High · published April 16, 2025
In the Linux kernel, the following vulnerability has been resolved:
net: decrease cached dst counters in dst_release
Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in
dst_release()") moved decrementing the dst count from dst_destroy to
dst_release to avoid accessing already freed data in case of netns
dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels
are used, this fix is incomplete as the same issue will be seen for
cached dsts:
Unable to handle kernel paging request at virtual address ffff5aabf6b5c000
Call trace:
percpu_counter_add_batch+0x3c/0x160 (P)
dst_release+0xec/0x108
dst_cache_destroy+0x68/0xd8
dst_destroy+0x13c/0x168
dst_destroy_rcu+0x1c/0xb0
rcu_do_batch+0x18c/0x7d0
rcu_core+0x174/0x378
rcu_core_si+0x18/0x30
Fix this by invalidating the cache, and thus decrementing cached dst
counters, in dst_release too.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.6, < 6.6.87 | 6.6.87 |
| linux/linux_kernel | ≥ 6.7, < 6.12.23 | 6.12.23 |
| linux/linux_kernel | ≥ 6.13, < 6.13.11 | 6.13.11 |
| linux/linux_kernel | ≥ 6.14, < 6.14.2 | 6.14.2 |