Patch "rxrpc: Fix UAF in rxgk_issue_challenge()" has been added to the 6.18-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix UAF in rxgk_issue_challenge()

to the 6.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-uaf-in-rxgk_issue_challenge.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 107a4cb0d47e735830f852d83970d5c81f8e1e08 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Tue, 9 Jun 2026 15:09:07 +0100
Subject: rxrpc: Fix UAF in rxgk_issue_challenge()

From: David Howells <dhowells at redhat.com>

commit 107a4cb0d47e735830f852d83970d5c81f8e1e08 upstream.

Fix rxgk_issue_challenge() to free the page containing the challenge
content after invoking the tracepoint as the whdr passed to the tracepoint
points into the page just freed.

Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
Reported-by: Marc Dionne <marc.dionne at auristor.com>
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260609140911.838677-4-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/rxgk.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/rxrpc/rxgk.c b/net/rxrpc/rxgk.c
index a1ee102abae1..77a67ace1d24 100644
--- a/net/rxrpc/rxgk.c
+++ b/net/rxrpc/rxgk.c
@@ -687,16 +687,17 @@ static int rxgk_issue_challenge(struct rxrpc_connection *conn)
 	ret = do_udp_sendmsg(conn->local->socket, &msg, len);
 	if (ret > 0)
 		rxrpc_peer_mark_tx(conn->peer);
-	__free_page(page);
 
 	if (ret < 0) {
 		trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
 				    rxrpc_tx_point_rxgk_challenge);
+		__free_page(page);
 		return -EAGAIN;
 	}
 
 	trace_rxrpc_tx_packet(conn->debug_id, whdr,
 			      rxrpc_tx_point_rxgk_challenge);
+	__free_page(page);
 	_leave(" = 0");
 	return 0;
 }
-- 
2.55.0



Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.18/rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch
queue-6.18/rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch
queue-6.18/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
queue-6.18/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/rxrpc-fix-ackall-packet-handling.patch
queue-6.18/rxrpc-fix-leak-of-connection-from-oob-challenge.patch
queue-6.18/rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch
queue-6.18/afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch
queue-6.18/rxrpc-fix-socket-notification-race.patch
queue-6.18/rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch
queue-6.18/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch
queue-6.18/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
queue-6.18/afs-fix-null-pointer-dereference-in-afs_get_tree.patch
queue-6.18/rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch
queue-6.18/rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch
queue-6.18/afs-fix-uncancelled-rxrpc-oob-message-handler.patch
queue-6.18/rxrpc-fix-uaf-in-rxgk_issue_challenge.patch