11:22:15.776Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() devm_kasprintf() returns NULL on error. Currently, mt7925_thermal_init() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. References: - https://git.kernel.org/stable/c/1bbdf4213711bb6dc365e7628430a63dd3280794 - https://git.kernel.org/stable/c/2e99e9b34ece0b6d3e82cb757e9f60fa414da999 - https://git.kernel.org/stable/c/03ee
280794 - https://git.kernel.org/stable/c/2e99e9b34ece0b6d3e82cb757e9f60fa414da999 - https://git.kernel.org/stable/c/03ee8f73801a8f46d83dfc2bf73fb9ffa5a21602
CVE ID: CVE-2025-38542 State: PUBLISHED Published: 2025-08-16T11:22:16.689Z Last Updated: 2025-11-03T17:39:38.181Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refcount leak in atrtr_create() When updating an existing route entry in atrtr_create(), the old device reference was not being released before assigning the new device, leading to a device refcount leak. Fix this by calling dev_put() to release the old device reference before holding the new one. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/b92bedf71f25303e203a4e657489d76691a58119 - https:/
CVE Program Container: References: - https://git.kernel.org/stable/c/b92bedf71f25303e203a4e657489d76691a58119 - https://git.kernel.org/stable/c/a7852b01793669248dce0348d14df89e77a32afd - https://git.kernel.org/stable/c/b2f5dfa87367fdce9f8b995bc6c38f64f9ea2c90 - https://git.kernel.org/stable/c/d2e9f50f0bdad73b64a871f25186b899624518c4 - https://git.kernel.org/stable/c/4a17370da6e476d3d275534e9e9cd2d02c57ca46 - https://git.kernel.org/stable/c/473f3eadfc73b0fb6d8dee5829d19a5772e387f7 - https://git.kernel.org/stable/c/64124cf0aab0dd1e18c0fb5ae66e45741e727f8b - https://git.kernel.org/stable/c/711c80f7d8b163d3ecd463cd96f07230f488e750
CVE ID: CVE-2025-38543 State: PUBLISHED Published: 2025-08-16T11:22:17.619Z Last Updated: 2025-11-03T17:39:39.114Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/tegra: nvdec: Fix dma_alloc_coherent error check Check for NULL return value with dma_alloc_coherent, in line with Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/61b8d20962d00b7df117011c52f97cbb9c76a669 - https://git.kernel.org/stable/c/d1240029f97ac8c06db4dd4407bbbf83e8d08570 - https://git.kernel.org/stable/c/a560de522374af931fa994d161db3667b0bb2545 - h
/d1240029f97ac8c06db4dd4407bbbf83e8d08570 - https://git.kernel.org/stable/c/a560de522374af931fa994d161db3667b0bb2545 - https://git.kernel.org/stable/c/2e0812eedccd0629d73c9d0b1184a5db055df1da - https://git.kernel.org/stable/c/44306a684cd1699b8562a54945ddc43e2abc9eab
CVE ID: CVE-2025-38544 State: PUBLISHED Published: 2025-08-16T11:22:18.541Z Last Updated: 2025-08-16T11:22:18.541Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a server, it has to preallocate incoming calls and assign to them call IDs that will be used to thread related recvmsg() and sendmsg() together. The preallocated call IDs will automatically be attached to calls as they come in until the pool is empty. To the kernel, the call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer to prepared structs. In any
he call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer to prepared structs. In any case, the user isn't permitted to create two calls with the same call ID (call IDs become available again when the call ends) and EBADSLT should result from sendmsg() if an attempt is made to preallocate a call with an in-use call ID. However, the cleanup in the error handling will trigger both assertions in rxrpc_cleanup_call() because the call isn't marked complete and isn't marked as having been released. Fix this by setting the call state in rxrpc_service_prealloc_one() and then marking it as being released before calling the cleanup function. References: - https://git.
