Към съдържанието
Търсене

CVE-2026-53197: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() iptfs_destroy_state() calls hrtimer_cancel() while holding a spinlock that the timer callback also acquires, leading to an ABBA deadlock on SMP systems. For the output timer (iptfs_timer): - iptfs_destroy_state() holds x->lock, calls hrtimer_cancel() - iptfs_delay_timer() callback takes x->lock For the drop timer (drop_timer): - iptfs_destroy_state() holds drop_lock, calls hrtimer_cancel() - iptfs_drop_timer() callback takes drop_lock Both timers use HRTIMER_MODE_REL_SOFT, so their callbacks run in softirq context. When hrtimer_cancel() is called for a soft timer that is currently executing on another CPU, hrtimer_cancel_wait_running() spins on softirq_expiry_lock -- the same lock held by the softirq running the callback. If the callback is blocked waiting for the spinlock held by the caller of hrtimer_cancel(), a circular dependency forms: CPU 0: holds lock_A -> waits for softirq_expiry_lock CPU 1: holds softirq_expiry_lock -> waits for lock_A Fix by calling hrtimer_cancel() before acquiring the respective locks. hrtimer_cancel() is safe to call without holding any lock and will wait for any in-progress callback to complete. For the output timer, the lock is still acquired afterwards to drain the packet queue. For the drop timer, the lock/unlock pair is removed entirely since it only existed to serialize with the timer callback, which hrtimer_cancel() already guarantees. Found by source code audit.

    Засегнати продукти

    • Linux Linux: 4b3faf610cc63bfac972711635eafbca5e7d7117 преди a13ca53e47e500854a3b9ec18b5dc83acfec863e; 4b3faf610cc63bfac972711635eafbca5e7d7117 преди 822b98d354e63e8249e85473c5f3c519f3c9cecc; 4b3faf610cc63bfac972711635eafbca5e7d7117 преди c8a8a75b733467b00c08b91a38dbaf207a08ed6e
    • Linux Linux: 6.14; преди 6.14; 6.18.36 до 6.18.*; 7.0.13 до 7.0.*; от 7.1 нататък

    История

    • 25 юни 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-53197: Linux | freedomonline.bg