$ the-wire · showcase
IPHETH DRIVER PLUGS USE-AFTER-FREE HOLE ON USB DISCONNECT
By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology
A critical use-after-free vulnerability in the iPhone USB tethering driver can leave kernel work queues armed after interface shutdown, exposing memory corruption on device unplug.
The ipheth driver had a dangerous gap in its disconnect path: carrier-check work could be re-armed after the interface closed and drained its queues, then survive until the netdev itself was freed [1]. This is the kind of race condition that persists silently until the hardware is unplugged with traffic in flight. Separately, Eric Dumazet removed a noisy WARN_ON from the multicast loop check that was triggering on non-INET sockets like AF_PACKET, which never supported multicast loopback options in the first place [2]. On the MPTCP side, Matthieu Baerts tightened suboption parsing to reject mutually exclusive combinations that the RFC forbids but the code wasn't prepared to handle, then cleaned up now-unreachable validation logic downstream [3] [4]. A fourth MPTCP fix addresses pathological receive-path drops that were leaking forward-allocated memory unboundedly when skbs hit errors before queueing [5].
Action items
- → Apply ipheth UAF fix [ref:1] immediately if running tethering over USB torvalds/linux [immediate]
- → Monitor MPTCP connection behavior after multipath receive-path hardening [ref:3] torvalds/linux [monitor]
References
- [1] net: usb: ipheth: fix carrier_work UAF on disconnect torvalds/linux ↗
- [2] net: remove WARN_ON_ONCE() from sk_mc_loop() torvalds/linux ↗
- [3] mptcp: avoid combining some incoming suboptions torvalds/linux ↗
- [4] mptcp: remove MPC && MPJ check torvalds/linux ↗
- [5] mptcp: reclaim forward-allocated memory on RX path errors torvalds/linux ↗
