DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2806

udev_event_attach returns stale ENOMEM on the success path when the device dict already exists

Field Value
ID DF-2806
Status new
Severity Info
CVSS 3.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE CWE-252 / erroneous status propagation
File sys/kern/kern_udev.c
Lines 589, 608-618
Area kern
Confidence certain
Discovered 2026-08-31
Pass 2 (GLM 5.3 second pass)
Bucket base:kern
Reported pending
Known CVE none
CVE match novel

Summary

udev_event_attach() initializes error = ENOMEM. In the non-alias branch, if udev_get_dict() returns a non-NULL dict on the first iteration the init loop body never runs, error is never reset, and the function returns ENOMEM after successfully queueing the ATTACH event. Current callers ignore the return; any future caller checking it would mis-handle every re-attach. Fix: error = 0 at :589, ENOMEM only on explicit failures.

Timeline

  • 2026-08-31 Discovered during pass-2 audit of kern_udev.c (GLM 5.3).

Discussion (0)

No comments yet.