documentation_complete: true


title: 'Perform full reference count validation'

description: |-
    Enabling this switches the refcounting infrastructure from a fast unchecked atomic_t
    implementation to a fully state checked implementation, which can have a slight
    impact in performance.
    This configuration is available from kernel 4.13, but may be available if backported
    by distros.

    {{{ describe_kernel_build_config("CONFIG_REFCOUNT_FULL", "y") | indent(4) }}}

rationale: |-
    Refcounting provides protections against various use-after-free conditions that can be
    used in security flaw exploits.

warnings:
    {{{ warning_kernel_build_config() | indent(4) }}}

severity: medium

identifiers:
    cce@rhel8: CCE-86422-3
    cce@rhel9: CCE-86423-1
    cce@rhel10: CCE-88998-0

ocil_clause: 'the kernel was not built with the required value'

ocil: |-
    {{{ ocil_kernel_build_config("CONFIG_REFCOUNT_FULL", "y") | indent(4) }}}

template:
    name: kernel_build_config
    vars:
        config: CONFIG_REFCOUNT_FULL
        value: 'y'

