Description

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock. pktgen_remove_device() removes the same entry before _rem_dev_from_if_list() takes that lock. This allows the following interleaving: CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend) if_lock(t) proc_remove(pkt_dev->entry) proc_remove(pkt_dev->entry) pkt_dev->entry = proc_create_data(...) if_unlock(t) The kthread can pass the stale proc_dir_entry to proc_remove() after the rename path has freed it. A reproducer with a widened race window reports: BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80 Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67 Call Trace: proc_remove+0x78/0x80 pktgen_remove_device.isra.0+0x11c/0x4c0 pktgen_thread_worker+0x1214/0x6bc0 kthread+0x2c6/0x3b0 Allocated by task 95: __proc_create+0x204/0x790 proc_create_data+0x72/0xe0 pktgen_thread_write+0xd61/0x1510 Freed by task 28: kmem_cache_free+0xcb/0x3d0 proc_free_inode+0x5b/0x80 rcu_core+0x50a/0x1850 The buggy address belongs to the object at ffff8881478fea00 which belongs to the cache proc_dir_entry of size 192 Move proc_remove() into the if_lock-protected list removal helper. Keep it before list_del_rcu() to preserve the ordering required by add_device(). The rename path must then finish replacing the entry before removal, or it observes that the device is no longer on the list.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:52.713Z",
  "pubdate": "2026-08-15T13:17:52.713Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel network packet generator (pktgen) subsystem, specifically within the proc entry management handling. The flaw arises due to insufficient locking granularity and race conditions between network device rename events (NETDEV_CHANGENAME) and packet generator worker threads (kpktgend).\nAn attacker capable of triggering network device renames concurrently with pktgen device lifecycle operations can exploit this timing window to induce memory corruption via a use-after-free condition. This vulnerability compromises the integrity of the proc_dir_entry cache slab objects.\nThe impact includes potential kernel memory corruption, denial of service through kernel crashes (kernel panics), and theoretically arbitrary code execution depending on local kernel hardening configurations. The affected component is the pktgen module within the Linux kernel networking stack.\nExploitation requires local execution privileges to interact with the pktgen pseudo-file system interface and manipulate network device names. There are no specific remote network exposure vectors directly tied to this vulnerability unless an attacker already possesses local shell access or the ability to run arbitrary system commands.",
  "technicalDetails": "The root cause of the vulnerability is a race condition involving the management of proc_dir_entry structures associated with pktgen devices. Specifically, pktgen_change_name() replaces pkt_dev->entry while holding the t->if_lock mutex, but pktgen_remove_device() removes the same entry outside of the protected critical section before _rem_dev_from_if_list() acquires the lock.\nThis execution flow permits a specific interleaving where CPU 0 processing the NETDEV_CHANGENAME event executes proc_remove(pkt_dev->entry) and subsequently assigns pkt_dev->entry = proc_create_data(...) under if_lock(t). Concurrently, CPU 1 running the kpktgend thread can execute its own proc_remove(pkt_dev->entry) on the stale pointer before the rename path completes or after it has already freed the underlying memory object.\nConsequently, the kernel worker thread passes a stale proc_dir_entry pointer to proc_remove() after the rename path has freed it, triggering a slab use-after-free condition. Kernel debugging subsystems such as KASAN detect this anomaly during reads of size 8 at addresses managed by the proc_dir_entry slab cache, resulting in a BUG report indicating slab-use-after-free in proc_remove+0x78/0x80.\nThe attack flow proceeds as follows: 1. A local user initiates a pktgen device configuration and starts the worker thread (kpktgend). 2. The user triggers a network interface rename event concurrently. 3. The race window opens between pktgen_change_name() and pktgen_remove_device(). 4. The stale proc_dir_entry is referenced and passed to proc_remove() by the worker thread. 5. The slab allocator reuses or frees the memory, causing kernel instability, memory corruption, or a crash.\nThe vulnerable component comprises the pktgen interface handling functions within net/core/pktgen.c, specifically involving pktgen_change_name(), pktgen_remove_device(), and associated locking primitives. The vulnerability affects Linux kernel versions implementing the vulnerable pktgen locking model prior to the integration of the patch moving proc_remove() into the if_lock-protected list removal helper before list_del_rcu()."
}