Към съдържанието
Търсене

CVE-2025-39948: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each buffer in the current frame. This function was introduced as part of handling multi-buffer XDP support in the ice driver. It works by iterating over the buffers from first_desc up to 1 plus the total number of fragments in the frame, cached from before the XDP program was executed. If the hardware posts a descriptor with a size of 0, the logic used in ice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added as fragments in ice_add_xdp_frag. Since the buffer isn't counted as a fragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't call ice_put_rx_buf(). Because we don't call ice_put_rx_buf(), we don't attempt to re-use the page or free it. This leaves a stale page in the ring, as we don't increment next_to_alloc. The ice_reuse_rx_page() assumes that the next_to_alloc has been incremented properly, and that it always points to a buffer with a NULL page. Since this function doesn't check, it will happily recycle a page over the top of the next_to_alloc buffer, losing track of the old page. Note that this leak only occurs for multi-buffer frames. The ice_put_rx_mbuf() function always handles at least one buffer, so a single-buffer frame will always get handled correctly. It is not clear precisely why the hardware hands us descriptors with a size of 0 sometimes, but it happens somewhat regularly with "jumbo frames" used by 9K MTU. To fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on all buffers between first_desc and next_to_clean. Borrow the logic of a similar function in i40e used for this same purpose. Use the same logic also in ice_get_pgcnts(). Instead of iterating over just the number of fragments, use a loop which iterates until the current index reaches to the next_to_clean element just past the current frame. U

    Засегнати продукти

    • Linux Linux: ac1728cf370bec2e74fe6a2adf05b4629980d2b3 преди 8729dc4eeb502145418db5f2ca2192fd26f3efda; 311813ed013c016d4b0b0985a9ee41f778489077 преди 80555adb5c892f0e21d243ae96ed997ee520aea9; 743bbd93cf29f653fae0e1416a31f03231689911 преди fcb5718ebfe7fd64144e3399280440cce361a3ae; 743bbd93cf29f653fae0e1416a31f03231689911 преди 84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b; d445b59d30415bb56f4803f622d566bca06e0abc; 6.6.78 преди 6.6.160; 6.12.14 преди 6.12.49; 6.13.3 преди 6.14
    • Linux Linux: 6.14; преди 6.14; 6.6.160 до 6.6.*; 6.12.49 до 6.12.*; 6.16.9 до 6.16.*; от 6.17 нататък

    История

    • 4 октомври 2025 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2025-39948: Linux | freedomonline.bg