https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:39:06 +0000 https://vulnerability.circl.lu/vuln/cve-2025-68319 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netconsole: Acquire su_mutex before navigating configs hierarchy</p> <p>There is a race between operations that iterate over the userdata cg_children list and concurrent add/remove of userdata items through configfs. The update_userdata() function iterates over the nt-&gt;userdata_group.cg_children list, and count_extradata_entries() also iterates over this same list to count nodes.</p> <p>Quoting from Documentation/filesystems/configfs.rst: &gt; A subsystem can navigate the cg_children list and the ci_parent pointer &gt; to see the tree created by the subsystem. This can race with configfs&#39; &gt; management of the hierarchy, so configfs uses the subsystem mutex to &gt; protect modifications. Whenever a subsystem wants to navigate the &gt; hierarchy, it must do so under the protection of the subsystem &gt; mutex.</p> <p>Without proper locking, if a userdata item is added or removed concurrently while these functions are iterating, the list can be accessed in an inconsistent state. For example, the list_for_each() loop can reach a node that is being removed from the list by list_del_init() which sets the nodes&#39; .next pointer to point to itself, so the loop will never end (or reach the WARN_ON_ONCE in update_userdata() ).</p> <p>Fix this by holding the configfs subsystem mutex (su_mutex) during all operations that iterate over cg_children. This includes: - userdatum_value_store() which calls update_userdata() to iterate over cg_children - All sysdata…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netconsole: Acquire su_mutex before navigating configs hierarchy</p> <p>There is a race between operations that iterate over the userdata cg_children list and concurrent add/remove of userdata items through configfs. The update_userdata() function iterates over the nt-&gt;userdata_group.cg_children list, and count_extradata_entries() also iterates over this same list to count nodes.</p> <p>Quoting from Documentation/filesystems/configfs.rst: &gt; A subsystem can navigate the cg_children list and the ci_parent pointer &gt; to see the tree created by the subsystem. This can race with configfs&#39; &gt; management of the hierarchy, so configfs uses the subsystem mutex to &gt; protect modifications. Whenever a subsystem wants to navigate the &gt; hierarchy, it must do so under the protection of the subsystem &gt; mutex.</p> <p>Without proper locking, if a userdata item is added or removed concurrently while these functions are iterating, the list can be accessed in an inconsistent state. For example, the list_for_each() loop can reach a node that is being removed from the list by list_del_init() which sets the nodes&#39; .next pointer to point to itself, so the loop will never end (or reach the WARN_ON_ONCE in update_userdata() ).</p> <p>Fix this by holding the configfs subsystem mutex (su_mutex) during all operations that iterate over cg_children. This includes: - userdatum_value_store() which calls update_userdata() to iterate over cg_children - All sysdata…</p> https://vulnerability.circl.lu/vuln/cve-2025-68319