vfs_register() walks sysctl__vfs_children without SYSCTL_XLOCK while unlinking/relinking the iterated oid mid-loop
| Field | Value |
|---|---|
| ID | DF-2919 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-667 Improper Locking |
| File | sys/kern/vfs_init.c |
| Lines | 338-343 |
| Area | kern/vfs |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The sysctl renumber loop iterates the parent oid list with a naked SLIST_FOREACH while the loop body calls sysctl_unregister_oid()/ sysctl_register_oid() (each taking SYSCTL_XLOCK internally) on the very node being iterated — the iterator's SLIST_NEXT is read from the re-linked node after sorted reinsertion, so entries between the old and new position are skipped; and the unlocked traversal races any concurrent module's sysctl registration under _vfs, allowing traversal onto a node whose owning module is being torn down (UAF read). Benign in practice today because oid names are unique (at most one match exists) and the concurrent actor must be a root-driven module load/unload; hardening-grade. Fix: hold SYSCTL_XLOCK across the whole traversal using the internal register/unregister variants.
Timeline
- 2026-09-02 Discovered during pass-2 audit of vfs_init.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2919 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 707 B | ↓ raw | |
| VERDICT.md | — | 996 B | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 1010 B | view raw | |
| manifest.json | — | 481 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 616 B | view raw | |
| verdict.json | — | 2.0 KB | view raw |
DF-2919 — vfs_register naked sysctl walk with mid-loop mutation (Info-tier hardening verification)
What
vfs_register naked sysctl walk with mid-loop mutation
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2919 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Line-accurate confirmation (benign today: unique oid names mean at most one match; the concurrent actor is root-driven module load/unload; forcing the race needs a custom teardown module - not run for Info tier): vfs_register iterates sysctl__vfs_children with a naked SLIST_FOREACH (vfs_init.c:338-343) while the loop body calls sysctl_unregister_oid/sysctl_register_oid - each taking SYSCTL_XLOCK internally - on the very node being iterated, so the iterator reads oid_link from the re-linked node after sorted reinsertion (skipping entries between old and new position), and the unlocked traversal can race another module's registration onto a node whose owner is being torn down (UAF read). Fix (find-then-renumber restructure, no mid-loop mutation) compiled in the fix kernel.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testableRestructure compiled and booted (all vfs modules registered through the patched path at boot).
Confirmed kernel references
Detail
Evidence (decisive lines)
sourcenote.txt: traversal/mutation analysis; fix.diff restructure
PoC changes
none
Verified recommended fix
Find the unique match first, then unregister/renumber/re-register outside the traversal
Verdict
Line-accurate confirmation (benign today: unique oid names mean at most one match; the concurrent actor is root-driven module load/unload; forcing the race needs a custom teardown module - not run for Info tier): vfs_register iterates sysctl__vfs_children with a naked SLIST_FOREACH (vfs_init.c:338-343) while the loop body calls sysctl_unregister_oid/sysctl_register_oid - each taking SYSCTL_XLOCK internally - on the very node being iterated, so the iterator reads oid_link from the re-linked node after sorted reinsertion (skipping entries between old and new position), and the unlocked traversal can race another modules registration onto a node whose owner is being torn down (UAF read). Fix (find-then-renumber restructure, no mid-loop mutation) compiled in the fix kernel.
No comments yet.