Vulnerability feed

Executive summary

The advisory describes a race condition in the Linux kernel strparser stream parser code, which could lead to a use-after-free when the parser is torn down while a receive call is still running. The advisory notes that a public reproducer exists that turns the issue into an exploit, and it does not state a severity score. The fix is a kernel patch; the advisory does not state affected or fixed version ranges beyond the referenced commit.

Technical summary

The flaw is a race condition, described as a possible use-after-free, between strp_recv() running in softirq or socket-locked context and strp_done() tearing down the parser. The race requires that strp_stop() is called without guaranteeing in-flight strp_recv() calls have finished before strp_done() runs; the advisory says only espintcp can be affected. The fix adds a lock_sock/release_sock pair in strp_done() to synchronize with pending strp_recv(), changes the stopped, paused, aborted, interrupted and unrecov_intr bitfields to u8 fields, and updates documentation to say the socket lock must not be held when calling strp_done(). The advisory does not state affected or fixed kernel version numbers, a CVSS score, workarounds, or detection guidance beyond the patch itself.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/0984ebc631792ac…105112ee74a6b8f1efcc

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxLinuxLinux kernelLinux strparserLinux espintcp