irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0. After irq_work_single() clears BUSY via atomic_cmpxchg(), it still dereferences @work for irq_work_is_hard() and rcuwait_wake_up(). An irq_work_sync() caller on another CPU that enters after BUSY is cleared can observe BUSY==0 immediately, return, and free the work before those accesses complete — causing a use-after-free. Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire irq_work_single() execution is within an RCU read-side critical section. Then add synchronize_rcu() in irq_work_sync() after rcuwait_wait_event() to ensure the caller waits for the RCU grace period before returning, preventing premature frees.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 810979682ccc98dbd83f341c18a2e556c30a7164 · fixed in 2dc79362302922cb18f35e262712b5e58de65442; From 810979682ccc98dbd83f341c18a2e556c30a7164 · fixed in eef4f71b46a9929ac33e968538c9dd5d96a02460; From 810979682ccc98dbd83f341c18a2e556c30a7164 · fixed in 684a78183c54c23e70d1cba320f7fc184604210b; From 810979682ccc98dbd83f341c18a2e556c30a7164 · fixed in 18c0456ea2615b1a743a6db739c74411c3b42bc6; From 810979682ccc98dbd83f341c18a2e556c30a7164 · fixed in 81b582784518196eff1050212a046bc29d3a05dd; From 810979682ccc98dbd83f341c18a2e556c30a7164 · fixed in 91840be8f710370607f949a627e070896faeddb8
- Linux Linux
5.16
- KernelLinux
From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.142; From 6.7.0 · fixed in 6.12.92; From 6.13.0 · fixed in 6.18.34; From 6.19.0 · fixed in 7.0.11