Към съдържанието
Търсене

CVE-2026-46325: Linux, грешка в паметта

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > P

Засегнати продукти

  • Linux Linux: 592627ccbdff0ec6fff00fc761142a76db750dd4 преди e327021bd73b134c18167e2cd2a52eb5597fcba6; 592627ccbdff0ec6fff00fc761142a76db750dd4 преди 2a585a08a43c568ed6e9f27a97fd3d95106b9e68; 592627ccbdff0ec6fff00fc761142a76db750dd4 преди 409c2c5508f3d30627bea576f8676de523cb906e; 592627ccbdff0ec6fff00fc761142a76db750dd4 преди 836f6c13c9674027793f720be3f15ecd2b90b6ca; 592627ccbdff0ec6fff00fc761142a76db750dd4 преди 12985e5915a0b8354796efadaaeb201eed115377; 0e443760b8b7b1e6723f4408afa056b2bc4fea12; 6.2.3 преди 6.3
  • Linux Linux: 6.3; преди 6.3; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.14 до 6.18.*; 6.19.4 до 6.19.*; от 7.0 нататък

Вид слабост

История

  • 9 юни 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-46325: Linux, грешка в паметта | freedomonline.bg