In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: defer link RX stats percpu free to RCU<\/p>\n
sta_remove_link() frees a removed MLO link’s RX stats percpu buffer right
\naway, but defers only the link container to RCU:<\/p>\n
\tsta_info_free_link(&alloc->info);
\n\tkfree_rcu(alloc, rcu_head);<\/p>\n
The RX fast path reads link_sta under rcu_read_lock and writes the percpu
\nstats. A reader that resolved link_sta before the removal keeps the
\npointer. The container stays alive from the kfree_rcu, so the read still
\nworks. But the percpu block it points to is already freed. This needs
\nuses_rss. That is when pcpu_rx_stats exists.<\/p>\n
The full STA teardown frees the deflink stats only after
\nsynchronize_net(). The link removal path had no such barrier. The race is
\nhard to win in practice, but the free should still wait for RCU.<\/p>\n
Free the link together with its data from a single RCU callback, so the
\npercpu block is reclaimed only after readers drain.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: defer link RX stats percpu free to RCU<\/p>\n
sta_remove_link() frees a removed MLO link’s RX stats percpu buffer right
\na<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5466","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}