Към съдържанието
Търсене

CVE-2026-64012: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked When sfb has children (eg qfq qdisc) whose peek() callback is qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from its child (sfb in this case), it will do the following: 1a. do a peek() - and when sensing there's an skb the child can offer, then - the child in this case(sfb) calls its child's (qfq) peek. qfq does the right thing and will return the gso_skb queue packet. Note: if there wasnt a gso_skb entry then qfq will store it there. 1b. invoke a dequeue() on the child (sfb). And herein lies the problem. - sfb will call the child's dequeue() which will essentially just try to grab something of qfq's queue. [ 127.594489][ T453] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f] [ 127.594741][ T453] CPU: 2 UID: 0 PID: 453 Comm: ping Not tainted 7.1.0-rc1-00035-gac961974495b-dirty #793 PREEMPT(full) [ 127.595059][ T453] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 127.595254][ T453] RIP: 0010:qfq_dequeue+0x35c/0x1650 [sch_qfq] [ 127.595461][ T453] Code: 00 fc ff df 80 3c 02 00 0f 85 17 0e 00 00 4c 8d 73 48 48 89 9d b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 0c 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b [ 127.596081][ T453] RSP: 0018:ffff88810e5af440 EFLAGS: 00010216 [ 127.596337][ T453] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000 [ 127.596623][ T453] RDX: 0000000000000009 RSI: 0000001880000000 RDI: ffff888104fd82b0 [ 127.596917][ T453] RBP: ffff888104fd8000 R08: ffff888104fd8280 R09: 1ffff110211893a3 [ 127.597165][ T453] R10: 1ffff110211893a6 R11: 1ffff110211893a7 R12: 0000001880000000 [ 127.597404][ T453] R13: ffff888104fd82b8 R14: 0000000000000048 R15: 0000000040000000 [ 1

    Засегнати продукти

    • Linux Linux: e13e02a3c68d899169c78d9a18689bd73491d59a преди e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57; e13e02a3c68d899169c78d9a18689bd73491d59a преди 1e70274d3b81de28973bcdbce40a512bcb181ff9; e13e02a3c68d899169c78d9a18689bd73491d59a преди e125f5980b730c67c92a30cf150ec8c3d6777318; e13e02a3c68d899169c78d9a18689bd73491d59a преди 6c153d97c100f5b282c424101d8ff63122306997; e13e02a3c68d899169c78d9a18689bd73491d59a преди 84bfbfc0c48731bcce74cdf4f9c497547ec525e0; e13e02a3c68d899169c78d9a18689bd73491d59a преди dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e; e13e02a3c68d899169c78d9a18689bd73491d59a преди 9ad3288632c859cf84183199832d822e7a70bdae; e13e02a3c68d899169c78d9a18689bd73491d59a преди 1b9bc71153b01dbde8045b9edede4240f4f5520e
    • Linux Linux: 2.6.39; преди 2.6.39; 5.10.259 до 5.10.*; 5.15.210 до 5.15.*; 6.1.176 до 6.1.*; 6.6.143 до 6.6.*; 6.12.93 до 6.12.*; 6.18.35 до 6.18.*; 7.0.12 до 7.0.*; от 7.1 нататък

    История

    • 19 юли 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-64012: Linux | freedomonline.bg