Към съдържанието
Търсене

CVE-2026-63811: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fs_write_begin() may read the previously written data back from the COW inode: prepare_atomic_write_begin() locates the block in the COW inode and sets use_cow, and the read bio is then built with the COW inode: f2fs_submit_page_read(use_cow ? F2FS_I(inode)->cow_inode : inode, ...); and f2fs_grab_read_bio() decides whether to schedule fs-layer decryption (STEP_DECRYPT) for the bio based on that inode via fscrypt_inode_uses_fs_layer_crypto(). However, the folio being filled belongs to the original inode (folio->mapping->host == inode), and the data stored in the COW block was encrypted (or left as plaintext) using the original inode's context, not the COW inode's -- see f2fs_encrypt_one_page(), which keys off fio->page->mapping->host. fscrypt_decrypt_pagecache_blocks() likewise operates on folio->mapping->host. The COW inode is created as a tmpfile in the parent directory and inherits its encryption policy from there. With test_dummy_encryption the newly created COW inode gets the dummy policy and becomes encrypted, while a pre-existing regular file -- created before the policy applied, e.g. already present in the on-disk image -- stays unencrypted. The read path then sets STEP_DECRYPT based on the encrypted COW inode and calls fscrypt_decrypt_pagecache_blocks() on a folio whose host (the unencrypted original inode) has a NULL ->i_crypt_info, dereferencing it: Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:fscrypt_decrypt_pagecache_blocks+0xa0/0x310 Workqueue: f2fs_post_read_wq f2fs_post_read_work Call Trace: fscrypt_decrypt_bio+0x1eb/0x340 f2fs_post_read_work+0xba/0x140 process_one_work+0x91c/0x1a40 worker_thread+0x677/0xe90 kthread+0x2bc/0x3a0 The CO

    Засегнати продукти

    • Linux Linux: 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd преди bcc9df992f3cbc43f2ecfe0b22e428e50f326e72; 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd преди 655d55c5740d37ffdf6233ff5fe21cea879407f1; 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd преди 7e4ab3907f44dc243d026048d7f5d477dae9267b; 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd преди a92332f32a8d31a7eee47b1dc1d751cb3319908f; 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd преди a41075acde0124d2f8a5f563068a5d63e8ffd57b
    • Linux Linux: 6.4; преди 6.4; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.1.3 до 7.1.*; 7.2 до *

    История

    • 19 юли 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-63811: Linux | freedomonline.bg