Към съдържанието
Търсене

CVE-2026-23171: Linux, грешка в паметта

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn" The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.6

Засегнати продукти

  • Linux Linux: 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e преди c6ae2b978001065ca0e1d33d5cbf949efeff879e; 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e преди 172dcb67dd35b162357df229d7806acc724cd469; 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e преди 2889d92c5f728351c9930c7996d22fe6e906e785; 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e преди bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d; 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e преди e9acda52fd2ee0cdca332f996da7a95c5fd25294
  • Linux Linux: 5.15; преди 5.15; 6.1.191 до 6.1.*; 6.6.140 до 6.6.*; 6.12.90 до 6.12.*; 6.18.9 до 6.18.*; от 6.19 нататък

Вид слабост

История

  • 14 февруари 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-23171: Linux, грешка в паметта | freedomonline.bg