https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:53:31 +0000 https://cve.radiocsirt.org/vuln/cve-2021-47012 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>RDMA/siw: Fix a use after free in siw_alloc_mr</p> <p>Our code analyzer reported a UAF.</p> <p>In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr-&gt;mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr-&gt;mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr-&gt;mem is used in siw_mr_drop_mem(mr).</p> <p>My patch moves &#34;mr-&gt;mem = mem&#34; behind the if (xa_alloc_cyclic(..)&lt;0) {} section, to avoid the uaf.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>RDMA/siw: Fix a use after free in siw_alloc_mr</p> <p>Our code analyzer reported a UAF.</p> <p>In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr-&gt;mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr-&gt;mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr-&gt;mem is used in siw_mr_drop_mem(mr).</p> <p>My patch moves &#34;mr-&gt;mem = mem&#34; behind the if (xa_alloc_cyclic(..)&lt;0) {} section, to avoid the uaf.</p> https://cve.radiocsirt.org/vuln/cve-2021-47012