ice_prealloc_one() and then marking it as being released before calling the cleanup function. References: - https://git.kernel.org/stable/c/432c5363cd6fe5a928bbc94524d28b05515684dd - https://git.kernel.org/stable/c/5385ad53793de2ab11e396bdcdaa65bb04b4dad6 - https://git.kernel.org/stable/c/d8ffb47a443919277cb093c3db1ec6c0a06880b1 - https://git.kernel.org/stable/c/69e4186773c6445b258fb45b6e1df18df831ec45
CVE ID: CVE-2025-38545 State: PUBLISHED Published: 2025-08-16T11:22:19.459Z Last Updated: 2025-08-16T11:22:19.459Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info While transitioning from netdev_alloc_ip_align() to build_skb(), memory for the "skb_shared_info" member of an "skb" was not allocated. Fix this by allocating "PAGE_SIZE" as the skb length, accounting for the packet length, headroom and tailroom, thereby including the required memory space for skb_shared_info. References: - https://git.kernel.org/stable/c/fc2fffa2facac15ce711e95f98f954426
quired memory space for skb_shared_info. References: - https://git.kernel.org/stable/c/fc2fffa2facac15ce711e95f98f954426e025bc5 - https://git.kernel.org/stable/c/7d6ca0c8c0caf9a13cae2de763bb1f2a9ea7eabb - https://git.kernel.org/stable/c/02c4d6c26f1f662da8885b299c224ca6628ad232
CVE ID: CVE-2025-38546 State: PUBLISHED Published: 2025-08-16T11:22:20.477Z Last Updated: 2025-11-03T17:39:40.981Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atmarp() to prevent memleak. Add
mory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atmarp() to prevent memleak. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2fb37ab3226606cbfc9b2b6f9e301b0b735734c5 - https://git.kernel.org/stable/c/9e4dbeee56f614e3f1e166e5d0655a999ea185ef - https://git.kernel.org/stable/c/1c075e88d5859a2c6b43b27e0e46fb281cef8039 - https://git.kernel.org/stable/c/0c17ff462d98c997d707ee5cf4e4a9b1b52b9d90 - https://git.kernel.org/stable/c/1fb9fb5a4b5cec2d56e26525ef8c519de858fa60 - https://git.kernel.org/stable/c/9f771816f14da6d6157a8c30069091abf6b566fb - https://git.kernel.org/stable/c/cb2e4a2f8f268d8fba6662f663a2e57846f1
stable/c/9f771816f14da6d6157a8c30069091abf6b566fb - https://git.kernel.org/stable/c/cb2e4a2f8f268d8fba6662f663a2e57846f14a8d - https://git.kernel.org/stable/c/62dba28275a9a3104d4e33595c7b3328d4032d8d
CVE ID: CVE-2025-38547 State: PUBLISHED Published: 2025-08-16T11:34:15.905Z Last Updated: 2025-08-16T11:34:15.905Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps The AXP717 ADC channel maps is missing a sentinel entry at the end. This causes a KASAN warning. Add the missing sentinel entry. References: - https://git.kernel.org/stable/c/086a76474121bf2351438e311376ec67b410b2ea - https://git.kernel.org/stable/c/0c0c01c88bb69951539539d2001e67f0c613001f - https://git.kernel.org/stable/c/3281ddcea6429f7bc1fdb39d407752dd1371aba9
CVE ID: CVE-2025-38548 State: PUBLISHED Published: 2025-08-16T11:34:16.889Z Last Updated: 2025-11-03T17:39:42.862Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd(). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2e6f4d9cfbda52700c126c5a2b93dd2042e8680c - https://git.kernel.org/stable/c/4eb5cc48399f89b63acdbfe912fa5c8fe2900147 - https://git.kernel.org/stable/c/0db770e2922389753ddbd6663a5516a32b97b743 - https:/
c48399f89b63acdbfe912fa5c8fe2900147 - https://git.kernel.org/stable/c/0db770e2922389753ddbd6663a5516a32b97b743 - https://git.kernel.org/stable/c/eda5e38cc4dd2dcb422840540374910ef2818494 - https://git.kernel.org/stable/c/3c4bdc8a852e446080adc8ceb90ddd67a56e1bb8 - https://git.kernel.org/stable/c/2771d2ee3d95700f34e1e4df6a445c90565cd4e9 - https://git.kernel.org/stable/c/495a4f0dce9c8c4478c242209748f1ee9e4d5820
CVE ID: CVE-2025-38549 State: PUBLISHED Published: 2025-08-16T11:34:17.699Z Last Updated: 2025-08-16T11:34:17.699Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths When processing mount options, efivarfs allocates efivarfs_fs_info (sfi) early in fs_context initialization. However, sfi is associated with the superblock and typically freed when the superblock is destroyed. If the fs_context is released (final put) before fill_super is called—such as on error paths or during reconfiguration—the sfi structure would leak, as ownership never transfers to the superb
