Linux Kernel IPvlan Use-After-Free Vulnerability in Link Management

A use-after-free vulnerability has been identified in the Linux kernel's IPvlan implementation, specifically in the 'ipvlan_get_iflink' function. This issue arises because IPvlan does not maintain a reference count for the lower device, unlike other similar virtual network devices. When the linkwatch work is triggered for an IPvlan device, the lower device may have already been freed, leading to a use-after-free condition where 'ipvlan->phy_dev' is accessed after the memory has been released. The vulnerability was reported by syzbot and can be exploited by manipulating the linkwatch events for the affected IPvlan device.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, which may be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.