Executive Summary

This vulnerability exists in the Linux kernel's IP Virtual Server (ipvs) component. Specifically, when editing a service's scheduler using the function ip_vs_edit_service(), the pointer to the scheduler (svc->scheduler) is cleared too late—after the scheduler module has already initiated Read-Copy-Update (RCU) callbacks. This timing issue can cause packets to be processed by the old scheduler even though the scheduler's associated data (svc->sched_data) has already been freed after the RCU grace period.

The fix involves clearing the scheduler pointer earlier in the process (in ip_vs_unbind_scheduler()), before any RCU callbacks are scheduled by the done_service method. Additionally, if the new scheduler fails to initialize when replacing the old one, the system attempts to restore the old scheduler while still returning an error code.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to packets being processed by a scheduler whose associated data has already been freed, potentially causing undefined behavior such as memory corruption or system instability in the Linux kernel's IPVS subsystem. This could result in crashes, denial of service, or unpredictable network behavior on affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by updating the Linux kernel to include the fix that clears the svc scheduler pointer early during the edit process in ipvs. Therefore, the immediate step to mitigate this vulnerability is to update your Linux kernel to a version that contains this fix.

Useful 0 Not Useful 0