Към съдържанието
Търсене

CVE-2026-45866: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: serial: caif: fix use-after-free in caif_serial ldisc_close() There is a use-after-free bug in caif_serial where handle_tx() may access ser->tty after the tty has been freed. The race condition occurs between ldisc_close() and packet transmission: CPU 0 (close) CPU 1 (xmit) ------------- ------------ ldisc_close() tty_kref_put(ser->tty) [tty may be freed here] <-- race window --> caif_xmit() handle_tx() tty = ser->tty // dangling ptr tty->ops->write() // UAF! schedule_work() ser_release() unregister_netdevice() The root cause is that tty_kref_put() is called in ldisc_close() while the network device is still active and can receive packets. Since ser and tty have a 1:1 binding relationship with consistent lifecycles (ser is allocated in ldisc_open and freed in ser_release via unregister_netdevice, and each ser binds exactly one tty), we can safely defer the tty reference release to ser_release() where the network device is unregistered. Fix this by moving tty_kref_put() from ldisc_close() to ser_release(), after unregister_netdevice(). This ensures the tty reference is held as long as the network device exists, preventing the UAF. Note: We save ser->tty before unregister_netdevice() because ser is embedded in netdev's private data and will be freed along with netdev (needs_free_netdev = true). How to reproduce: Add mdelay(500) at the beginning of ldisc_close() to widen the race window, then run the reproducer program [1]. Note: There is a separate deadloop issue in handle_tx() when using PORT_UNKNOWN serial ports (e.g., /dev/ttyS3 in QEMU without proper serial backend). This deadloop exists even without this patch, and is l

    Засегнати продукти

    • Linux Linux: 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf преди 5e266ba8d330d3b8e5bc198f238cd8901826cfa1; 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf преди d3c75db4e0460641dbcd274b40867e252d801da1; 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf преди 4e63d6f68544ae5269ac9735ae5b69b59b5b8725; 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf преди 331e2b7051635780edea248dd08ae2026c126f4a; 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf преди 52731ef4438155cea782fac74e547a327ab9e7c5; 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf преди c8c197aaa56b25a2d54f3aa07e27e228d6c08546; 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf преди 40962f2bf8cdba63af23aec95ad3f49b689e58e2; 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf преди 308e7e4d0a846359685f40aade023aee7b27284c
    • Linux Linux: 3.11; преди 3.11; 5.10.252 до 5.10.*; 5.15.202 до 5.15.*; 6.1.165 до 6.1.*; 6.6.128 до 6.6.*; 6.12.75 до 6.12.*; 6.18.14 до 6.18.*; 6.19.4 до 6.19.*; от 7.0 нататък

    История

    • 27 май 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-45866: Linux | freedomonline.bg