Към съдържанието
Търсене

CVE-2026-53025: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y): refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130 ... Call Trace: <TASK> cdev_put+0x18/0x30 __fput+0x255/0x2a0 __x64_sys_close+0x3d/0x80 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f The cdev is contained in the "gb_raw" structure, which is freed in the disconnect operation. When the cdev is released at a later time, cdev_put gets an address that points to freed memory. To fix this use-after-free, convert the struct device from a pointer to being embedded, that makes the lifetime of the cdev and of this device the same. Then, use cdev_device_add, which guarantees that the device won't be released until all references to the cdev have been released. Finally, delegate the freeing of the structure to the device release function, instead of freeing immediately in the disconnect callback.

    Засегнати продукти

    • Linux Linux: e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 преди 0597908256173da5256ef8e6db17ccc8d5c40ee3; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 преди e4d07fd4e30024a4a15094ef2c404197667c857e; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 преди 3abf97a03f4abce1dc3639eea2fcd4bd747b3308; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 преди e72ffe59e48a74a8d9220f5ca1d03f2194d882f0; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 преди ef2d97c15b19b3489de01695bce478601e236c3e; e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 преди 983cc2c7efbce04ecbf6328448d895044dd6ab31
    • Linux Linux: 4.9; преди 4.9; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.0.10 до 7.0.*; от 7.1 нататък

    История

    • 24 юни 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-53025: Linux | freedomonline.bg