DF-2806
udev_event_attach returns stale ENOMEM on the success path when the device dict already exists
| Field | Value |
|---|---|
| ID | DF-2806 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-252 / erroneous status propagation |
| File | sys/kern/kern_udev.c |
| Lines | 589, 608-618 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
udev_event_attach() initializes error = ENOMEM. In the non-alias branch, if udev_get_dict() returns a non-NULL dict on the first iteration the init loop body never runs, error is never reset, and the function returns ENOMEM after successfully queueing the ATTACH event. Current callers ignore the return; any future caller checking it would mis-handle every re-attach. Fix: error = 0 at :589, ENOMEM only on explicit failures.
Timeline
- 2026-08-31 Discovered during pass-2 audit of kern_udev.c (GLM 5.3).
No comments yet.