REDHAT-BUG-2432664: Medium severity linux/kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
macvlan: fix possible UAF in macvlanforwardsource()
Add RCU protection on (struct macvlansourceentry)->vlan.
Whenever macvlanhashdelsource() is called, we must clear entry->vlan pointer before RCU grace period starts.
This allows macvlanforwardsource() to skip over entries queued for freeing.
Note that macvlandev are already RCU protected, as they are embedded in a standard netdev (netdevpriv(ndev)).
https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE/T/#u
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply a code change that adds RCU protection on struct macvlan_source_entry->vlan and ensure macvlan_hash_del_source() clears entry->vlan pointer before the RCU grace period starts so macvlan_forward_source() will skip entries queued for freeing.
Linux kernel (macvlan) macvlan_source_entry->vlan RCU protection / macvlan_hash_del_source behavior = clear pointer before RCU grace period
Event History
Frequently Asked Questions
Which kernel networking functionality should be prioritized for review?
Review systems using the macvlan source-entry and source-forwarding paths. The issue involves entries processed by macvlan_forward_source() while they are being removed through macvlan_hash_del_source().
What condition creates the unsafe access?
An entry can be queued for freeing while its vlan pointer remains available to the forwarding path. Without clearing that pointer before the RCU grace period begins, macvlan_forward_source() may access an entry that is being freed.
How does the resolved code prevent the issue?
The fix adds RCU protection for the vlan member of macvlan_source_entry and clears entry->vlan before the RCU grace period starts. This lets the forwarding path skip entries queued for freeing.
Which Red Hat advisories are associated with this issue?
The provided references list RHSA-2026:3964 and RHSA-2026:3966.