Към съдържанието
Търсене

CVE-2025-71152: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: net: dsa: properly keep track of conduit reference Problem description ------------------- DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, is just wrong and doesn't make sense. There are two distinct problems. 1. The OF path, which uses of_find_net_device_by_node(), never releases the elevated refcount on the conduit's kobject. Nominally, the OF and non-OF paths should result in objects having identical reference counts taken, and it is already suspicious that dsa_dev_to_net_device() has a put_device() call which is missing in dsa_port_parse_of(), but we can actually even verify that an issue exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command "before" and "after" applying this patch: (unbind the conduit driver for net device eno2) echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind we see these lines in the output diff which appear only with the patch applied: kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000) kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000) 2. After we find the conduit interface one way (OF) or another (non-OF), it can get unregistered at any time, and DSA remains with a long-lived, but in this case stale, cpu_dp->conduit pointer. Holding the net device's underlying kobject isn't actually of much help, it just prevents it from being freed (but we never need that kobject directly). What helps us to prevent the net device from being unregistered is the parallel netdev reference mechanism (dev_hold() and dev_put()). Actually we actually use that netdev tracker mechanism implicitly on user ports since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link(). But time still passes at DSA switch probe time bet

    Засегнати продукти

    • Linux Linux: 83c0afaec7b730b16c518aecc8e6246ec91b265e преди bc3305eeeee5d8e43005ad46e252991e46d10f33; 83c0afaec7b730b16c518aecc8e6246ec91b265e преди ec2b34acb1894cfc10ed22d8277ca4f11e9f4b23; 83c0afaec7b730b16c518aecc8e6246ec91b265e преди b358fc6ff3b35a29f7f677da1c67af67d0d560cb; 83c0afaec7b730b16c518aecc8e6246ec91b265e преди 0e766b77ba5093583dfe609fae0aa1545c46dbbd; 83c0afaec7b730b16c518aecc8e6246ec91b265e преди 06e219f6a706c367c93051f408ac61417643d2f9
    • Linux Linux: 4.8; преди 4.8; 6.1.191 до 6.1.*; 6.6.130 до 6.6.*; 6.12.78 до 6.12.*; 6.18.4 до 6.18.*; от 6.19 нататък

    История

    • 23 януари 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2025-71152: Linux | freedomonline.bg