Re: [PATCH] kobject: fix uevent socket use-after-free on net namespace delete

[Greg KH]

On Thu, Sep 17, 2026 at 08:12:06PM +0530, Adarsh Das wrote:
> When a network namespace is deleted, we free its uevent socket. But
> sometimes a device in that namespace is still being removed and tries to
> send a uevent through that socket. The socket is already freed, so KASAN
> reports a use-after-free.
> 
> This patch attempts the fix of taking a lock around both the send path
> and the free path, and clear the pointer before freeing so nobody uses
> it after free.
> 
> Reported-by: syzbot <syzbot+4393dfdddf166f2de2b0@xxxxxxxxxxxxxxxxxxxxxxxxx>
> Link: https://syzkaller.appspot.com/bug?extid=4393dfdddf166f2de2b0
> Signed-off-by: Adarsh Das <adarshdas950@xxxxxxxxx>
> ---
>  lib/kobject_uevent.c | 24 +++++++++++++++++-------
>  1 file changed, 17 insertions(+), 7 deletions(-)

Did you forget an Assisted-by: tag?

How was this tested?

thanks,

greg k-h