objcache_destroy() purges remote CPUs' per-cpu magazines under only a local critical section — no cross-CPU exclusion (contract-reliant teardown; KKASSERT panic / magazine UAF if any in-flight get/put exists)
| Field | Value |
|---|---|
| ID | DF-2814 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-667 Improper Locking |
| File | sys/kern/kern_objcache.c |
| Lines | 929-939 (vs doc :96-97; mag_purge :780-788) |
| Area | kern |
| Confidence | speculative |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
percpu_objcache is documented as "protected by crit_enter()" on ITS OWN cpu, yet objcache_destroy() iterates ALL cpus and calls mag_purge(freeit=TRUE) on each cpucache's magazines with only a crit_enter() on the DESTROYER's cpu — zero protection against a get/put in flight on the remote cpu. mag_purge's "mag ripped out" defense is neutralized for freeit=TRUE: the KKASSERT panics INVARIANTS kernels, and on stock kernels *magp=NULL + kfree(mag) leaves cpucache->previous_magazine pointing at freed memory → magazine UAF on the next get/put. In-tree destroy callers audited all quiesce via module refcounts/mount locks first — speculative/defense-in-depth; if any future caller races: panic or magazine UAF.
Recommended fix
Quiesce remote CPUs before purging their magazines (IPI-run the mag_purge pair on the owning cpu), or add an explicit per-cache dying flag checked under crit in get/put that diverts to the depot/free path once teardown begins.
Timeline
- 2026-08-31 Discovered during pass-2 audit of kern_objcache.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2814 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| v26harness.c | — | 14.3 KB | view raw | |
| run.log | — | 347 B | view raw | |
| fix.diff | — | 2.1 KB | view raw |
Fix verification
fixedPatched kernel: 5 full destroy-vs-hammer race rounds with memory poisoning completed with no crash (baseline: kernel fault in objcache_put on round 0). The oc_dying flag plus IPI barrier closes the remote-magazine window.
cmd=5 on patched kernel: SURVIVED 5 race rounds (no UAF fault observed)
Confirmed kernel references
Detail
Exploit chain
objcache_create -> CPU1 thread get/put loop -> objcache_destroy on CPU0 purges+frees remote magazines under local crit only -> CPU1 derefs freed magazine -> kernel fault in objcache_put
Evidence (decisive lines)
v26harness.c t5 (cmd=5); df2814_mod.log: CONTROL ok, round 0 -> Stopped at objcache_put+0x4b kernel fault
PoC changes
none (crashed round 0 before the poison phase)
Verified recommended fix
--- sys/kern/kern_objcache.c 2026-06-29 12:51:19.000000000 +0000
Verdict
Reproduced on the first race round. The harness creates a kmalloc-backed objcache, starts a kernel thread pinned to CPU1 hammering objcache_get/objcache_put in a loop, and then calls objcache_destroy (sys/kern/kern_objcache.c:907-943) from CPU0. The destroy path purges every remote CPUs magazines with only the destroyers local critical section (:929-939) - no cross-CPU exclusion - so the CPU1 thread faults dereferencing a freed magazine: Stopped at objcache_put+0x4b: movslq (%rax),%rdx (kernel-mode page fault inside objcache_put reading mag->rounds of a kfree()d magazine), wedging the guest in DDB before the harnesss poison step even ran. The quiesced CONTROL (create/get/put/destroy with no remote hammer) completed cleanly. The per-cpu magazine contract (crit_enter on the OWNING cpu) is documented at :745-749 and is exactly what destroy violates. All in-tree destroy callers quiesce first, so the bug is contract-reliant defense-in-depth as the finding states - but the UAF is trivially triggerable by any in-tree code that ever gets the quiesce wrong.
No comments yet.