Към съдържанието
Търсене

CVE-2026-63801: Linux, грешка в паметта

8.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously (e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the per-netns tipc_crypto, and the completion then reads it: tipc_aead_decrypt_done() dereferences aead->crypto->stats and aead->crypto->net, and tipc_crypto_rcv_complete() dereferences aead->crypto->aead[] and the node table -- reading freed memory. Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO): BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999) Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51 Workqueue: events_unbound Call Trace: tipc_aead_decrypt_done (net/tipc/crypto.c:999) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Allocated by task 169: __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) tipc_crypto_start (net/tipc/crypto.c:1502) tipc_init_net (net/tipc/core.c:72) ops_init (net/core/net_namespace.c:137) setup_net (net/core/net_namespace.c:446) copy_net_ns (net/core/net_namespace.c:579) create_new_namespaces (kernel/nsproxy.c:132) __x64_sys_unshare (kernel/fork.c:3316) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Freed by task 8: kfree (mm/slub.c:6566) tipc_exit_net (net/tipc/core.c:119) cleanup_net (net/core/ne

Засегнати продукти

  • Linux Linux: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 171d31245d11bf84836fad3b394cb465a4d008ec; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 2d1f21419ec121232c916d3a3fc9b6766473a0e7; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 0a780653b2a7569a7af9be7d0b00b1251baca63a; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди eaca7dae02fab70c8d223cffe03cec1b93249ce2; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди dca7713fe044a2067387948557ea099056e1679e; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди e18769616fd5a90ec1e12aabbba544c488284292; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 1eea5e1820a2f5164d706bd1277bc97ff31ce32d; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди bda3348872a2ef0d19f2df6aa8cb5025adce2f20
  • Linux Linux: 5.5; преди 5.5; 5.10.260 до 5.10.*; 5.15.211 до 5.15.*; 6.1.177 до 6.1.*; 6.6.144 до 6.6.*; 6.12.95 до 6.12.*; 6.18.38 до 6.18.*; 7.1.3 до 7.1.*; от 7.2 нататък

Вид слабост

История

  • 19 юли 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-63801: Linux, грешка в паметта | freedomonline.bg