Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #93729 > unrolled thread

Bug#1144314: unprivileged user-triggerable use-after-free host panic bug

Back to article view | Back to linux.debian.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#1144314: unprivileged user-triggerable use-after-free host panic bug Salvatore Bonaccorso <carnil@debian.org> - 2026-08-14 21:40 +0200

#93729 — Bug#1144314: unprivileged user-triggerable use-after-free host panic bug

Hi Noah,

On Thu, Aug 13, 2026 at 02:38:34PM +0000, Noah Elias Feldt wrote:
> Subject: linux-binary-7.1.3+deb13-amd64: unprivileged user-triggerable use-after-free host panic
> Package: src:linux
> X-Debbugs-Cc: n.feldt@mittwald.de
> Version: 7.1.3-1~bpo13+1
> Severity: important
> 
> Dear Maintainer,
> 
> An unprivileged local user can panic the entire host. Reading a cgroup's
> world-readable cgroup.procs triggers a use-after-free of struct task_struct in
> css_task_iter_next(), ending in "Kernel panic - not syncing: Fatal exception in
> interrupt".
> Nodes hard-panic and reboot organically under normal load on
> the affected kernel. It also reproduces deterministically within seconds with
> the attached PoC as an ordinary user (no root, no capabilities, no namespaces).
> 
> *** Reporter, please consider answering these questions, where appropriate ***
> 
>    * What led up to the situation?
>      An unprivileged process reads its own world-readable cgroup.procs while,
>      on the same CPU, thread-group leaders in that cgroup exit and are
>      mass-reaped (attached poc.c). Not only synthetic: several of our production
>      nodes have already panicked this way organically under normal container
>      workload (Kubernetes / cri-o) on the affected kernel.
> 
>    * What exactly did you do?
>      Ran the reproducer as an ordinary user on an Debian 13 KVM guest
>      (trixie-backports kernel)
> 
>    * What was the outcome?
>      In ~12-70 s: "refcount_t: addition on 0" in css_task_iter_next()
>      (get_task_struct on usage==0) -> premature free -> NULL rcu_head.func in
>      rcu_do_batch (RIP:0x0) -> "Kernel panic - not syncing". Host dead -- same
>      signature as the organic production panics. Full trace attached (dmesg.log).
> 
>    * What outcome did you expect instead?
>      Reading cgroup.procs must never crash the host.

I can reproduce the issue up to the current kernel version
7.2~rc7-1~exp1 in experimental. Are you able to narrow down more the
range and would you be able to bisect the issue?

I will see if I can otherwise poin point it as well and if there are
already upstream issues reported about this.

Regards,
Salvatore

[toc] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web