Към съдържанието
Търсене

CVE-2026-74348: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for locking_state debugfs open debug_lockres_open() copies inode->i_private into struct debug_lockres and debug_lockres_release() later drops that pointer with dlm_put(). That only works if open successfully pins the struct dlm_ctxt. Today open calls dlm_grab(dlm) but ignores its return value. Once the last domain unregister has removed the context from dlm_domains, dlm_grab() returns NULL, yet open still stores the raw pointer and returns success. The later release path is outside the debugfs removal barrier, so it can call dlm_put() after dlm_free_ctxt_mem() has freed the context. KASAN reports this as a slab-use-after-free in dlm_put() called from debug_lockres_release(). Fail the open when dlm_grab() cannot acquire the reference and unwind the seq_file private state before returning. That keeps locking_state from handing out a file descriptor whose release path does not own the dlm_ctxt. The buggy scenario involves two paths, with each column showing the order within that path: locking_state debugfs open: last domain unregister: 1. debug_lockres_open() reads 1. dlm_unregister_domain() calls inode->i_private. dlm_complete_dlm_shutdown(). 2. debug_lockres_open() calls 2. shutdown removes the dlm_ctxt from dlm_grab(dlm) and gets NULL. dlm_domains. 3. open still stores the raw dlm 3. final teardown reaches pointer in dl->dl_ctxt and dlm_free_ctxt_mem() and frees it. returns success. 4. debug_lockres_release() later calls dlm_put(dl->dl_ctxt). Validation reproduced this kernel report: KASAN slab-use-after-free in dlm_put+0x82/0x200 RIP: 0033:0x7f4d349bc9e0 The buggy address belongs to the object at ffff888103a3c000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 816 bytes inside of freed 2048-byte region [ffff888103a3c000, ffff888103a3c800) Write of size

    Засегнати продукти

    • Linux Linux: 4e3d24ed1a1285fe3289653aacc965642706bacb преди 6cc93dea4078cbcddee63fa2234e382a76600464; 4e3d24ed1a1285fe3289653aacc965642706bacb преди 90a6512425414098a63fc97b77bed089c75d106b; 4e3d24ed1a1285fe3289653aacc965642706bacb преди 5bee5d5f67aedd26d2b72e00e49dd93331fbcc30; 4e3d24ed1a1285fe3289653aacc965642706bacb преди aa7883b6a3c76301a3299deb34de948e73bb6a08; 4e3d24ed1a1285fe3289653aacc965642706bacb преди 9c81c1a61a52b6ecf0d14f1dbd95f154a7a9e92a; 4e3d24ed1a1285fe3289653aacc965642706bacb преди a087b2d3411e7f9df71ba3293596923ee2c70d65; 4e3d24ed1a1285fe3289653aacc965642706bacb преди a09831214912a1f270663d935613910fafd8d883; 4e3d24ed1a1285fe3289653aacc965642706bacb преди 03ad858ce8064861ea580021976dc19b7aabb549
    • Linux Linux: 2.6.26; преди 2.6.26; 5.10.261 до 5.10.*; 5.15.212 до 5.15.*; 6.1.178 до 6.1.*; 6.6.145 до 6.6.*; 6.12.97 до 6.12.*; 6.18.40 до 6.18.*; 7.1.5 до 7.1.*; от 7.2 нататък

    История

    • 15 август 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-74348: Linux | freedomonline.bg