Към съдържанието
Търсене

CVE-2026-74672: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug(). The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write. The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers). The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm. ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own. This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses. vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks. As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock while both setting the huge page table entry and freeing the prior leaf page table. The ptdump code already acquires the mmap write lock, so by doing so we ensure that the ptdump walker only ever observes either the huge page table entry or the existing page table entry, and nothing is freed underneath it. A mitigation for this issue was already applied for arm64 in commit fa93b45fd397 ("arm64: Enable vmalloc-huge with ptdump"), which this series has to deal with carefully. This mitigation resolv

    Засегнати продукти

    • Linux Linux: b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e преди 51eaba47b3dc258d1182fc3a88da544ed6b6bb2d; b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e преди e85ed734611616d4a9d8a240bde563dd6ac7452f; b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e преди 39c6772b56a6bbdd62794833f74232971d94d7c9; b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e преди 8d7f560f4b0482d469de962fbe4b59c37561052e; b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e преди 7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468; b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e преди c5bf8cd148cfea948cfa3db71da427294b20db0f; b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e преди 3cc26c8907db0f5d1ff8043b5851ee572e9b3c98; b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e преди 26444eb71465c9934d9d418ef69c43f61185329b; 31895cfd79564111cdd5a9f48c5d491ae26a238e; 9c7f7bdb1932f8c1e5f80d32c717184701afe701; acdb4981644c8e31ccee294bdefff475c0cf587b; 0454e2fad9306961540ee7e84da47a8e345b7d22; 4.4.125 преди 4.5; 4.9.91 преди 4.10; 4.14.31 преди 4.15; 4.15.14 преди 4.16
    • Linux Linux: 4.16; преди 4.16; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.184 до 6.1.*; 6.6.153 до 6.6.*; 6.12.105 до 6.12.*; 6.18.45 до 6.18.*; 7.1.9 до 7.1.*; от 7.2 нататък

    История

    • 22 август 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-74672: Linux | freedomonline.bg