Към съдържанието
Търсене

CVE-2026-74478: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.

    Засегнати продукти

    • Linux Linux: 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb преди 967c779c9853d2a1cc9cd8e61d300250c348f3d9; 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb преди a7bc015bb798c525e7a82dd14225c6aeb994274b; 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb преди 7dc9781e320d664c9bdd50003c9acfddf363d1e1; 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb преди 4b9601595e8b6b5d18878cac0aeabc687d241111; 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb преди 67d58ab4f2ccf7145f3da07e025735a09c79de1b; 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb преди 180ff4c81faf01ec4e06082c9daa7c40518ead89; 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb преди 804b681002ead233abf49a3efd681f5468a835f9; 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb преди af421e9aed3920c7ac88c24daa48606c7112feca
    • Linux Linux: 4.17; преди 4.17; 5.10.265 до 5.10.*; 5.15.216 до 5.15.*; 6.1.183 до 6.1.*; 6.6.151 до 6.6.*; 6.12.103 до 6.12.*; 6.18.44 до 6.18.*; 7.1.8 до 7.1.*; от 7.2 нататък

    История

    • 15 август 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-74478: Linux | freedomonline.bg