Към съдържанието
Търсене

CVE-2026-72166: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9_client_rpc on fatal signal When p9_client_rpc() is called with type P9_TFLUSH and the transport has no peer (e.g. fd transport backed by pipes with no 9p server), a fatal signal causes an infinite loop: again: err = io_wait_event_killable(req->wq, ...) /* SIGKILL wakes the task, returns -ERESTARTSYS */ if (err == -ERESTARTSYS && c->status == Connected && type == P9_TFLUSH) { sigpending = 1; clear_thread_flag(TIF_SIGPENDING); goto again; } clear_thread_flag() clears TIF_SIGPENDING before jumping back to io_wait_event_killable(). signal_pending_state() checks TIF_SIGPENDING, finds it zero, and the task goes to sleep again. The task can only wake on the next signal delivery that calls signal_wake_up() and sets TIF_SIGPENDING again. When that happens the loop repeats, clears TIF_SIGPENDING, and sleeps again indefinitely. This is triggered in practice by coredump_wait(): when a thread in a multi-threaded process causes a coredump (e.g. via SIGSYS from Syscall User Dispatch), coredump_wait() sends SIGKILL to all other threads and waits for them to call mm_release(). If one of those threads is blocked in p9_client_rpc() over an fd transport with no peer, it enters the P9_TFLUSH loop and never calls mm_release(), so coredump_wait() stalls forever: INFO: task syz.0.18:676 blocked for more than 143 seconds. Not tainted 6.12.77+ #1 task:syz.0.18 state:D stack:27600 pid:676 tgid:673 ppid:630 flags:0x00000004 Call Trace: <TASK> context_switch kernel/sched/core.c:5344 [inline] __schedule+0xcb4/0x5d50 kernel/sched/core.c:6724 __schedule_loop kernel/sched/core.c:6801 [inline] schedule+0xe5/0x350 kernel/sched/core.c:6816 schedule_timeout+0x253/0x290 kernel/time/timer.c:2593 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common+0x409/0x600 kernel/sched/completion.c:116 wait_for_common kernel/sched/completion.c:127 [inline] wait_

    Засегнати продукти

    • Linux Linux: 91b8534fa8f5e01f249b1bf8df0a2540053549ad преди 18a3427526e2141f80050f82c1d26b19a454707d; 91b8534fa8f5e01f249b1bf8df0a2540053549ad преди 378481cc60a937ef8ea4ef6e4f95f0dbc4e21414; 91b8534fa8f5e01f249b1bf8df0a2540053549ad преди 4f621ae3a2d99b0bac50e8d66cbf7f68323c01e8; 91b8534fa8f5e01f249b1bf8df0a2540053549ad преди f62a1f245a71680033260a6f6d74011cc3acb3cd; 91b8534fa8f5e01f249b1bf8df0a2540053549ad преди dc892cbb1e4341d427b1f940ebd6abd69bf8e479; 91b8534fa8f5e01f249b1bf8df0a2540053549ad преди a8874c34c4a973f9922908a4b8be1d1278f01e42; 91b8534fa8f5e01f249b1bf8df0a2540053549ad преди 823886a1b089b49bcd349bc8bd3417b7910cd1ac; 91b8534fa8f5e01f249b1bf8df0a2540053549ad преди 6b4f48728faa8bb514368f7eacda05565dea8696
    • Linux Linux: 2.6.28; преди 2.6.28; 5.10.266 до 5.10.*; 5.15.212 до 5.15.*; 6.1.178 до 6.1.*; 6.6.145 до 6.6.*; 6.12.97 до 6.12.*; 6.18.40 до 6.18.*; 7.1.5 до 7.1.*; от 7.2 нататък

    История

    • 15 август 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-72166: Linux | freedomonline.bg