In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix UAF in blkcg_unpin_online() blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up,…
High CVSS 7.8
Summary
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix UAF in blkcg_unpin_online() blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF: ================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 a…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/29d1e06560f0f6179062ac638b4064deb637d1ad Patch
- https://git.kernel.org/stable/c/5baa28569c924d9a90d036c2aaab79f791fedaf8 Patch
- https://git.kernel.org/stable/c/64afc6fe24c9896c0153e5a199bcea241ecb0d5c Patch
- https://git.kernel.org/stable/c/83f5a87ee8caa76a917f59912a74d6811f773c67
- https://git.kernel.org/stable/c/86e6ca55b83c575ab0f2e105cf08f98e58d3d7af Patch
- https://git.kernel.org/stable/c/8a07350fe070017a887433f4d6909433955be5f1
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
Timeline
- nvd_ingest NVD