uch as on error paths or during reconfiguration—the sfi structure would leak, as ownership never transfers to the superblock. Implement the .free callback in efivarfs_context_ops to ensure any allocated sfi is properly freed if the fs_context is torn down before fill_super, preventing this memory leak. References: - https://git.kernel.org/stable/c/816d36973467d1c9c08a48bdffe4675e219a2e84 - https://git.kernel.org/stable/c/e9fabe7036bb8be6071f39dc38605508f5f57b20 - https://git.kernel.org/stable/c/64e135f1eaba0bbb0cdee859af3328c68d5b9789
CVE ID: CVE-2025-38550 State: PUBLISHED Published: 2025-08-16T11:34:18.619Z Last Updated: 2025-11-03T17:39:43.796Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/6e4eec86fe5f6b3fdbc702d1d36ac2a6e7ec0806 - https://git.kernel.org/stable/c/728db00a14cacb37f36e9382ab5fad55caf890cc - https://git.kernel.org/stable/c/dcbc346f50a009d8b7f4e330f9f2e22d64
g/stable/c/728db00a14cacb37f36e9382ab5fad55caf890cc - https://git.kernel.org/stable/c/dcbc346f50a009d8b7f4e330f9f2e22d6442fa26 - https://git.kernel.org/stable/c/7929d27c747eafe8fca3eecd74a334503ee4c839 - https://git.kernel.org/stable/c/5f18e0130194550dff734e155029ae734378b5ea - https://git.kernel.org/stable/c/ae3264a25a4635531264728859dbe9c659fad554
CVE ID: CVE-2025-38551 State: PUBLISHED Published: 2025-08-16T11:34:19.544Z Last Updated: 2025-08-16T11:34:19.544Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix recursived rtnl_lock() during probe() The deadlock appears in a stack trace like: virtnet_probe() rtnl_lock() virtio_config_changed_work() netdev_notify_peers() rtnl_lock() It happens if the VMM sends a VIRTIO_NET_S_ANNOUNCE request while the virtio-net driver is still probing. The config_work in probe() will get scheduled until virtnet_open() enables the config change notification via virtio_config_driver_enable(). References: - https://git.kernel.org/
t_open() enables the config change notification via virtio_config_driver_enable(). References: - https://git.kernel.org/stable/c/4e7c46362550b229354aeb52038f414e231b0037 - https://git.kernel.org/stable/c/3859f137b3c1fa1f0031d54263234566bdcdd7aa - https://git.kernel.org/stable/c/be5dcaed694e4255dc02dd0acfe036708c535def
CVE ID: CVE-2025-38552 State: PUBLISHED Published: 2025-08-16T11:34:20.455Z Last Updated: 2025-11-03T17:39:44.761Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'a
e fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/c476d627584b7589a134a8b48dd5c6639e4401c5 - https://git.kernel.org/stable/c/7c96d519ee15a130842a6513530b4d20acd2bfcd - https://git.kernel.org/stable/c/f81b6fbe13c7fc413b5158cdffc6a59391a2a8db - https://git.kernel.org/stable/c/659da22dee5ff316ba63bdaeeac7b58b5442f6c2 - https://git.kernel.org/stable/c/def5b7b2643ebba696fc60ddf675dca13f073486
CVE ID: CVE-2025-38553 State: PUBLISHED Published: 2025-08-19T06:06:53.204Z Last Updated: 2025-11-03T17:39:46.686Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/sched: Restrict conditions for adding duplicating netems to qdisc tree netem_enqueue's duplication prevention logic breaks when a netem resides in a qdisc tree with other netems - this can lead to a soft lockup and OOM loop in netem_dequeue, as seen in [1]. Ensure that a duplicating netem cannot exist in a tree with other netems. Previous approaches suggested in discussions in chronological order: 1) Track duplication status or ttl in the sk_buff struct. Considered
