In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right …
High CVSS 8.8
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610
- https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b
- https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0
Timeline
- nvd_ingest NVD