[PATCH 0/2] ipe: fix two use-after-frees

[Fan Wu]

On 9/22/2026 8:13 PM, Fan Wu wrote:
> This series fixes two use-after-free bugs in IPE, both found by a recent
> AI-assisted code scan.
> 
> The first one is in the policy load audit path, where a concurrent
> delete can free the policy while it is being audited. The second one is
> in the dm-verity root hash path, where ->preresume can free a digest
> that policy evaluation is still using.
> 
> Fan Wu (2):
>   ipe: fix use-after-free when auditing a newly loaded policy
>   ipe: protect the dm-verity root hash with RCU
> 
>  security/ipe/eval.c      | 12 ++++++++----
>  security/ipe/eval.h      |  2 +-
>  security/ipe/fs.c        |  8 +++-----
>  security/ipe/hooks.c     | 22 +++++++++++++++++-----
>  security/ipe/policy_fs.c |  3 +++
>  5 files changed, 32 insertions(+), 15 deletions(-)
> 
> 
> base-commit: 93f51579e7df248780214094418f205253383cc5

I added both into ipe/text for testing.

-Fan