Към съдържанието
Търсене

CVE-2026-74269: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA). It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which builds the skb head: napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size); The problem with this expression is that in page mode, rx_offset is: bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM; Which evaluates (at least on x86_64) to 258. The test test_xdp_native_adjst_head_grow_data tests a case where the head is adjusted by -256. When this test runs, data_ptr is shifted to frag_start + 2 (where frag_start = page_address(page) + offset). Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb expression subtracts 258, landing at an address before frag_start. This could be either the previous fragment or the previous physical page when the offset is < 256 (e.g. if the fragment started at offset 0). When the skb is freed, the page pool fragment reference is dropped on either the wrong page or the wrong frag of the right page. In either case, the corrupted reference count can lead to the page being prematurely recycled while still in use. Once (incorrectly) recycled, it can be handed out again and on driver teardown this would result in a double free. The commit under fixes updated this code to handle the case where the native page size is >= 64k, but it unintentionally broke the head grow case. To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on allocation and preserve it on reuse. In bnxt_rx_multi_page_skb, use the newly added offset field to compute the fragment start and pass that to napi_build_skb. Adjust the layout with skb_reserve. There are two cases, the non-adjustment case and the adjustment case. In both cases, the skb is built at page_address(pa

Засегнати продукти

  • Linux Linux: e9f11bfc03fb0d3c86f91b8ae945bb10f7e19c16 преди 59f6211c006cb5936b443fb396eb43864ca21ed5; f6974b4c2d8e1062b5a52228ee47293c15b4ee1e преди 3e8f3959a7fd28461b8cd9708c21286b4250b77a; f6974b4c2d8e1062b5a52228ee47293c15b4ee1e преди ff34e5a26a26c92142afea11455e259c4c4c617b; f6974b4c2d8e1062b5a52228ee47293c15b4ee1e преди 4c03275bc4435cc8e25f7f3f08aff58c0e783d8d; f6974b4c2d8e1062b5a52228ee47293c15b4ee1e преди bb72b1c6755631c74b7e0878ee55bb81c06776c0; f6974b4c2d8e1062b5a52228ee47293c15b4ee1e преди e26657fe3b85c068b01f42bb0c602f242d643ba9; ae0e135dc900827687ecc684c2bbb57aae48d318; 6.1.45 преди 6.1.191; 6.4.10 преди 6.5
  • Linux Linux: 6.5; преди 6.5; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.53 до 6.18.*; 7.1.5 до 7.1.*; от 7.2 нататък

История

  • 15 август 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-74269: Linux | freedomonline.bg