Executive brief
The Linux kernel's device resource management system (Devres) contains a race condition that can occur when two CPU cores attempt to revoke a device resource simultaneously. This can lead to use-after-free memory errors, causing the system to crash or potentially allowing an attacker to manipulate freed memory. This affects drivers that use device-bound resource allocation, particularly DMA-mapped memory structures.
Technical details
The vulnerability is a use-after-free race condition in the kernel's Rust-based Devres implementation. The race occurs between devres_release_all() (called during device release) and Devres::drop() (called when dropping resources) when two paths concurrently call revoke()/revoke_nosync(). The revoker that loses the atomic swap on is_available returns immediately, but the other revoker may still be executing drop_in_place() on the inner data. When the losing revoker's caller proceeds to drop adjacent resources (e.g., SGTable freeing sg_table and pages), drop_in_place() may still reference those freed objects. The fix adds a Completion primitive: the winning revoker signals it after drop_in_place() completes, while the losing revoker waits for it before returning. Network exposure is minimal as this requires local kernel execution; the vulnerability was fixed in upstream kernel commits acc516dfa1972d31836b50abc0115216cd0fccc5 and backported to stable branches.
Affected products
- Linux Linux Kernel Affected versions include kernel 6.x and 7.x series (affected commit 05aa6fb1c21d onwards)
Timeline
- 2026-09-11: disclosed
- 2026-06-28: patched: Upstream commit acc516dfa1972d31836b50abc0115216cd0fccc5
- 2026-09-07: patched: Stable tree backport commit c7e3d57c705ab1053a6a1bbef96795e792da1540