Description

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T13:17:52.600Z",
  "pubdate": "2026-08-15T13:17:52.600Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's User-Mode Linux (UM) vector network driver, specifically within the vector_mmsg_rx() function. The flaw is triggered when an incoming packet's overlay header fails validation via verify_header(), causing the driver to prematurely free the socket buffer (skb) and invoke a continue statement without clearing the corresponding pointer in the skbuff_vector[] array or advancing the processing cursors. Consequently, subsequent iterations attempt to process and free the same stale, freed skb pointer, leading to a reference count underflow and a use-after-free condition. This vulnerability affects Linux kernel instances utilizing the UM vector transport mechanism with GRE or L2TPv3 protocols, which implement header verification routines that can return negative error codes. An unauthenticated remote attacker or network peer operating over these affected transports can trigger the flaw by transmitting malformed packets containing invalid cookies or session IDs. Successful exploitation results in kernel memory corruption, potentially leading to a denial of service (system crash) or arbitrary code execution within the kernel context. No special privileges are required by the attacker beyond network connectivity to the affected transport interface.",
  "technicalDetails": "The vulnerability resides in the vector_mmsg_rx() function implemented within the User-Mode Linux (UM) vector network driver component of the Linux kernel (specifically in the arch/um/drivers/vector_user.c or related vector transport files, operating on skbuff_vector and mmsg_vector structures). The root cause is a logic error in error-handling control flow when processing received packet buffers.\nDuring normal packet reception or short-packet handling paths, received packets are processed, and the consumption logic falls through to the end of the loop body. This execution path explicitly clears the consumed slot by setting (*skbuff_vector) = NULL and safely advances both the mmsg_vector and skbuff_vector cursors. However, when a packet's overlay header fails verification via the verify_header() function (returning a negative value), the code executes dev_kfree_skb_irq(skb), increments rx_encaps_errors, and immediately invokes a continue statement.\nBecause of the continue statement, the pointer to the newly freed skb remains uncleared in the skbuff_vector[] array, and the loop cursors fail to increment. In the subsequent iteration of the receive loop, the driver reads the exact same array slot, retrieves the dangling pointer to the already-freed skb, and passes it to be freed a second time. This double-free sequence induces a reference count underflow in the networking subsystem, culminating in a critical use-after-free vulnerability.\nThe attack flow requires an attacker to establish network communication with an endpoint running the Linux kernel configured with the UM vector driver utilizing GRE or L2TPv3 transports. Transports such as raw and tap sockets do not implement header verification that returns negative values in this context and are therefore unaffected. The attacker transmits a crafted packet with invalid encapsulation headers, specifically targeting the cookie or session-ID fields inspected by GRE or L2TPv3 verify_header() checks. When the kernel processes this packet, verify_header() fails, initiating the flawed error path and leaving the stale skb pointer in the vector array. The immediate re-reading of the freed memory address triggers the use-after-free condition.\nExploitation does not require authentication or elevated privileges; any network peer capable of sending encapsulated traffic over GRE or L2TPv3 to the vulnerable interface can trigger the code path. The immediate post-exploitation impact typically manifests as kernel panics, memory corruption, or unpredictable system instability due to heap corruption within the networking slab allocator."
}