Към съдържанието
Търсене

CVE-2026-23102: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds memory (and may potentially take a fatal fault) and/or may kill the task with a SIGKILL. (1) Restoring a context with SVE_SIG_FLAG_SM set can place the task into an invalid state where SVCR.SM is set (and sve_state is non-NULL) but TIF_SME is clear, consequently resuting in out-of-bounds memory reads and/or killing the task with SIGKILL. This can only occur in unusual (but legitimate) cases where the SVE signal context has either been modified by userspace or was saved in the context of another task (e.g. as with CRIU), as otherwise the presence of an SVE signal context with SVE_SIG_FLAG_SM implies that TIF_SME is already set. While in this state, task_fpsimd_load() will NOT configure SMCR_ELx (leaving some arbitrary value configured in hardware) before restoring SVCR and attempting to restore the streaming mode SVE registers from memory via sve_load_state(). As the value of SMCR_ELx.LEN may be larger than the task's streaming SVE vector length, this may read memory outside of the task's allocated sve_state, reading unrelated data and/or triggering a fault. While this can result in secrets being loaded into streaming SVE registers, these values are never exposed. As TIF_SME is clear, fpsimd_bind_task_to_cpu() will configure CPACR_ELx.SMEN to trap EL0 accesses to streaming mode SVE registers, so these cannot be accessed directly at EL0. As fpsimd_save_user_state() verifies the live vector length before saving (S)SVE state to memory, no secret values can be saved back to memory (and hence cannot be observed via ptrace, signals, etc). When the live vector length doesn't match th

    Засегнати продукти

    • Linux Linux: 85ed24dad2904f7c141911d91b7807ab02694b5e преди 9bc3adba8c35119be80ab20217027720446742f2; 85ed24dad2904f7c141911d91b7807ab02694b5e преди ce820dd4e6e2d711242dc4331713b9bb4fe06d09; 85ed24dad2904f7c141911d91b7807ab02694b5e преди 7b5a52cf252a0d2e89787b645290ad288878f332; 85ed24dad2904f7c141911d91b7807ab02694b5e преди d2907cbe9ea0a54cbe078076f9d089240ee1e2d9
    • Linux Linux: 5.19; преди 5.19; 6.1.162 до 6.1.*; 6.6.123 до 6.6.*; 6.18.8 до 6.18.*; от 6.19 нататък

    История

    • 4 февруари 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-23102: Linux | freedomonline.bg