HIGH Introduced in 5.8
genetlink PolicyDump UAF
CVE-2026-97901
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and remain pending after the initial request. Netlink pins the module which owns the dump callback, but in this case that is the controller's owner rather than the target family's owner. The target family can consequently be unregistered and its module unloaded while a policy dump is pending. Advancing the dump then dereferences policy memory from the unloaded module. Take a reference to the target family's module when the dump starts. Drop it from the error and done paths. This matches the lifetime for which the dump context retains the family and policy pointers.
02KernelScan AI Analysis
Risk summary
A local user with access to a netlink socket can trigger a use-after-free in the generic netlink policy dump mechanism by keeping a dump pending while the target family's module is unloaded. This could lead to kernel memory corruption, information disclosure, or a system crash. Systems that frequently load and unload kernel modules, or run untrusted local code, are at higher risk.
Vulnerability analysis
The generic netlink controller's policy dump interface retains pointers to a target family's operation and policy tables across a multi-part dump, but it only holds a reference to the controller's own module rather than the target family's module. If the target family is unregistered and its module unloaded while a dump is pending, continuing the dump dereferences memory that has already been freed. The fix pins the target family's module for the entire duration of the dump, releasing the reference only when the dump completes or is cancelled. Any local user with access to a netlink socket can start a policy dump; exploitation additionally requires the target family's module to be unloaded while the dump is pending, which typically requires administrative privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.8 | 6.12.112 | 6e4d746e55c8 |
| 6.18 | 5.8 | 6.18.53 | 508387ad95ef |
| 7.2 | 5.8 | 7.2.7 | 6d8e653fcf1c |
| mainline | 5.8 | 7.3-rc3 | 6a1094c34d17 |