Към съдържанието
Търсене

CVE-2026-45837: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arena_vm_close on fork arena_vm_open() only bumps vml->mmap_count but never registers the child VMA in arena->vma_list. The vml->vma always points at the parent VMA, so after parent munmap the pointer dangles. If the child then calls bpf_arena_free_pages(), zap_pages() reads the stale vml->vma triggering use-after-free. Fix this by preventing the arena VMA from being inherited across fork with VM_DONTCOPY, and preventing VMA splits via the may_split callback. Also reject mremap with a .mremap callback returning -EINVAL. A same-size mremap(MREMAP_FIXED) on the full arena VMA reaches copy_vma() through the following path: check_prep_vma() - returns 0 early: new_len == old_len skips VM_DONTEXPAND check prep_move_vma() - vm_start == old_addr and vm_end == old_addr + old_len so may_split is never called move_vma() copy_vma_and_data() copy_vma() vm_area_dup() - copies vm_private_data (vml pointer) vm_ops->open() - bumps vml->mmap_count vm_ops->mremap() - returns -EINVAL, rollback unmaps new VMA The refcount ensures the rollback's arena_vm_close does not free the vml shared with the original VMA.

    Засегнати продукти

    • Linux Linux: 317460317a02a1af512697e6e964298dedd8a163 преди 723b9fa930cc277c15ce6b9ec9feec828cfac9d7; 317460317a02a1af512697e6e964298dedd8a163 преди d18099f19e53250f8ad2801498b88cec29d9107a; 317460317a02a1af512697e6e964298dedd8a163 преди 201128fcc7b213d27ab77bc4e89488b41796480f; 317460317a02a1af512697e6e964298dedd8a163 преди 4fddde2a732de60bb97e3307d4eb69ac5f1d2b74
    • Linux Linux: 6.9; преди 6.9; 6.12.88 до 6.12.*; 6.18.30 до 6.18.*; 7.0.7 до 7.0.*; от 7.1 нататък

    История

    • 27 май 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-45837: Linux | freedomonline.bg