Към съдържанието
Търсене

CVE-2026-22976: Linux, грешка в паметта

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset `qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class itself is active. Two qfq_class objects may point to the same leaf_qdisc. This happens when: 1. one QFQ qdisc is attached to the dev as the root qdisc, and 2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get() / qdisc_put()) and is pending to be destroyed, as in function tc_new_tfilter. When packets are enqueued through the root QFQ qdisc, the shared leaf_qdisc->q.qlen increases. At the same time, the second QFQ qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters qfq_reset() with its own q->q.qlen == 0, but its class's leaf qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate an inactive aggregate and trigger a null-deref in qfq_deactivate_agg: [ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 0.903571] #PF: supervisor write access in kernel mode [ 0.903860] #PF: error_code(0x0002) - not-present page [ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0 [ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI [ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE [ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2)) [ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0 Code starting with the faulting instruction =========================================== 0: 0f 84 4d 01 00 00 je 0x153 6: 48 89 70 18 mov %rsi,0x18(%rax) a: 8b 4

Засегнати продукти

  • Linux Linux: 0545a3037773512d3448557ba048cebb73b3e4af преди 6116a83ec167d3ab1390cded854d237481f41b63; 0545a3037773512d3448557ba048cebb73b3e4af преди 0809c4bc06c9c961222df29f2eccfd449304056f; 0545a3037773512d3448557ba048cebb73b3e4af преди cdb24200b043438a144df501f1ebbd926bb1a2c7; 0545a3037773512d3448557ba048cebb73b3e4af преди 11bf9134613f6c71fc0ff36c5d8d33856f6ae3bb; 0545a3037773512d3448557ba048cebb73b3e4af преди 43497313d0da3e12b5cfcd97aa17bf48ee663f95; 0545a3037773512d3448557ba048cebb73b3e4af преди 51ffd447bc37bf1a5776b85523f51d2bc69977f6; 0545a3037773512d3448557ba048cebb73b3e4af преди c1d73b1480235731e35c81df70b08f4714a7d095
  • Linux Linux: 3.0; преди 3.0; 5.10.248 до 5.10.*; 5.15.198 до 5.15.*; 6.1.161 до 6.1.*; 6.6.121 до 6.6.*; 6.12.66 до 6.12.*; 6.18.6 до 6.18.*; от 6.19 нататък
  • Siemens RUGGEDCOM RST2428P: преди V4.0

Вид слабост

История

  • 21 януари 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-22976: Linux, грешка в паметта | freedomonline.bg