In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: smc: fix splice entry lifetime imbalance in smc_rx_splice<\/p>\n
smc_rx_splice() passes pages to splice_to_pipe() before taking the
\nreferences that cover the lifetime of each splice entry. In the
\nVM-backed RMB path, splice_to_pipe() may drop unqueued entries through
\nsmc_rx_spd_release(), while queued entries are released later via the
\npipe buffer callback.<\/p>\n
The old post-splice accounting also derives the number of queued VM pages
\nfrom an offset mutated while building the descriptor, and a multi-page
\nsplice pairs one sock_hold() with multiple sock_put() calls.<\/p>\n
Take the page and socket references for every candidate entry before
\nsplice_to_pipe(), and drop the matching private state, page reference,
\nand socket reference from smc_rx_spd_release() for entries that never
\nget queued. This fixes a refcount imbalance that can underflow page
\nrefcounts and trigger a use-after-free.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: smc: fix splice entry lifetime imbalance in smc_rx_splice<\/p>\n
smc_rx_splice() passes pages to splice_to_pipe() before taking the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11232","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}