Към съдържанието
Търсене

CVE-2026-23088: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash on synthetic stacktrace field usage When creating a synthetic event based on an existing synthetic event that had a stacktrace field and the new synthetic event used that field a kernel crash occurred: ~# cd /sys/kernel/tracing ~# echo 's:stack unsigned long stack[];' > dynamic_events ~# echo 'hist:keys=prev_pid:s0=common_stacktrace if prev_state & 3' >> events/sched/sched_switch/trigger ~# echo 'hist:keys=next_pid:s1=$s0:onmatch(sched.sched_switch).trace(stack,$s1)' >> events/sched/sched_switch/trigger The above creates a synthetic event that takes a stacktrace when a task schedules out in a non-running state and passes that stacktrace to the sched_switch event when that task schedules back in. It triggers the "stack" synthetic event that has a stacktrace as its field (called "stack"). ~# echo 's:syscall_stack s64 id; unsigned long stack[];' >> dynamic_events ~# echo 'hist:keys=common_pid:s2=stack' >> events/synthetic/stack/trigger ~# echo 'hist:keys=common_pid:s3=$s2,i0=id:onmatch(synthetic.stack).trace(syscall_stack,$i0,$s3)' >> events/raw_syscalls/sys_exit/trigger The above makes another synthetic event called "syscall_stack" that attaches the first synthetic event (stack) to the sys_exit trace event and records the stacktrace from the stack event with the id of the system call that is exiting. When enabling this event (or using it in a historgram): ~# echo 1 > events/synthetic/syscall_stack/enable Produces a kernel crash! BUG: unable to handle page fault for address: 0000000000400010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 6 UID: 0 PID: 1257 Comm: bash Not tainted 6.16.3+deb14-amd64 #1 PREEMPT(lazy) Debian 6.16.3-1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:trace_event_raw_event_synth+0x90/0x380 Code

    Засегнати продукти

    • Linux Linux: 00cf3d672a9dd409418647e9f98784c339c3ff63 преди 98ecbfb2598c9c7ca755a29f402da9d36c057077; 00cf3d672a9dd409418647e9f98784c339c3ff63 преди 327af07dff6ab5650b21491eb4f69694999ff3d1; 00cf3d672a9dd409418647e9f98784c339c3ff63 преди 3b90d099efa2b67239bd3b3dc3521ec584261748; 00cf3d672a9dd409418647e9f98784c339c3ff63 преди 90f9f5d64cae4e72defd96a2a22760173cb3c9ec; b9453380c1c542fd095a4dbe9251eeba4022bbce; 5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55; f3baa42afeea0d5f04ad31525e861199d02210cc; 5.10.237 преди 5.11; 5.15.124 преди 5.16; 6.1.43 преди 6.2
    • Linux Linux: 6.3; преди 6.3; 6.6.122 до 6.6.*; 6.12.68 до 6.12.*; 6.18.8 до 6.18.*; от 6.19 нататък

    История

    • 4 февруари 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-23088: Linux | freedomonline.bg