CVSS
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Описание
Оригинално описание
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run_deferred() takes it, and the RCU callback that frees the DSQ assumes that the grace period has flushed it, so exit_dsq() checks the per-CPU node without the deferred list lock. A grace period waits for readers in flight, not for a pending run_deferred(). A run_deferred() which starts after the grace period began can detach the request right before the callback looks and then read the freed DSQ's id. Cancel the pending requests before the grace period instead. The irq work that frees the DSQ unlinks every CPU's request under the per-CPU deferred list lock, and schedule_dsq_reenq() ignores a new request under the same lock once the id is invalid. Only a run_deferred() that started before the grace period can hold a request, and it runs with IRQs disabled, so the grace period waits for it and nothing touches the DSQ after the callback.
Засегнати продукти
- Linux Linux: 84b1a0ea0b7c23dec240783a592e480780efe459 преди 633f586329bfd9843bf8acf86c95353f4c16e22d; 84b1a0ea0b7c23dec240783a592e480780efe459 преди 069403dff337feb192bfc70fb28ddc8a171e20c1
- Linux Linux: 7.1; преди 7.1; 7.2.13 до 7.2.*; от 7.3 нататък
История
- 28 октомври 2026 Публикувано