CVE-2025-40271

In the Linux kernel, the following vulnerability has been resolved:

fs/proc: fix uaf in proc_readdir_de()

Pde is erased from subdir rbtree through rb_erase(), but not set the node

to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE()

set the erased node to EMPTY, then pde_subdir_next() will return NULL to

avoid uaf access.

We found an uaf issue while using stress-ng testing, need to run testcase

getdent and tun in the same time. The steps of the issue is as follows:

1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current

pde is tun3;

2) in the [time windows] unregister netdevice tun3 and tun2, and erase

them from rbtree. erase tun3 first, and then erase tun2. the

pde(tun2) will be released to slab;

3) continue to getdent process, then pde_subdir_next() will return

pde(tun2) which is released, it will case uaf access.

CPU 0 | CPU 1

-------------------------------------------------------------------------

traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2

sys_getdents64() |

iterate_dir() |

proc_readdir() |

proc_readdir_de() | snmp6_unregister_dev()

pde_get(de); | proc_remove()

read_unlock(&proc_subdir_lock); | remove_proc_subtree()

| write_lock(&proc_subdir_lock);

[time window] | rb_erase(&root->subdir_node, &parent->subdir);

| write_unlock(&proc_subdir_lock);

read_lock(&proc_subdir_lock); |

next = pde_subdir_next(de); |

pde_put(de); |

de = next; //UAF |

rbtree of dev_snmp6

|

pde(tun3)

/ \

NULL pde(tun2)