DF-2807
Short-buffer read() on /dev/udev silently drops the event and reports ENOMEM
| Field | Value |
|---|---|
| ID | DF-2807 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-404 Improper Resource Shutdown (event loss) |
| File | sys/kern/kern_udev.c |
| Lines | 842-860 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
When uio_resid < strlen(xml)+1 the handler sets error = ENOMEM but still advances the reader marker past the event and reaps it: the event is consumed and destroyed without being delivered — silent event loss to a reader issuing a too-small read(), plus a misleading errno. Root-gated; consumers using small buffers would silently miss hotplug events. Fix: on the short-buffer path break WITHOUT moving the marker and return EMSGSIZE so the reader can retry with a larger buffer.
Timeline
- 2026-08-31 Discovered during pass-2 audit of kern_udev.c (GLM 5.3).
No comments yet.