Summary

Global singly-headed doubly-linked list rooted at safe_mem_hdr_first (safe_mem.c:55) is plain global storage. _alloc_safe_mem insertion walk at :97-102 and _free_safe_mem unlink at :145-150 have NO lock NO atomic NO serialization against tbridge ioctls. Two concurrent TBRIDGE_GETRESULT ioctls each spawn separate kthread running testcase (tbridge.c:266-267) both calling alloc/free on same global list. Insert: both threads observe same tail both write hdrp->next losing one insertion orphaning other. Unlink: prev/next pointers can already be stale or zeroed (bzero at :154 zeros entire region including just-unlinked hdr) so subsequent free reads hdr->next->prev through pointer just bzero-d = classic UAF. No lock anywhere in sys/dev/misc/tbridge/ ioctl handler does not serialize. Attacker: root /dev/tbridge 0600 root:wheel two TBRIDGE_GETRESULT ioctls concurrent. Impact: UAF convertible to arbitrary kernel free or corrupted function-pointer deref.