Към съдържанието
Търсене

CVE-2026-72336: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control get_l2cap_conn() looks up an LE hci_conn under hdev protection, but then drops that protection before reading hcon->l2cap_data and before lowpan_control_write() later dereferences conn->hcon. A disconnect or device close can tear down the same L2CAP connection in that window. The buggy scenario involves two paths, with each column showing the order within that path: 6LoWPAN control write: HCI disconnect/device close: 1. get_l2cap_conn() finds hcon 1. hci_disconn_cfm() dispatches and hcon->l2cap_data. the L2CAP disconnect callback. 2. get_l2cap_conn() drops hdev 2. l2cap_conn_del() clears protection and returns conn. hcon->l2cap_data and drops the L2CAP connection reference. 3. lowpan_control_write() reads 3. hci_conn_del() removes and drops conn->hcon. the HCI connection. Take a reference to the L2CAP connection with l2cap_conn_hold_unless_zero() while hdev is still locked, and drop that reference after the debugfs command's last use of conn. This mirrors the existing L2CAP ACL receive-side handoff and keeps the connection dereferenceable after leaving hdev protection. Export the existing helper so the bluetooth_6lowpan module can use the same lifetime primitive. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in lowpan_control_write+0x374/0x520 The buggy address belongs to the object at ffff888111b9d000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 0 bytes inside of freed 1024-byte region [ffff888111b9d000, ffff888111b9d400) Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x5f0 lowpan_control_write+0x374/0x520 (net/bluetooth/6lowpan.c:1131) srso_alias_return_thunk+0x5/0xfbef5 __virt_addr_valid+0x19f/0x330 ka

    Засегнати продукти

    • Linux Linux: 6b8d4a6a03144c5996f98db7f8256267b0d72a3a преди 1df008a0770843caaeb7148705fc104bfb266630; 6b8d4a6a03144c5996f98db7f8256267b0d72a3a преди ba1f1ef6522e63aa5dd29805b4390ea2ccadf05e; 6b8d4a6a03144c5996f98db7f8256267b0d72a3a преди d2a8dc1f619c9e0e4126bee795c39ebddd2ec8ff; 6b8d4a6a03144c5996f98db7f8256267b0d72a3a преди 23a83bac3356e7b211bcdcf581a31f7b536a2c24; 6b8d4a6a03144c5996f98db7f8256267b0d72a3a преди 32c48c7f6cc8c7888e46a8c81622154ccafda5d2; 6b8d4a6a03144c5996f98db7f8256267b0d72a3a преди 518aa9505fa10ea5662349e5d2efd8c9e32a820b
    • Linux Linux: 3.17; преди 3.17; 6.1.191 до 6.1.*; 6.6.145 до 6.6.*; 6.12.97 до 6.12.*; 6.18.40 до 6.18.*; 7.1.5 до 7.1.*; 7.2 до *

    История

    • 15 август 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-72336: Linux | freedomonline.bg