Linux Kernel Per-CPU Counter Use-After-Free Vulnerability in Module Tag Management

A use-after-free vulnerability has been identified in the Linux kernel's handling of per-CPU counters for module allocation tags. When a module is unloaded, it retains memory for its allocation tags until they are no longer in use. However, the per-CPU counters referenced by these tags are freed when the module is unloaded, leading to a use-after-free condition if the module's memory is accessed afterward. This vulnerability has been addressed by dynamically allocating per-CPU counters for module tags, ensuring they remain available for in-use tags after a module is unloaded. This change also eliminates the need for a larger PERCPU_MODULE_RESERVE when memory allocation profiling is enabled, as per-CPU memory for counters no longer requires reservation.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, potentially allowing for arbitrary memory access or manipulation.