sysctl_intrnames traverses every CPU's interrupt-handler lists unsynchronized → use-after-free read / kernel heap disclosure via hw.intrnames

Summary

The hw.intrnames sysctl handler walks the per-CPU i_reclist chains of ALL cpus from the reader's own CPU with no critical section, no migration, and no lock. unregister_int unlinks a rec under a critical section on the target CPU only, then frees rec/rec->name with kfree after crit_exit. A reader that has already loaded a rec pointer but is timesliced or preempted (an ordinary user syscall thread) will, on resume, dereference freed memory: rec->next and rec->name passed as %s into ksnprintf. If the freed rec chunk is reclaimed by attacker-influenced kernel allocations, rec->name becomes an attacker-influenced pointer and ksnprintf emits a NUL-terminated string read from an arbitrary kernel address to the unprivileged reader — a kernel memory disclosure; otherwise the walk corrupts on garbage and panics.

Threat model & preconditions

Any local user can read hw.intrnames (CTLFLAG_RD, no privilege; systat -i uses it). The freeing side needs a concurrent driver teardown: kldunload/drvctl detach (root), USB/PCIe hot-unplug (physical attacker or VM host action), or the shutdown/reboot detach storm racing a reader — repeatable arbitrary-address string leak for a physical attacker.

Recommended fix

Migrate to each CPU and take a critical section around the list traversal (matching the register/unregister protocol), or maintain a stable snapshot under a spin/token — minimal patch in the row above.

Timeline

• 2026-08-31 Discovered during pass-2 audit of kern_intr.c (GLM 5.3); free-side needs root/hardware trigger on the stock guest, honest not-live-verified.