es suggested in discussions in chronological order: 1) Track duplication status or ttl in the sk_buff struct. Considered too specific a use case to extend such a struct, though this would be a resilient fix and address other previous and potential future DOS bugs like the one described in loopy fun [2]. 2) Restrict netem_enqueue recursion depth like in act_mirred with a per cpu variable. However, netem_dequeue can call enqueue on its child, and the depth restriction could be bypassed if the child is a netem. 3) Use the same approach as in 2, but add metadata in netem_skb_cb to handle the netem_dequeue case and track a packet's involvement in duplication. This is an overly complex approach, a
to handle the netem_dequeue case and track a packet's involvement in duplication. This is an overly complex approach, and Jamal notes that the skb cb can be overwritten to circumvent this safeguard. 4) Prevent the addition of a netem to a qdisc tree if its ancestral path contains a netem. However, filters and actions can cause a packet to change paths when re-enqueued to the root from netem duplication, leading us to the current solution: prevent a duplicating netem from inhabiting the same tree as other netems. [1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ [2] https://lwn.net/Art
Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ [2] https://lwn.net/Articles/719297/ Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/ad340a4b4adb855b18b3666f26ad65c8968e2deb - https://git.kernel.org/stable/c/f088b6ebe8797a3f948d2cae47f34bfb45cc6522 - https://git.kernel.org/stable/c/cab2809944989889f88a1a8b5cff1c78460c72cb - https://git.kernel.org/stable/c/325f5ec67cc0a77f2d0d453445b9857f1cd06c76 - https://git.kernel.org/stable/c/103c4e27ec9f5fe53022e46e976abf52c7221baf - https://git.kernel.org/stable/c/795cb393e38977aa991e70a9363da0ee734b2114 - https://git.kernel.org/stable/c/250f8796006c0f2bc63
//git.kernel.org/stable/c/795cb393e38977aa991e70a9363da0ee734b2114 - https://git.kernel.org/stable/c/250f8796006c0f2bc638ce545f601d49ae8d528b - https://git.kernel.org/stable/c/09317dfb681ac5a96fc69bea0c54441cf91b8270 - https://git.kernel.org/stable/c/ec8e0e3d7adef940cdf9475e2352c0680189d14e
CVE ID: CVE-2025-38554 State: PUBLISHED Published: 2025-08-19T17:02:33.315Z Last Updated: 2025-09-29T05:53:41.103Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped By inducing delays in the right places, Jann Horn created a reproducer for a hard to hit UAF issue that became possible after VMAs were allowed to be recycled by adding SLAB_TYPESAFE_BY_RCU to their cache. Race description is borrowed from Jann's discovery report: lock_vma_under_rcu() looks up a VMA locklessly with mas_walk() under rcu_read_lock(). At that point, the VMA may be concurrently freed, and
) looks up a VMA locklessly with mas_walk() under rcu_read_lock(). At that point, the VMA may be concurrently freed, and it can be recycled by another process. vma_start_read() then increments the vma->vm_refcnt (if it is in an acceptable range), and if this succeeds, vma_start_read() can return a recycled VMA. In this scenario where the VMA has been recycled, lock_vma_under_rcu() will then detect the mismatching ->vm_mm pointer and drop the VMA through vma_end_read(), which calls vma_refcount_put(). vma_refcount_put() drops the refcount and then calls rcuwait_wake_up() using a copy of vma->vm_mm. This is wrong: It implicitly assumes that the caller is keeping the VMA's mm alive, but in this
ng a copy of vma->vm_mm. This is wrong: It implicitly assumes that the caller is keeping the VMA's mm alive, but in this scenario the caller has no relation to the VMA's mm, so the rcuwait_wake_up() can cause UAF. The diagram depicting the race: T1 T2 T3 == == == lock_vma_under_rcu mas_walk <VMA gets removed from mm> mmap <the same VMA is reallocated> vma_start_read __refcount_inc_not_zero_limited_acquire munmap __vma_enter_locked refcount_add_not_zero vma_end_read vma_refcount_put __refcount_dec_and_test rcuwait_wait_event <finish operation> rcuwait_wake_up [UAF] Note that rcuwait_wait_event() in T3 does not block because refcount was already dropped by T1. At this point T3 can exit and fre