Linux Kernel Use-After-Free Vulnerability in Key Management

A use-after-free vulnerability has been identified in the Linux kernel's key management system. The issue arises in the key_put() function, which improperly accesses a key after its reference count has dropped to zero, allowing the garbage collector to destroy it. This violation occurs because the function attempts to expedite quota reclamation by modifying garbage collection work, but inadvertently interacts with the key post-deletion, which is not permitted. The vulnerability has been addressed by introducing a flag to signal that a key is ready for garbage collection, rather than relying on the key's reference count.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, potentially allowing for arbitrary code execution or memory corruption.