Description

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou_create() fou_create() publishes struct fou through sk_user_data before adding the new FOU port to the per-netns list. If fou_add_to_port_list() fails, the error path frees fou while it is still reachable through sk_user_data. A concurrent receive can then dereference the freed object in fou_from_sock(). This ordering issue was previously noted in the linked discussion. The failure is reachable when local port 0 is requested. Each socket binds to a different ephemeral port, but fou_cfg_cmp() compares the requested port 0 and reports -EALREADY once an entry already exists. Release the tunnel socket before freeing fou so sk_user_data is cleared first, and defer reclamation with kfree_rcu() to protect concurrent RCU readers. This matches the lifetime handling in fou_release().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:54.557Z",
  "pubdate": "2026-08-15T13:17:54.557Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's Foo-over-UDP (FOU) subsystem, specifically within the fou_create() function. The vulnerability is classified as a use-after-free condition leading to potential local privilege escalation, denial of service, or arbitrary code execution within the kernel context. It affects the Linux kernel networking subsystem handling FOU configurations. The risk implications are severe, as successful exploitation allows concurrent receive operations to dereference a prematurely freed memory object. The attacker capability requires the ability to interact with the network socket subsystem, specifically triggering the failure path when requesting local port 0 where fou_cfg_cmp() returns -EALREADY. Exploitation requires local access and execution capabilities to configure FOU sockets and race concurrent network receive operations against the error handling path of fou_create().",
  "technicalDetails": "The root cause of the vulnerability stems from a race condition and incorrect object lifetime ordering within fou_create() in the Linux kernel. During the creation of a new FOU socket, fou_create() publishes the struct fou pointer through the socket's sk_user_data field prior to successfully adding the new FOU port to the per-netns list via fou_add_to_port_list(). If fou_add_to_port_list() encounters a failure—such as when a local port 0 is requested, forcing the binding to an ephemeral port where fou_cfg_cmp() incorrectly evaluates existing entries and reports -EALREADY—the error handling path immediately frees the struct fou object using kfree() without first clearing the sk_user_data pointer. Because the object is still reachable via sk_user_data, a concurrent receive operation executing fou_from_sock() can access the stale memory address, resulting in a use-after-free condition. The vulnerable component is the FOU tunnel socket management logic inside the Linux kernel networking stack. The attack flow involves an authenticated local user triggering the creation of an FOU socket that fails registration, immediately followed by or concurrent with network packet reception handled by fou_from_sock(). This attempts to dereference the dangling pointer stored in sk_user_data. Post-exploitation impact includes kernel panics leading to a denial of service, memory corruption, or potential execution of arbitrary kernel code depending on heap layout manipulation and timing."
}