Към съдържанието
Търсене

CVE-2026-63796: Linux, грешка в паметта

8.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can run past bg_bitmap. Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent allocator type and reject descriptors whose bg_size or bg_bits exceed that capacity. Keep the existing chain geometry check so both the on-disk bitmap layout and the allocator metadata must agree before the descriptor is used. Validation reproduced this kernel report: KASAN use-after-free in _find_next_bit+0x7f/0xc0 Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xd0/0x630 (?:?) _find_next_bit+0x7f/0xc0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x188/0x2f0 (?:?) kasan_report+0xe4/0x120 (?:?) ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375) ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457) ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86) ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786) ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886) get_page_from_freelist+0x70e/0x2370 (?:?) lock_release+0xc6/0x290 (?:?) do_raw_spin_unlock+0x9a/0x100 (?:?) kasan_unpoison+0x27/0x60 (?:?) __bfs+0x147/0x240 (?:?) get_page_from_freelist+0x83d/0x2370 (?:?) ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96) sched_domains_numa_masks_clear+0x70/0xd0 (?:?) check_irq_usage+0xe8/0xb70 (?:?) __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497) check_path+0x24/0x50 (?:?) rcu_is_watching+0x20/0x50 (?:?) check_prev_add+0xfd/0xd00 (?:?) ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?) __folio_batch_

Засегнати продукти

  • Linux Linux: ccd979bdbce9fba8412beb3f1de68a9d0171b12c преди 336340a0f8a141df8a4eb21a5a86f8ffb87769f6; ccd979bdbce9fba8412beb3f1de68a9d0171b12c преди 296c6a42b1174395935ca4cfe8f393e37b698d54; ccd979bdbce9fba8412beb3f1de68a9d0171b12c преди d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e; ccd979bdbce9fba8412beb3f1de68a9d0171b12c преди c5a125eadba05ba421c4b55e68da22b4a40d32b4; ccd979bdbce9fba8412beb3f1de68a9d0171b12c преди 8f9903b0cdbb3155a8899410330b4b4d583a7a5c; ccd979bdbce9fba8412beb3f1de68a9d0171b12c преди 4cd57ebee395041099fcdfcabb00749ce38d8b27; ccd979bdbce9fba8412beb3f1de68a9d0171b12c преди 99c21e7263248c3f084756bfae08163cc5d6c62f; ccd979bdbce9fba8412beb3f1de68a9d0171b12c преди 9bd541e09dffff27e5bec0f9f45b0228173a5375
  • Linux Linux: 2.6.16; преди 2.6.16; 5.10.260 до 5.10.*; 5.15.211 до 5.15.*; 6.1.177 до 6.1.*; 6.6.144 до 6.6.*; 6.12.95 до 6.12.*; 6.18.38 до 6.18.*; 7.1.3 до 7.1.*; от 7.2 нататък

Вид слабост

История

  • 19 юли 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-63796: Linux, грешка в паметта | freedomonline.bg