Fixed
Created: Dec 8, 2025
Updated: Jun 1, 2026
Resolved Date: May 25, 2026
Found In Version: 10.22.33.1
Fix Version: 10.22.33.24
Severity: Standard
Applicable for: Wind River Linux LTS 22
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]fs/proc: fix uaf in proc_readdir_de()[EOL][EOL]Pde is erased from subdir rbtree through rb_erase(), but not set the node[EOL]to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE()[EOL]set the erased node to EMPTY, then pde_subdir_next() will return NULL to[EOL]avoid uaf access.[EOL][EOL]We found an uaf issue while using stress-ng testing, need to run testcase[EOL]getdent and tun in the same time. The steps of the issue is as follows:[EOL][EOL]1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current[EOL] pde is tun3;[EOL][EOL]2) in the [time windows] unregister netdevice tun3 and tun2, and erase[EOL] them from rbtree. erase tun3 first, and then erase tun2. the[EOL] pde(tun2) will be released to slab;[EOL][EOL]3) continue to getdent process, then pde_subdir_next() will return[EOL] pde(tun2) which is released, it will case uaf access.[EOL][EOL]CPU 0 ( CPU 1[EOL)-------------------------------------------------------------------------EOL]traverse dir /proc/pid/net/dev_snmp6/ ( unregister_netdevice(tun->dev) //tun3 tun2[EOL)sys_getdents64() |EOL] iterate_dir() ([EOL) proc_readdir() |EOL] proc_readdir_de() ( snmp6_unregister_dev()[EOL) pde_get(de); | proc_remove()EOL] read_unlock(&proc_subdir_lock); ( remove_proc_subtree()[EOL) | write_lock(&proc_subdir_lock);EOL] [time window] ( rb_erase(&root->subdir_node, &parent->subdir);[EOL) | write_unlock(&proc_subdir_lock);EOL] read_lock(&proc_subdir_lock); ([EOL) next = pde_subdir_next(de); |EOL] pde_put(de); ([EOL) de = next; //UAF |EOL][EOL]rbtree of dev_snmp6[EOL] ([EOL) pde(tun3)[EOL] / NULL pde(tun2)
