Към съдържанието
Търсене

CVE-2026-23198: Linux, грешка в паметта

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: KVM: Don't clobber irqfd routing type when deassigning irqfd When deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's routing entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86 and arm64, which explicitly look for KVM_IRQ_ROUTING_MSI. Instead, to handle a concurrent routing update, verify that the irqfd is still active before consuming the routing information. As evidenced by the x86 and arm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below), clobbering the entry type without notifying arch code is surprising and error prone. As a bonus, checking that the irqfd is active provides a convenient location for documenting _why_ KVM must not consume the routing entry for an irqfd that is in the process of being deassigned: once the irqfd is deleted from the list (which happens *before* the eventfd is detached), it will no longer receive updates via kvm_irq_routing_update(), and so KVM could deliver an event using stale routing information (relative to KVM_SET_GSI_ROUTING returning to userspace). As an even better bonus, explicitly checking for the irqfd being active fixes a similar bug to the one the clobbering is trying to prevent: if an irqfd is deactivated, and then its routing is changed, kvm_irq_routing_update() won't invoke kvm_arch_update_irqfd_routing() (because the irqfd isn't in the list). And so if the irqfd is in bypass mode, IRQs will continue to be posted using the old routing information. As for kvm_arch_irq_bypass_del_producer(), clobbering the routing type results in KVM incorrectly keeping the IRQ in bypass mode, which is especially problematic on AMD as KVM tracks IRQs that are being posted to a vCPU in a list whose lifetime is tied to the irqfd. Without the help of KASAN to detect use-after-free, the most common sympton on AMD is a NULL pointer deref in amd_iommu_update_ga() due to the memory for irqfd structure being re-all

Засегнати продукти

  • Linux Linux: f70c20aaf141adb715a2d750c55154073b02a9c3 преди 959a063e7f12524bc1871ad1f519787967bbcd45; f70c20aaf141adb715a2d750c55154073b02a9c3 преди 2284bc168b148a17b5ca3b37b3d95c411f18a08d; f70c20aaf141adb715a2d750c55154073b02a9c3 преди 6d14ba1e144e796b5fc81044f08cfba9024ca195; f70c20aaf141adb715a2d750c55154073b02a9c3 преди b61f9b2fcf181451d0a319889478cc53c001123e; f70c20aaf141adb715a2d750c55154073b02a9c3 преди ff48c9312d042bfbe826ca675e98acc6c623211c; f70c20aaf141adb715a2d750c55154073b02a9c3 преди 4385b2f2843549bfb932e0dcf76bf4b065543a3c; f70c20aaf141adb715a2d750c55154073b02a9c3 преди b4d37cdb77a0015f51fee083598fa227cc07aaf1
  • Linux Linux: 4.4; преди 4.4; 5.10.250 до 5.10.*; 5.15.200 до 5.15.*; 6.1.163 до 6.1.*; 6.6.124 до 6.6.*; 6.12.70 до 6.12.*; 6.18.10 до 6.18.*; от 6.19 нататък

Вид слабост

История

  • 14 февруари 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-23198: Linux, грешка в паметта | freedomonline.bg