Към съдържанието
Търсене

CVE-2026-80556: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq. If we remove the module, atmci_remove makes cleanup and the memory allocated for host with devm_kzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | atmci_interrupt | queue_work(system_bh_wq, | &host->bh_work) atmci_remove | atmci_cleanup_slot(...) | atmci_writel(host, ATMCI_IDR, ~0UL) | timer_delete_sync(&host->timer) | dma_release_channel(host->dma.chan) | free_irq(platform_get_irq(pdev, 0), host) | | atmci_work_func | // use host // devm resources released after | // remove returns, host is freed | | // use host (use-after-free) Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmci_remove.

    Засегнати продукти

    • Linux Linux: 7d2be0749a59096a334c94dc48f43294193cb8ed преди 22aecf6c4721727a2f724ca0438bc7d4b609bf3f; 7d2be0749a59096a334c94dc48f43294193cb8ed преди b5060ff2f5460795a3e9f7cdf5052aa42f96ff81; 7d2be0749a59096a334c94dc48f43294193cb8ed преди 7599a73ff66d195a908f5d88b427933a9fb1c02a; 7d2be0749a59096a334c94dc48f43294193cb8ed преди c125ee35a49a0518521b52b27631eef061b8719a
    • Linux Linux: 2.6.27; преди 2.6.27; 6.12.105 до 6.12.*; 6.18.46 до 6.18.*; 7.1.10 до 7.1.*; 7.2 до *

    История

    • 26 август 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-80556: Linux | freedomonline.bg