Read-Copy-Update (RCU) is widely used in the Linux kernel to manage concurrent access to shared data structures.However, improper synchronization when removing RCU protected hash table entries can lead to stale pointers, inconsistent lookups, and critical use after free (UAF) vulnerabilities. This paper investigates a driver-level synchronization issue arising from the omission of explicit synchronize_rcu() calls during hash table updates, using a discovered weakness in the Intel ICE network drivers Virtual Function (VF) management. Previous kernel vulnerabilities, such as a bug in the Reliable Datagram Sockets (RDS) subsystem, show how improper RCU synchronization can directly cause kernel crashes. Experimental results demonstrate that removing VF entries without proper synchronization leaves transient stale entries, delays memory reclamation, and results in significant memory fragmentation under rapid insert/delete workloads. RCU hash tables are widely deployed in Linux kernel subsystems such as networking, virtualization, and file systems; improper synchronization can cause memory fragmentation, kernel instability, and out-of-memory (OOM) conditions. Mitigations are proposed, recommending explicit insertion of synchronize_rcu() calls to ensure timely and safe memory reclamation. These findings reinforce established best practices for RCU synchronization, highlighting their importance for maintaining kernel stability and memory safety. Keywords: RCU, kernel synchronization, hash tables, ICE driver, memory fragmentation, use-after-free

翻译：读-复制-更新（RCU）在Linux内核中被广泛用于管理对共享数据结构的并发访问。然而，在移除受RCU保护的哈希表条目时，若同步不当会导致悬垂指针、查找不一致以及严重的使用后释放（UAF）漏洞。本文通过分析Intel ICE网络驱动虚拟功能（VF）管理中发现的一个缺陷，研究了在哈希表更新期间因省略显式synchronize_rcu()调用而引发的驱动级同步问题。先前的内核漏洞，如可靠数据报套接字（RDS）子系统中的一个错误，已表明RCU同步不当可直接导致内核崩溃。实验结果表明，在缺乏适当同步的情况下移除VF条目会残留瞬态过时条目，延迟内存回收，并在快速插入/删除工作负载下导致显著的内存碎片化。RCU哈希表广泛应用于Linux内核子系统，如网络、虚拟化和文件系统；同步不当可能引发内存碎片化、内核不稳定以及内存耗尽（OOM）状况。本文提出了缓解措施，建议显式插入synchronize_rcu()调用以确保及时且安全的内存回收。这些发现强化了RCU同步的既定最佳实践，突显了其对维护内核稳定性和内存安全的重要性。关键词：RCU，内核同步，哈希表，ICE驱动，内存碎片化，使用后释放