Към съдържанието
Търсене

CVE-2026-64032: Linux, грешка в паметта

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snooping is disabled. When global multicast snooping is enabled, the bridge iterates over all the bridge ports and enables the per-port multicast context on each port. The reverse happens when multicast snooping is disabled. The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port: # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev br1 type bridge mcast_vlan_snooping 1 # ip link set dev br1 type bridge mcast_snooping 0 # ip link set dev br1 type bridge mcast_snooping 1 This is not intended and it is a problem since the commit cited below. Prior to this commit, when removing a bridge port, br_multicast_disable_port() would disable the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when flushing VLANs. After this commit, br_multicast_disable_port() only disables the per-port multicast context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port when it was removed, the per-port multicast context would remain enabled when freeing the bridge port, leading to a use-after-free [1]. Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled. [1] ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1

Засегнати продукти

  • Linux Linux: 410a033bfa8c7daefbae0225c836693db2149ec1 преди ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b; c6d16eab122744df698f18b47cf771945cd55066 преди ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70; b4c83b37490d61cfdd62a2b29e98a9b89004b5c0 преди 1900ca8acb92fbea8bf9abef9927c7fed03db7fc; 78f768e36c065ca3f88272fcf39014782c2d4ecd преди ebe5561154c823b323bd06e350b55e0b8604d851; 4b30ae9adb047dd0a7982975ec3933c529537026 преди a9224862d597d0eed0a34bbb27343f703fc4113f; 4b30ae9adb047dd0a7982975ec3933c529537026 преди 7213256c91ed778a0997c2029c152b18dc50e4fd; 4b30ae9adb047dd0a7982975ec3933c529537026 преди 4df78ff02629c7729168f0696a7a2123c389818d; c996e25df0b3282c724bb5aca434518bc08cd963; 5.15.186 преди 5.15.209; 6.1.142 преди 6.1.175; 6.6.95 преди 6.6.142; 6.12.35 преди 6.12.92; 6.15.4 преди 6.16
  • Linux Linux: 6.16; преди 6.16; 5.15.209 до 5.15.*; 6.1.175 до 6.1.*; 6.6.142 до 6.6.*; 6.12.92 до 6.12.*; 6.18.34 до 6.18.*; 7.0.11 до 7.0.*; от 7.1 нататък

Вид слабост

История

  • 19 юли 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-64032: Linux, грешка в паметта | freedomonline.bg