Към съдържанието
Търсене

CVE-2026-74558: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past fragments that are neither submitted to the driver nor returned to userspace through the completion ring. A similar problem occurs when a packet exceeds xdp_zc_max_segs. The descriptors consumed up to the limit are released without completion, and the remaining continuation descriptors can subsequently be interpreted as the beginning of another packet. Parse Tx batches in packet units and distinguish descriptors belonging to complete valid packets from descriptors consumed while draining an invalid or oversized packet. Return the former to the driver and append the latter to the CQ address area so userspace can reclaim their UMEM frames. Treat a standalone invalid descriptor as a one-descriptor reclaim-only packet. Advancing the Tx-ring consumer releases the ring slot, but does not by itself return ownership of the referenced UMEM frame to userspace. Once draining starts, continue until the packet's end-of-packet descriptor is consumed. Preserve the drain state on the socket when EOP has not yet been supplied, so draining can continue during a later call. Leave incomplete but otherwise valid packets on the Tx ring. Shared-UMEM pools using multi-buffer Tx also need packet-framed parsing. Walk their Tx sockets one packet at a time, preserving the existing per-socket fairness scheme, instead of using the legacy one-descriptor fallback. Keep that fallback for shared pools that do not use multi-buffer Tx. Since the drain state is maintained per socket and both the singular and shared paths can resume an interrupted drain, changing the socket list from singular to shared requires no special bind-time transition. CQ entries are positional, and drivers may complete only part

    Засегнати продукти

    • Linux Linux: cf24f5a5feeaae34c1a34d1e04f8ac697290427a преди 56036bdc445c468b1defd1780ed2af4a3fc7ddb2; cf24f5a5feeaae34c1a34d1e04f8ac697290427a преди 2c0a8cc97a9d970a252f17aa0bbf4588768f7aad; cf24f5a5feeaae34c1a34d1e04f8ac697290427a преди e7ce2bad0c33471c8da4dd73dff2119a68f96f3a; cf24f5a5feeaae34c1a34d1e04f8ac697290427a преди 72f2b4516faf55d4dfac2414649d3cffa5fd2c5e
    • Linux Linux: 6.6; преди 6.6; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.1.8 до 7.1.*; 7.2 до *

    История

    • 15 август 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-74558: Linux | freedomonline.bg