Executive brief
The Linux kernel's packet socket networking module contains a use-after-free vulnerability in its TX_RING (transmit ring) buffer handling. When network packets are being transmitted through AF_PACKET sockets, freed memory could be accessed by active packet objects, potentially leading to memory corruption, kernel crashes, or privilege escalation. This affects systems using raw packet socket transmission, commonly found in network monitoring and packet manipulation tools.
Technical details
This is a use-after-free vulnerability in net/packet.c's TX_RING implementation. The root cause is premature freeing of vmalloc-backed ring buffers while skbs (socket buffers) still hold raw pointers to frame data within those buffers. The vulnerable code path occurs in tpacket_destruct_skb(), which decrements the pending reference before completing frame writes, and during ring replacement when pending TX frames are not properly accounted under synchronization locks. The fix defers vmalloc vector cleanup through a delayed work queue until all TX skbs finish their write cycles, reorders the pending decrement after frame stores, and adds rechecking of pending frames under pg_vec_lock during ring swaps. No authentication or special privileges are required for a local process to trigger this via packet socket operations. A remote network vector is unlikely unless the vulnerability is triggered through kernel-side packet processing.
Affected products
- Linux Linux kernel unknown