CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the netfs subsystem, specifically in the handling of folios during the unlocking process, which can lead to a use-after-free condition. This critical flaw (CVSS 9.8) may allow attackers to exploit memory management issues, potentially leading to arbitrary code execution or system crashes. Organizations using affected Linux distributions should prioritize patching this vulnerability to mitigate risks associated with system stability and security.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for netfs_perform_write() or netfs_write_begin(). However, given that netfs_unlock_abandoned_read_pages() is called _after_ NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no_unlock_folio as ownership immediately reverts to the caller. Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs_unlock_read_folio() where the same applies.
Related CVEs
Other vulnerabilities affecting the same vendor(s)