Към съдържанието
Търсене

CVE-2026-64177: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded sk_receive_skb() The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process context. In that case release_sock() -> __release_sock() drops the slock with spin_unlock_bh() and then calls sk->sk_backlog_rcv() with bottom halves enabled. Typical sk_backlog_rcv handlers process the socket whose backlog is being drained, so the BH state at entry is irrelevant for the slocks they touch. pep_do_rcv() is different: when the inbound skb targets an existing PEP pipe, it forwards the skb to a different *child* socket via sk_receive_skb(). That helper takes the child slock with bh_lock_sock_nested(), which is just spin_lock_nested() and assumes BH is already off. The same child slock therefore ends up acquired with BH on (process path) and with BH off (softirq path): process context softirq context --------------- --------------- release_sock(listener) __netif_receive_skb() __release_sock() phonet_rcv() spin_unlock_bh() __sk_receive_skb(listener) [BH now ENABLED] [BH already disabled] sk_backlog_rcv: sk_backlog_rcv: pep_do_rcv() pep_do_rcv() sk_receive_skb(child) sk_receive_skb(child) bh_lock_sock_nested(child) bh_lock_sock_nested(child) => SOFTIRQ-ON-W => IN-SOFTIRQ-W Lockdep flags this as inconsistent lock state, and it can become a real self-deadlock if a softirq on the same CPU tries to receive to the same child socket while its slock is held in the BH-enabled path: WARNING: inconsistent lock state inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. (slock-AF_PHONET/1){+.?.}-{3:3}, at: __sk_receive_skb+0x1cf/0x900 __sk

    Засегнати продукти

    • Linux Linux: 9641458d3ec42def729fde64669abf07f3220cd5 преди f08c45076e4fd8b0adbc5eb186d6e6a3e7350d7b; 9641458d3ec42def729fde64669abf07f3220cd5 преди b2606c302d7f2b4ee48da05e32ed60aed1b0cd53; 9641458d3ec42def729fde64669abf07f3220cd5 преди 02c04df84de709060f63e1d52ec67488c4f6f212; 9641458d3ec42def729fde64669abf07f3220cd5 преди 8420aa4900417797323dd567ba9d1512280c2dc3; 9641458d3ec42def729fde64669abf07f3220cd5 преди bd795f106b3889fb0706c6e4831c4b27e2b5666b; 9641458d3ec42def729fde64669abf07f3220cd5 преди 84bc87beb4cd77670939b446326788e4c9b3db37; 9641458d3ec42def729fde64669abf07f3220cd5 преди a3fc8f2dacd1c37325977fc1fbbf3d52141df99e; 9641458d3ec42def729fde64669abf07f3220cd5 преди dbc81608e3a653dea6cf403f20cae35468b8ab9c
    • Linux Linux: 2.6.28; преди 2.6.28; 5.10.258 до 5.10.*; 5.15.209 до 5.15.*; 6.1.175 до 6.1.*; 6.6.142 до 6.6.*; 6.12.92 до 6.12.*; 6.18.34 до 6.18.*; 7.0.11 до 7.0.*; 7.1 до *

    История

    • 19 юли 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-64177: Linux | freedomonline.bg