CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of Generic Segmentation Offload (GSO) segments, specifically in the context of asynchronous cryptographic operations. This flaw can lead to a use-after-free condition due to stale pointers in the segment list, potentially allowing an attacker to execute arbitrary code or crash the system. Organizations using affected Linux kernel versions should prioritize patching this vulnerability to mitigate risks associated with network packet processing and cryptographic operations.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free. Repoint skb->prev at the last retained segment before returning.