Към съдържанието
Търсене

CVE-2026-53080: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_fw: fix NULL dereference of "old" filters before change() Like pointed out by Sashiko [1], since commit ed76f5edccc9 ("net: sched: protect filter_chain list with filter_chain_lock mutex") TC filters are added to a shared block and published to datapath before their ->change() function is called. This is a problem for cls_fw: an invalid filter created with the "old" method can still classify some packets before it is destroyed by the validation logic added by Xiang. Therefore, insisting with repeated runs of the following script: # ip link add dev crash0 type dummy # ip link set dev crash0 up # mausezahn crash0 -c 100000 -P 10 \ > -A 4.3.2.1 -B 1.2.3.4 -t udp "dp=1234" -q & # sleep 1 # tc qdisc add dev crash0 egress_block 1 clsact # tc filter add block 1 protocol ip prio 1 matchall \ > action skbedit mark 65536 continue # tc filter add block 1 protocol ip prio 2 fw # ip link del dev crash0 can still make fw_classify() hit the WARN_ON() in [2]: WARNING: ./include/net/pkt_cls.h:88 at fw_classify+0x244/0x250 [cls_fw], CPU#18: mausezahn/1399 Modules linked in: cls_fw(E) act_skbedit(E) CPU: 18 UID: 0 PID: 1399 Comm: mausezahn Tainted: G E 7.0.0-rc6-virtme #17 PREEMPT(full) Tainted: [E]=UNSIGNED_MODULE Hardware name: Red Hat KVM, BIOS 1.16.3-2.el9 04/01/2014 RIP: 0010:fw_classify+0x244/0x250 [cls_fw] Code: 5c 49 c7 45 00 00 00 00 00 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 5b b8 ff ff ff ff 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 eb a0 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffd1b7026bf8a8 EFLAGS: 00010202 RAX: ffff8c5ac9c60800 RBX: ffff8c5ac99322c0 RCX: 0000000000000004 RDX: 0000000000000001 RSI: ffff8c5b74d7a000 RDI: ffff8c5ac8284f40 RBP: ffffd1b7026bf8d0 R08: 0000000000000000 R09: ffffd1b7026bf9b0 R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000010000 R13: ffffd1b7026bf930 R14: ffff8c5ac8284f40 R15:

    Засегнати продукти

    • Linux Linux: ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 преди a719275da488835e987d28effc04679b4aace3a0; ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 преди c205da704c84eeb4247d770150440294fd547049; ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 преди 5dcce34c57d5e5990869384d69deeb9414bf9b92; ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 преди 5df49f0579f7e625f2358a219d31fbc7621be799; ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 преди 829808cbf8cf8a6d07a0e67a5ea2c3fcd63a9e5c; ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 преди 41845bc5bb64f3d615abe575ad655b5e7f193634; ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 преди 4fabcfea7a9dd159df32c5df6587fe858cb0d748; ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 преди 65782b2db7321d5f97c16718c4c7f6c7205a56be
    • Linux Linux: 5.1; преди 5.1; 5.10.259 до 5.10.*; 5.15.210 до 5.15.*; 6.1.176 до 6.1.*; 6.6.143 до 6.6.*; 6.12.93 до 6.12.*; 6.18.35 до 6.18.*; 7.0.10 до 7.0.*; 7.1 до *
    • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem: преди *

    История

    • 24 юни 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-53080: Linux | freedomonline.bg