Към съдържанието
Търсене

CVE-2026-53034: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix af_unix null-ptr-deref in proto update unix_stream_connect() sets sk_state (`WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)`) _before_ it assigns a peer (`unix_peer(sk) = newsk`). sk_state == TCP_ESTABLISHED makes sock_map_sk_state_allowed() believe that socket is properly set up, which would include having a defined peer. IOW, there's a window when unix_stream_bpf_update_proto() can be called on socket which still has unix_peer(sk) == NULL. CPU0 bpf CPU1 connect -------- ------------ WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED) sock_map_sk_state_allowed(sk) ... sk_pair = unix_peer(sk) sock_hold(sk_pair) sock_hold(newsk) smp_mb__after_atomic() unix_peer(sk) = newsk BUG: kernel NULL pointer dereference, address: 0000000000000080 RIP: 0010:unix_stream_bpf_update_proto+0xa0/0x1b0 Call Trace: sock_map_link+0x564/0x8b0 sock_map_update_common+0x6e/0x340 sock_map_update_elem_sys+0x17d/0x240 __sys_bpf+0x26db/0x3250 __x64_sys_bpf+0x21/0x30 do_syscall_64+0x6b/0x3a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Initial idea was to move peer assignment _before_ the sk_state update[1], but that involved an additional memory barrier, and changing the hot path was rejected. Then a NULL check during proto update in unix_stream_bpf_update_proto() was considered[2], but the follow-up discussion[3] focused on the root cause, i.e. sockmap update taking a wrong lock. Or, more specifically, missing unix_state_lock()[4]. In the end it was concluded that teaching sockmap about the af_unix locking would be unnecessarily complex[5]. Complexity aside, since BPF_PROG_TYPE_SCHED_CLS and BPF_PROG_TYPE_SCHED_ACT are allowed to update sockmaps, sock_map_update_elem() taking the unix lock, as it is currently im

    Засегнати продукти

    • Linux Linux: c63829182c37c2d6d0608976d15fa61ebebe9e6b преди 75b7d3b3f8bd4e59eb3af1b11a43c64c0c2db6f4; c63829182c37c2d6d0608976d15fa61ebebe9e6b преди a94d3dd78ee8b63e6b8ad629081c952c93ee5a10; c63829182c37c2d6d0608976d15fa61ebebe9e6b преди 4913c94a3adcdbb64c552110c0c243cb1fdbb317; c63829182c37c2d6d0608976d15fa61ebebe9e6b преди 041eb6348d73ee5e15fc8161f1eac5a6e8289ca0; c63829182c37c2d6d0608976d15fa61ebebe9e6b преди 37bfcd164161b47d00b1c3bd20adc816a6977ce0; c63829182c37c2d6d0608976d15fa61ebebe9e6b преди dca38b7734d2ea00af4818ff3ae836fab33d5d5a
    • Linux Linux: 5.15; преди 5.15; 6.1.175 до 6.1.*; 6.6.141 до 6.6.*; 6.12.91 до 6.12.*; 6.18.33 до 6.18.*; 7.0.10 до 7.0.*; от 7.1 нататък

    История

    • 24 юни 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-53034: Linux | freedomonline.bg