CVSS
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Описание
Оригинално описание
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: remove call_control in inactive contexts If damon_call() is executed against a DAMON context that is not running, the function returns error while keeping the damon_call_control object linked to the context's call_controls list. Let's suppose the object is deallocated after the damon_call(), and yet another damon_call() is executed against the same context. The function tries to add the new damon_call_control object to the call_controls list, which still has the pointer to the previous damon_call_control object, which is deallocated. As a result, use-after-free happens. This can actually be triggered using the DAMON sysfs interface. It is not easily exploitable since it requires the sysfs write permission and making a definitely weird file writes, though. Please refer to the report for more details about the issue reproduction steps. Fix the issue by making two changes. Firstly, move the final kdamond_call() for cancelling all existing damon_call() requests from terminating DAMON context to be done before the ctx->kdamond reset. This makes any code that sees NULL ctx->kdamond can safely assume the context may not access damon_call() requests anymore. Secondly, let damon_call() to cleanup the damon_call_control objects that were added to the already-terminated DAMON context, before returning the error.
Засегнати продукти
- Linux Linux: 004ded6bee11b8ed463cdc54b89a4390f4b64f6d преди 23b061f421eef03647b512f3df48861706c87db3; 004ded6bee11b8ed463cdc54b89a4390f4b64f6d преди f9132fbc2e83baf2c45a77043672a63a675c9394
- Linux Linux: 6.17; преди 6.17; 6.18.7 до 6.18.*; от 6.19 нататък
История
- 25 януари 2026 Публикувано