Към съдържанието
Търсене

CVE-2026-64265: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dangling on fiq->interrupts. When the requesting task then receives a fatal signal, fuse_remove_pending_req() sees FR_PENDING=1, removes the request from fiq->pending and frees it via the refcount path, also without cleaning intr_entry. The stale intr_entry causes use-after-free when fuse_read_interrupt() iterates fiq->interrupts: - list_del_init(&req->intr_entry) -> UAF write on freed slab - req->in.h.unique -> UAF read, data leaked to userspace Remove intr_entry from fiq->interrupts in fuse_resend() for interrupted requests before they are placed back on fiq->pending. Add a WARN_ON if the intr_entry is not empty on request destruction.

    Засегнати продукти

    • Linux Linux: 760eac73f9f69aa28fcb3050b4946c2dcc656d12 преди 1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c; 760eac73f9f69aa28fcb3050b4946c2dcc656d12 преди 7366e6f4d2b4c7002b13fb01219e83679dad4127; 760eac73f9f69aa28fcb3050b4946c2dcc656d12 преди 893479015cb6442fd389d3b553ab3036c9541715; 760eac73f9f69aa28fcb3050b4946c2dcc656d12 преди f8fce75fedf73ac72aa09163deb8f4291fdcaad2
    • Linux Linux: 6.9; преди 6.9; 6.12.96 до 6.12.*; 6.18.39 до 6.18.*; 7.1.4 до 7.1.*; от 7.2 нататък

    История

    • 25 юли 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-64265: Linux | freedomonline.bg