Към съдържанието
Търсене

CVE-2026-23004: Linux, грешка в паметта

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_init()/INIT_LIST_HEAD() while writing list->prev, while the prior write on list->next went well. static inline void INIT_LIST_HEAD(struct list_head *list) { WRITE_ONCE(list->next, list); // This went well WRITE_ONCE(list->prev, list); // Crash, @list has been freed. } Issue here is that rt6_uncached_list_del() did not attempt to lock ul->lock, as list_empty(&rt->dst.rt_uncached) returned true because the WRITE_ONCE(list->next, list) happened on the other CPU. We might use list_del_init_careful() and list_empty_careful(), or make sure rt6_uncached_list_del() always grabs the spinlock whenever rt->dst.rt_uncached_list has been set. A similar fix is neeed for IPv4. [1] BUG: KASAN: slab-use-after-free in INIT_LIST_HEAD include/linux/list.h:46 [inline] BUG: KASAN: slab-use-after-free in list_del_init include/linux/list.h:296 [inline] BUG: KASAN: slab-use-after-free in rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline] BUG: KASAN: slab-use-after-free in rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020 Write of size 8 at addr ffff8880294cfa78 by task kworker/u8:14/3450 CPU: 0 UID: 0 PID: 3450 Comm: kworker/u8:14 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: netns cleanup_net Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 INIT_LIST_HEAD include/linux/list.h:46 [inline] list_del_init include/linux/list.h:296 [inline] rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline] rt6

Засегнати продукти

  • Linux Linux: 78df76a065ae3b5dbcb9a29912adc02f697de498 преди 72f39a3cc78b2c6d780376adf68e3de5355e71f8; 78df76a065ae3b5dbcb9a29912adc02f697de498 преди 815db2363e51f0ef416947492d4dac5b7a520f56; 78df76a065ae3b5dbcb9a29912adc02f697de498 преди f24a52948c95e02facbca2b3b6eb5a225e27eb01; 78df76a065ae3b5dbcb9a29912adc02f697de498 преди 722de945216144af7cd4d39bdeb936108d2595a7; 78df76a065ae3b5dbcb9a29912adc02f697de498 преди 9a6f0c4d5796ab89b5a28a890ce542344d58bd69
  • Linux Linux: 3.6; преди 3.6; 6.1.191 до 6.1.*; 6.6.130 до 6.6.*; 6.12.78 до 6.12.*; 6.18.7 до 6.18.*; 6.19 до *

Вид слабост

История

  • 25 януари 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-23004: Linux, грешка в паметта | freedomonline.bg