In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_route: fix fastmap use-after-free on filter

The route4 classifier maintains a 16-slot fastmap cache that stores raw
struct route4_filter pointers indexed by (id, iif). The reader
(route4_classify) populates this cache via route4_set_fastmap() for every
classified packet that hits a filter. The writer (route4_delete,
route4_change) clears the cache via route4_reset_fastmap() before
RCU-deferred kfree of the filter.

This creates a UAF race:
 1. Reader walks the RCU-protected bucket chain, finds filter f
 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()
 3. Reader calls route4_set_fastmap() and writes f into the cache
    *after* the writer's reset, caching a pointer about to be freed
 4. After the RCU grace period, kfree(f) executes
 5. Next classified packet on the same (id, iif) tuple hits the stale
    fastmap entry and reads f->res from freed memory

Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a
concurrent add/delete stress test (provided by both zdi and Santosh).
Both triggered KASAN slab-use-after-free reports in the route4 fastmap
paths.

Fix:
Introduce a per-filter boolean dying flag to suppress stale fastmap
republishing by in-flight readers.

https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc

https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df

https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f

https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f

https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139

https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1

https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d

https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/cls_route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1109c00547fc66df45b9ff923544be4c1e1bec13","lessThan":"7897198b26445b4009a057bda1986b94a99e5d5f","versionType":"git","status":"affected"},{"version":"1109c00547fc66df45b9ff923544be4c1e1bec13","lessThan":"820f083c294ad6d319c02a7d43294f2ed2565139","versionType":"git","status":"affected"},{"version":"1109c00547fc66df45b9ff923544be4c1e1bec13","lessThan":"5ec9001be6d0eb527251125632ec8fe88278897f","versionType":"git","status":"affected"},{"version":"1109c00547fc66df45b9ff923544be4c1e1bec13","lessThan":"b969984b2bdc85d721ce4047cd270cd37ec705a2","versionType":"git","status":"affected"},{"version":"1109c00547fc66df45b9ff923544be4c1e1bec13","lessThan":"a17f636c9330eac879822ce29f998e5abd1b72c1","versionType":"git","status":"affected"},{"version":"1109c00547fc66df45b9ff923544be4c1e1bec13","lessThan":"0e7a8cf8895b06d07c7311f028eba16ad742b9bc","versionType":"git","status":"affected"},{"version":"1109c00547fc66df45b9ff923544be4c1e1bec13","lessThan":"ae9aff87025219005a2d16b4fe83d6f24643e50d","versionType":"git","status":"affected"},{"version":"1109c00547fc66df45b9ff923544be4c1e1bec13","lessThan":"47d7f7051253bdc02b1d245d87e38f16d31a74df","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/cls_route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.18","status":"affected"},{"version":"0","lessThan":"3.18","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.152","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.104","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.45","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.9","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]