Към съдържанието
Търсене

CVE-2026-23167: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix race between rfkill and nci_unregister_device(). syzbot reported the splat below [0] without a repro. It indicates that struct nci_dev.cmd_wq had been destroyed before nci_close_device() was called via rfkill. nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which (I think) was called from virtual_ncidev_close() when syzbot close()d an fd of virtual_ncidev. The problem is that nci_unregister_device() destroys nci_dev.cmd_wq first and then calls nfc_unregister_device(), which removes the device from rfkill by rfkill_unregister(). So, the device is still visible via rfkill even after nci_dev.cmd_wq is destroyed. Let's unregister the device from rfkill first in nci_unregister_device(). Note that we cannot call nfc_unregister_device() before nci_close_device() because 1) nfc_unregister_device() calls device_del() which frees all memory allocated by devm_kzalloc() and linked to ndev->conn_info_list 2) nci_rx_work() could try to queue nci_conn_info to ndev->conn_info_list which could be leaked Thus, nfc_unregister_device() is split into two functions so we can remove rfkill interfaces only before nci_close_device(). [0]: DEBUG_LOCKS_WARN_ON(1) WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4854 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x39d/0x2cf0 kernel/locking/lockdep.c:5187, CPU#0: syz.0.8675/6349 Modules linked in: CPU: 0 UID: 0 PID: 6349 Comm: syz.0.8675 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline] RIP: 0010:check_wait_context kernel/locking/lockdep.c:4854 [inline] RIP: 0010:__lock_acquire+0x3a4/0x2cf0 ker

    Засегнати продукти

    • Linux Linux: 6a2968aaf50c7a22fced77a5e24aa636281efca8 преди cd4412d5905ee580e96c48360dc98fcd9e6f3208; 6a2968aaf50c7a22fced77a5e24aa636281efca8 преди eaa5da5130deda26420273d4610cf6e4f794ed75; 6a2968aaf50c7a22fced77a5e24aa636281efca8 преди 8ea4d96419fb20f15a52ce657d49f1e7c91eb7ac; 6a2968aaf50c7a22fced77a5e24aa636281efca8 преди 546eba0b10989de9ccc7fd619e874a30561e2b88; 6a2968aaf50c7a22fced77a5e24aa636281efca8 преди 126cd30cad37bc7c2c85fe2df2a522d4edf0a5c5; 6a2968aaf50c7a22fced77a5e24aa636281efca8 преди c3369fc5e6120a72169e71acd72e987907a682af; 6a2968aaf50c7a22fced77a5e24aa636281efca8 преди d2492688bb9fed6ab6e313682c387ae71a66ebae
    • Linux Linux: 3.2; преди 3.2; 5.10.249 до 5.10.*; 5.15.199 до 5.15.*; 6.1.162 до 6.1.*; 6.6.123 до 6.6.*; 6.12.69 до 6.12.*; 6.18.9 до 6.18.*; от 6.19 нататък

    История

    • 14 февруари 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-23167: Linux | freedomonline.bg