Към съдържанието
Търсене

CVE-2026-23150: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). syzbot reported various memory leaks related to NFC, struct nfc_llcp_sock, sk_buff, nfc_dev, etc. [0] The leading log hinted that nfc_llcp_send_ui_frame() failed to allocate skb due to sock_error(sk) being -ENXIO. ENXIO is set by nfc_llcp_socket_release() when struct nfc_llcp_local is destroyed by local_cleanup(). The problem is that there is no synchronisation between nfc_llcp_send_ui_frame() and local_cleanup(), and skb could be put into local->tx_queue after it was purged in local_cleanup(): CPU1 CPU2 ---- ---- nfc_llcp_send_ui_frame() local_cleanup() |- do { ' |- pdu = nfc_alloc_send_skb(..., &err) | . | |- nfc_llcp_socket_release(local, false, ENXIO); | |- skb_queue_purge(&local->tx_queue); | | ' | |- skb_queue_tail(&local->tx_queue, pdu); | ... | |- pdu = nfc_alloc_send_skb(..., &err) | ^._________________________________.' local_cleanup() is called for struct nfc_llcp_local only after nfc_llcp_remove_local() unlinks it from llcp_devices. If we hold local->tx_queue.lock then, we can synchronise the thread and nfc_llcp_send_ui_frame(). Let's do that and check list_empty(&local->list) before queuing skb to local->tx_queue in nfc_llcp_send_ui_frame(). [0]: [ 56.074943][ T6096] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-6) [ 64.318868][ T5813] kmemleak: 6 new suspected memory leaks (see /sys/kernel/debug/kmemleak) BUG: memory leak unreferenced object 0xffff8881272f6800 (size 1024): comm

    Засегнати продукти

    • Linux Linux: 94f418a206648c9be6fd84d6681d6956b8f8b106 преди ab660cb8e17aa93426d1e821c2cce60e4b9bc56a; 94f418a206648c9be6fd84d6681d6956b8f8b106 преди 65e976e1f474ae3bf5681d7abafb8f3fdb34b8cc; 94f418a206648c9be6fd84d6681d6956b8f8b106 преди 6734ff1ac6beba1d0c22dc9a3dc1849b773b511f; 94f418a206648c9be6fd84d6681d6956b8f8b106 преди f8d002626d434f5fea9085e2557711c16a15cec6; 94f418a206648c9be6fd84d6681d6956b8f8b106 преди 3098e5c8af0f4c8f7eebbb370798df8aa2e12ba5; 94f418a206648c9be6fd84d6681d6956b8f8b106 преди 61858cbce6ca4bef9ed116c689a4be9520841339; 94f418a206648c9be6fd84d6681d6956b8f8b106 преди 165c34fb6068ff153e3fc99a932a80a9d5755709
    • Linux Linux: 3.8; преди 3.8; 5.10.249 до 5.10.*; 5.15.199 до 5.15.*; 6.1.162 до 6.1.*; 6.6.123 до 6.6.*; 6.12.69 до 6.12.*; 6.18.9 до 6.18.*; от 6.19 нататък

    История

    • 14 февруари 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-23150: Linux | freedomonline.bg