CVE-2026-52940: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: tun: zero the whole vnet header in tun_put_user() tun_put_user() declares an on-stack struct virtio_net_hdr_v1_hash_tunnel without zeroing it. For a non-tunnel skb, virtio_net_hdr_tnl_from_skb() only initializes the first 10 bytes (sizeof(struct virtio_net_hdr)), leaving bytes 10..23 (num_buffers and the hash/tunnel fields) as stack garbage. An unprivileged user can set the vnet header size to 24 with TUNSETVNETHDRSZ, so __tun_vnet_hdr_put() copies all 24 bytes of the partially-initialized struct to userspace, leaking 14 bytes of kernel stack on every read of a non-tunnel packet. Fix it the same way tun_get_user() already does by zeroing the whole header right after declaration.

Засегнати продукти

• Linux Linux: 288f30435132d2f9e7a29ec9b9745a4f9dc7fd37 преди 5fd1fa5a4254bfdd70571c77f5e3bcb4e43738d5; 288f30435132d2f9e7a29ec9b9745a4f9dc7fd37 преди 585cb85e9a29185be05f326369573c2663cf4380; 288f30435132d2f9e7a29ec9b9745a4f9dc7fd37 преди 7f2fcff15e99bb852f6967396ed12b38376e2c8d
• Linux Linux: 6.17; преди 6.17; 6.18.36 до 6.18.*; 7.0.13 до 7.0.*; от 7.1 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-52940
• https://nvd.nist.gov/vuln/detail/CVE-2026-52940
• https://git.kernel.org/stable/c/5fd1fa5a4254bfdd70571c77f5e3bcb4e43738d5
• https://git.kernel.org/stable/c/585cb85e9a29185be05f326369573c2663cf4380
• https://git.kernel.org/stable/c/7f2fcff15e99bb852f6967396ed12b38376e2c8d