Linux 7.2-rc7 Addresses A "Nasty" Race Condition Leading To Use-After-Free After 8 Years
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Linux 7.2-rc7 includes a fix for an eight-year-old race condition in the PTDUMP code, introduced with Linux 4.16 in March 2018. The bug involves a race between ptdump and vmap when mapping huge P4D, PMD, or PUD entries, which can lead to use-after-free (UAF) behavior. The issue was detected by Syzbot in June, and Lorenzo Stoakes reworked a patch originally by David Carlier — with assistance from Claude Opus 4.8 — to resolve it. The fix is merged and expected to be back-ported to stable kernel versions soon.
Questions this post answers
What is the ptdump use-after-free bug fixed in Linux 7.2-rc7?
A race condition between ptdump and vmap when mapping huge P4D, PMD, or PUD entries can cause use-after-free behavior if the ptdump page table walker accesses a PUD, PMD, or PTE page table after it has been freed. The bug was introduced with memory management changes in Linux 4.16 (March 2018) and was detected by Syzbot. The fix was merged ahead of Linux 7.2-rc7 and is expected to be back-ported to stable kernel versions. Kernel developers tracking UAF fixes and stable back-ports follow Linux security patches on daily.dev.
How was the Linux ptdump UAF race condition discovered and fixed?
Syzbot detected the use-after-free in June. Lorenzo Stoakes reworked a patch originally written by David Carlier, using Claude Opus 4.8 to help hunt down the root cause. The fix addresses the race between ptdump and vmap during huge page table entry mapping and was merged into the Linux 7.2-rc7 release cycle, with stable back-ports expected shortly after. Developers working on kernel memory safety can track patch back-ports and related fixes on daily.dev.