Executive brief
The Linux kernel's page pool memory manager has a use-after-free flaw in its DMA cleanup logic. When network drivers reconfigure channels while traffic is flowing, a race condition can cause the kernel to access freed memory during concurrent cleanup operations, potentially leading to system crashes or instability.
Technical details
A use-after-free vulnerability exists in the page_pool DMA release path. The root cause is that __page_pool_release_netmem_dma() accesses netmem fields (dma_addr and pp_magic DMA index bits) after xa_cmpxchg() returns; when the cmpxchg loses the race, the losing path calls put_page() and frees the page before the winning path finishes reading these fields, leading to UAF. The vulnerability is triggered during concurrent execution of page_pool_scrub() (in page_pool_destroy) and page_pool_put_netmem() on different CPUs, particularly during network driver channel reconfiguration. The fix splits DMA release into two functions: __page_pool_unmap_netmem_dma() caches dma_addr before cmpxchg and never touches netmem after, while __page_pool_release_netmem_dma() wraps it and clears fields only when holding a page ref.
Affected products
- Linux Linux kernel affected versions not specified
Timeline
- 2026-09-17: disclosed