Към съдържанието
Търсене

CVE-2026-31494: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat. ================================================================== BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027 CPU: [...] Tainted: [E]=UNSIGNED_MODULE Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 print_report+0x384/0x5e0 kasan_report+0xa0/0xf0 kasan_check_range+0xe8/0x190 __asan_memcpy+0x54/0x98 gem_get_ethtool_stats+0x54/0x78 [macb 926c13f3af83b0c6fe64badb21ec87d5e93fcf65] dev_ethtool+0x1220/0x38c0 dev_ioctl+0x4ac/0xca8 sock_do_ioctl+0x170/0x1d8 sock_ioctl+0x484/0x5d8 __arm64_sys_ioctl+0x12c/0x1b8 invoke_syscall+0xd4/0x258 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 The buggy address belongs to a 1-page vmalloc region starting at 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff00000a333000 pfn:0xa333 flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff) raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80008080b080: 00 00 00 00 00 00

    Засегнати продукти

    • Linux Linux: 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd преди 9738be665544281aa624842812c2fbfed6f88226; 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd преди 240c5302eed83e34e98db18f6795ee5f40814024; 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd преди 9596759a84e1dbf2670518d85e969208960041f9; 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd преди 95246341945163ad9a250a87ca5bd1c1252777ae; 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd преди 9d74d10e4e26672e139a8bcf8bf95957bf2d160f; 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd преди 7ff87da099210856cbfe2f2f7f52ddfa57af4f0c; 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd преди e182fe273cdf5a8931592228196ef514ffac392b; 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd преди 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5
    • Linux Linux: 4.16; преди 4.16; 5.10.253 до 5.10.*; 5.15.203 до 5.15.*; 6.1.168 до 6.1.*; 6.6.131 до 6.6.*; 6.12.80 до 6.12.*; 6.18.21 до 6.18.*; 6.19.11 до 6.19.*; от 7.0 нататък
    • Siemens: още 3 продукта, добавени от Siemens

      SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

    История

    • 22 април 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-31494: Linux | freedomonline.bg