In the Linux kernel, the following vulnerability has been resolved: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe The sit driver's packet transmission path calls: sit_tunnel_xm…
High CVSS 7.5
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe The sit driver's packet transmission path calls: sit_tunnel_xmit() -> update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called to delete entries exceeding FNHE_RECLAIM_DEPTH+random. The race window is between fnhe_remove_oldest() selecting fnheX for deletion and the subsequent kfree_rcu(). During this time, the concurrent path's __mkroute_outp…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/041ab9ca6e80d8f792bb69df28ebf1ef39c06af8
- https://git.kernel.org/stable/c/0fd16ed6dc331636fb2a874c42d2f7d3156f7ff0
- https://git.kernel.org/stable/c/298f1e0694ab4edb6092d66efed93c4554e6ced1
- https://git.kernel.org/stable/c/4b7210da22429765d19460d38c30eeca72656282
- https://git.kernel.org/stable/c/69d35c12168f9c59b159ae566f77dfad9f96d7ca
- https://git.kernel.org/stable/c/ac1499fcd40fe06479e9b933347b837ccabc2a40
- https://git.kernel.org/stable/c/b84f083f50ecc736a95091691339a1b363962f0e
- https://git.kernel.org/stable/c/b8a44407bdaf2f0c5505cc7d9fc7d8da90cf9a94
Timeline
- nvd_ingest NVD