Към съдържанието
Търсене

CVE-2026-80870: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfd_criu_restore_event() -> create_signal_event() / create_other_event() -> allocate_event_notification_slot() -> idr_alloc(..., *restore_id, *restore_id + 1, ...) For BO restore: criu_restore_memory_of_gpu() -> idr_alloc(..., bo_priv->idr_handle, ...) In both cases, the restored ID comes from userspace-provided CRIU data. idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer. A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled. Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc(). Add INT_MAX validation before using restored IDs in: - kfd_criu_restore_event() - criu_restore_memory_of_gpu() If the restored ID is invalid, return -EINVAL. This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.

    Засегнати продукти

    • Linux Linux: 40e8a766a761f7fdc8530347527b344fddf6f1a8 преди f8687018f24037056692c1e93c7d96cc72889d5b; 40e8a766a761f7fdc8530347527b344fddf6f1a8 преди 89a75e3349c4fae28cbedc711bc924cbc6293da2; 40e8a766a761f7fdc8530347527b344fddf6f1a8 преди 085ea93bda71fee600cc12a17026598eb10dd1f9; 40e8a766a761f7fdc8530347527b344fddf6f1a8 преди 543ed0f61d56501cc585162da600bbedd7c08c0f; 40e8a766a761f7fdc8530347527b344fddf6f1a8 преди cb6311f25a096621ac7ffd91b50d1bb1cfb63a96; 40e8a766a761f7fdc8530347527b344fddf6f1a8 преди 85043dd49c2f51a37b22618168e3ae59ab92f0d6
    • Linux Linux: 5.18; преди 5.18; 6.1.178 до 6.1.*; 6.6.145 до 6.6.*; 6.12.97 до 6.12.*; 6.18.40 до 6.18.*; 7.1.5 до 7.1.*; от 7.2 нататък

    История

    • 4 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-80870: Linux | freedomonline.bg