linux-kernel - Re: [PATCH 6.12.y] cgroup: Fix kernfs_node UAF in css_free_rwork

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <xlebwk6u4a2uwxzexxwnhwldjtgcd5gl3srtciujayegoucweq@gx5ny36x3pu4>
Date: Fri, 30 Jan 2026 17:14:15 +0100
From: Michal Koutný <mkoutny@...e.com>
To: "T.J. Mercier" <tjmercier@...gle.com>
Cc: stable@...r.kernel.org, tj@...nel.org, hannes@...xchg.org, 
	cgroups@...r.kernel.org, hawk@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 6.12.y] cgroup: Fix kernfs_node UAF in css_free_rwork_fn

On Thu, Jan 29, 2026 at 11:11:48AM -0800, "T.J. Mercier" <tjmercier@...gle.com> wrote:
> On Thu, Jan 29, 2026 at 11:10 AM T.J. Mercier <tjmercier@...gle.com> wrote:
> >
> > This fix patch is not upstream, and is applicable only to kernels 6.10
> > (where the cgroup_rstat_lock tracepoint was added) through 6.15 after
> > which commit 5da3bfa029d6 ("cgroup: use separate rstat trees for each
> > subsystem") reordered cgroup_rstat_flush as part of a new feature
> > addition and inadvertently fixed this UAF.
> 
> I am proposing we apply this one-off patch to stable rather than
> backporting 5da3bfa029d6 ("cgroup: use separate rstat trees for each
> subsystem") and its fixes to 6.12.y.

That's a performance optimization rework, IMO too big for stable.

For the conservative stable-specific fixup:

Acked-by: Michal Koutný <mkoutny@...e.com>

Thanks!

Download attachment "signature.asc" of type "application/pgp-signature" (266 bytes)