Към съдържанието
Търсене

CVE-2026-74390: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs The irdma_copy_user_pgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc->total_cnt is reached. The issue is that the logic for checking palloc->total_cnt would only work for non-zero values. When irdma_setup_pbles is called with lvl==0, it calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means the only way to break out of the loop is to reach the last umem DMA block, which means it could end up going beyond the fixed size of 4 iwmr->pgaddrmem array that is used in the lvl==0 case. In the case of QP/CQ/SRQ rings, the value of lvl is determined by a separate input (for example, req.cq_pages in the case of a CQ). So, we must perform explicit checking to ensure we don't overflow the pgaddrmem array if the user provides a umem that consists of more blocks than their provided req.cq_pages.

Засегнати продукти

  • Linux Linux: b48c24c2d710cf34810c555dcef883a3d35a9c08 преди 4780f58672ee6328accd54a95f9c00683477e499; b48c24c2d710cf34810c555dcef883a3d35a9c08 преди 79a20a8e201a779224b4bf115250a7713bde72c0; b48c24c2d710cf34810c555dcef883a3d35a9c08 преди 9f8f0d2099e3de1194e37dc933ae0c4206b09aaf; b48c24c2d710cf34810c555dcef883a3d35a9c08 преди 192a3be0e3759daa24af2841208b074ca6dbaabc; b48c24c2d710cf34810c555dcef883a3d35a9c08 преди 424d51d33c7541a86934067c2c0538124687fc90; b48c24c2d710cf34810c555dcef883a3d35a9c08 преди abd27a977b419d584efa659488c22d2306987b29; b48c24c2d710cf34810c555dcef883a3d35a9c08 преди 5ebb3ed757be3e04cf803026004aa0beaeb13e9b
  • Linux Linux: 5.14; преди 5.14; 5.15.212 до 5.15.*; 6.1.178 до 6.1.*; 6.6.145 до 6.6.*; 6.12.97 до 6.12.*; 6.18.40 до 6.18.*; 7.1.5 до 7.1.*; от 7.2 нататък

История

  • 15 август 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-74390: Linux | freedomonline.bg