Към съдържанието
Търсене

CVE-2026-74715: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id separately when acquiring and releasing the network namespace reference. The reference imbalance can occur as follows: CPU 0 CPU 1 read opts->netns_id (-1) skip get_net_ns_by_id() write opts->netns_id (id) read opts->netns_id (id) put_net(net) /* no matching get */ The reverse transition leaks the reference. Repeating the unmatched put can destroy a live namespace and crash later users. The kernel reported: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700 Call Trace: __sys_bpf+0x1662/0x50c0 __x64_sys_bpf+0x73/0xb0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception Snapshot every input field of opts with READ_ONCE() before validating or using it. The netns_id snapshot keeps the namespace get/put pair balanced, while the other snapshots keep the remaining options from changing partway through an invocation. The individual reads can still observe an inconsistent combination during a concurrent update, but each selected field value remains stable for that invocation.

Засегнати продукти

  • Linux Linux: aed8ee7feb44b6537af1e0b4f03365d42928be38 преди cfde990193135a35637e55f69e83e4ab441e60ab; aed8ee7feb44b6537af1e0b4f03365d42928be38 преди fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8; aed8ee7feb44b6537af1e0b4f03365d42928be38 преди 41731d4290400cb898f15f049ae4018d45415e69; aed8ee7feb44b6537af1e0b4f03365d42928be38 преди 4af94462c0ca2187a02a1a6641020ae888c74d5c; aed8ee7feb44b6537af1e0b4f03365d42928be38 преди e5e060eb63d10b41ab60fd955649479d99b38210; aed8ee7feb44b6537af1e0b4f03365d42928be38 преди fdeba03fea78407a8c52faa99177c9f7f29f90eb
  • Linux Linux: 6.0; преди 6.0; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.1.9 до 7.1.*; от 7.2 нататък

История

  • 22 август 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-74715: Linux | freedomonline.bg