Към съдържанието
Търсене

CVE-2026-43244: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: kcm: fix zero-frag skb in frag_list on partial sendmsg error Syzkaller reported a warning in kcm_write_msgs() when processing a message with a zero-fragment skb in the frag_list. When kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb, it allocates a new skb (tskb) and links it into the frag_list before copying data. If the copy subsequently fails (e.g. -EFAULT from user memory), tskb remains in the frag_list with zero fragments: head skb (msg being assembled, NOT yet in sk_write_queue) +-----------+ | frags[17] | (MAX_SKB_FRAGS, all filled with data) | frag_list-+--> tskb +-----------+ +----------+ | frags[0] | (empty! copy failed before filling) +----------+ For SOCK_SEQPACKET with partial data already copied, the error path saves this message via partial_message for later completion. For SOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a subsequent zero-length write(fd, NULL, 0) completes the message and queues it to sk_write_queue. kcm_write_msgs() then walks the frag_list and hits: WARN_ON(!skb_shinfo(skb)->nr_frags) TCP has a similar pattern where skbs are enqueued before data copy and cleaned up on failure via tcp_remove_empty_skb(). KCM was missing the equivalent cleanup. Fix this by tracking the predecessor skb (frag_prev) when allocating a new frag_list entry. On error, if the tail skb has zero frags, use frag_prev to unlink and free it in O(1) without walking the singly-linked frag_list. frag_prev is safe to dereference because the entire message chain is only held locally (or in kcm->seq_skb) and is not added to sk_write_queue until MSG_EOR, so the send path cannot free it underneath us. Also change the WARN_ON to WARN_ON_ONCE to avoid flooding the log if the condition is somehow hit repeatedly. There are currently no KCM selftests in the kernel tree; a simple reproducer is available at [1]. [1]

    Засегнати продукти

    • Linux Linux: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 преди d6dcbcc8d630d14e9651fe93a9386b35f4dcfd56; ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 преди 6f129a251c2795ba55dd5cc1fdf7e0af3098d848; ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 преди 9ea3671d70ee07480d80bebe86696397c4e99fb7; ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 преди b1e3edf688a88c1a3ac41657055d9c136a08cd25; ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 преди 7af58f76e4b404a74c836881a845e6652db8a09f; ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 преди ca220141fa8ebae09765a242076b2b77338106b0
    • Linux Linux: 4.6; преди 4.6; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.75 до 6.12.*; 6.18.16 до 6.18.*; 6.19.6 до 6.19.*; 7.0 до *

    История

    • 6 май 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-43244: Linux | freedomonline.bg