Database/Kernel, userspace & hypervisor
Linux kernel crypto/essiv: EBUSY from a backlogged request frees live data, giving a use-after-free
Impact
The essiv template only treated -EINPROGRESS as a non-terminal return and freed request-related data for every other value, so a caller using MAY_BACKLOG that gets -EBUSY has its data freed while the request is still queued - a use-after-free in kernel crypto context. essiv is the IV generator used by dm-crypt, so this sits under encrypted local NVMe on GPU nodes where encryption-at-rest is mandated. The failure needs the crypto backlog to be full, which happens under heavy parallel I/O rather than on an idle host.
Who can reach it
Local - requires I/O through a dm-crypt volume configured with an essiv IV generator and enough concurrency to fill the crypto backlog. No network path and no special capability beyond writing to the encrypted volume.
What to do
Update to a stable kernel containing the essiv EBUSY fix (commits 69c67d451fc1, 796e02cca30a, 840a1d3b77c1, a006aa3eedb8, b5a772adf45a) and reboot the node; dm-crypt volumes cannot be re-stacked under live workloads. No mitigation short of patching is described in the record.
References
Related entries
- Linux kernel bpf: preemption left enabled in bpf_event_output corrupts shared perf sample bufferCVE-2023-54173 · Linux kernel BPF (bpf_event_output preemption)High
- Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2023-54202 · Linux i915 GPU kernel driverHigh
- Linux kernel (netfilter pipapo): Inactive elements mishandled in nft_pipapo_walk - use-after-free, local rootCVE-2023-6817 · Linux kernel (netfilter pipapo)High
- Linux kernel (io_uring): Page use-after-free via io_uring buffer-ring mmap - unprivileged local user to rootCVE-2024-0582 · Linux kernel (io_uring)High
- Linux kernel (nf_tables): Use-after-free in nft_verdict_init() - double-free to local rootCVE-2024-1086 · Linux kernel (nf_tables)High
- Linux kernel (ksmbd): Use-after-free in ksmbd_tcp_new_connection() - in-kernel SMB serverCVE-2024-26592 · Linux kernel (ksmbd)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.