Към съдържанието
Търсене

CVE-2026-31419: Linux, грешка в паметта

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_send

Засегнати продукти

  • Linux Linux: 20949c3816463e97c6f8fe84c0280c7e5ae83a8d преди 060d83bb6147c36fc21134d5b332d266b8c176bc; f1d206181f19b00b275b258fea1418718a2f4173 преди df690112b2172e8eb0f4dd8ec1019b65ee979203; 4e5bd03ae34652cd932ab4c91c71c511793df75c преди 00752893f96b344f258c9c6de18b33171ac4872c; 4e5bd03ae34652cd932ab4c91c71c511793df75c преди 2de5c8eea0a9db99dae7c36f4b541b74b41d3a04; 4e5bd03ae34652cd932ab4c91c71c511793df75c преди a0f661918edc79d7a75e468128af8d41e2a1a83a; 4e5bd03ae34652cd932ab4c91c71c511793df75c преди d4cc7e4c80b1634c7b1497574a2fdb18df6c026c; 4e5bd03ae34652cd932ab4c91c71c511793df75c преди f5b94654a4a19891a8108d66ef166de6c028c6cd; 4e5bd03ae34652cd932ab4c91c71c511793df75c преди 2884bf72fb8f03409e423397319205de48adca16; c1f1691ef84fa6d38fa5e5148eca073145e97ffa; 5.10.94 преди 5.10.273; 5.15.17 преди 5.15.224; 5.16.3 преди 5.17
  • Linux Linux: 5.17; преди 5.17; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.184 до 6.1.*; 6.6.143 до 6.6.*; 6.12.95 до 6.12.*; 6.18.22 до 6.18.*; 6.19.12 до 6.19.*; от 7.0 нататък
  • Red Hat: още 12 продукта, добавени от Red Hat

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7

Вид слабост

История

  • 13 април 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-31419: Linux, грешка в паметта | freedomonline.bg