Description
In the Linux kernel, the following vulnerability has been resolved:
mm: cachestat: fix folio read-after-free in cache walk
In cachestat, we access the folio from the page cache's xarray to compute
its page offset, and check for its dirty and writeback flags. However, we
do not hold a reference to the folio before performing these actions,
which means the folio can concurrently be released and reused as another
folio/page/slab.
Get around this altogether by just using xarray's existing machinery for
the folio page offsets and dirty/writeback states.
This changes behavior for tmpfs files to now always report zeroes in their
dirty and writeback counters. This is okay as tmpfs doesn't follow
conventional writeback cache behavior: its pages get "cleaned" during
swapout, after which they're no longer resident etc.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.5 | 6.6.21 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.7.9-1 | — |
| Debian 13 | linux | 6.7.9-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +13 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2002.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.3.0-427.35.1.el9_4 | RHSA-2024:6567 |
| RHEL 9 | rv +64 | 5.14.0-427.35.1.el9_4 | RHSA-2024:6567 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | bpftool | 7.3.0-427.35.1.el9_4 | ALSA-2024:6567 |
| AlmaLinux 9 | rv +60 | 5.14.0-427.35.1.el9_4 | ALSA-2024:6567 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | kernel | 5.14.0-427.35.1.el9_4 | RXSA-2024:6567, RLSA-2024:6567 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | bpftool | 7.3.0-427.35.1.el9_4 | ELSA-2024-6567 |
| Oracle Linux 9 | rv +27 | 5.14.0-427.35.1.el9_4 | ELSA-2024-6567 |
Advisories 7
- RHSA-2024:6567 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ALSA-2024:6567 Moderate: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2024:6567 Moderate: kernel security update Rocky Linux Security Advisories · Feb 5, 2026
- RXSA-2024:6567 Moderate: kernel security update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2025-1293 IBM DataPower Gateway: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 3, 2025
- WID-SEC-2024-0632 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 29, 2025
- ELSA-2024-6567 Moderate: kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 11, 2024