Към съдържанието
Търсене

CVE-2026-63911: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This copies runtime objects which must not be shared with the original SA, including the embedded sk_buff_head, hrtimers, spinlock, and in-flight reassembly/reorder state. If xfrm_state_migrate() fails after clone_state() but before the later init_state() call has reinitialized those fields, the cloned state can be destroyed by xfrm_state_gc_task() with list and timer state copied from the original SA. With queued packets this lets the clone splice and free skbs owned by the original IPTFS queue, leading to use-after-free and double-free reports in iptfs_destroy_state() and skb release paths. Reinitialize the clone's runtime state before publishing it through x->mode_data. Because clone_state() now publishes a destroyable mode_data object before init_state(), take the mode callback module reference there. Avoid taking it again from __iptfs_init_state() for the same object.

    Засегнати продукти

    • Linux Linux: 0e4fbf013fa566f274ce9b4ce698c75b1f998c52 преди 9327252e04626d4bb02ca8c0c108fbe8eabf0c5a; 0e4fbf013fa566f274ce9b4ce698c75b1f998c52 преди dfb9f6cbfa9826655a49698cf90eb800fce2178e; 0e4fbf013fa566f274ce9b4ce698c75b1f998c52 преди 7f83d174073234839aea176f265e517e0d50a1d2
    • Linux Linux: 6.14; преди 6.14; 6.18.35 до 6.18.*; 7.0.12 до 7.0.*; от 7.1 нататък

    История

    • 19 юли 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-63911: Linux | freedomonline.bg