Към съдържанието
Търсене

CVE-2026-81001: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_device pointers and takes no reference on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor. priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop: /* Snapshot list, allow later requests */ list_replace_init(&net_todo_list, &list); __rtnl_unlock(); ... if (dev->priv_destructor) dev->priv_destructor(dev); /* slip_devs[i] = NULL */ if (dev->needs_free_netdev) free_netdev(dev); ... /* Free network device */ kobject_put(&dev->dev.kobj); So rtnl_lock() does not serialise slip_open() against the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it after netdev_run_todo() has run the destructor and released the device: CPU0 (slip_open) CPU1 (slip_close) unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev = slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) /* dev is freed */ sl = netdev_priv(dev) if (sl->tty || sl->leased) /* use-after-free */ BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506 CPU: 2 PID: 6506 Comm:

Засегнати продукти

  • Linux Linux: 5342b77c4123ba39f911d92a813295fb3bb21f69 преди 045e307ac21fbd735b789d8817b21be4d8ead054; 5342b77c4123ba39f911d92a813295fb3bb21f69 преди 87398cdec8bdf84096a8af4dbccdb04f1972f32c; 5342b77c4123ba39f911d92a813295fb3bb21f69 преди e93ace1f46177a4f7b5a8e5996606cdf77e1e890; 5342b77c4123ba39f911d92a813295fb3bb21f69 преди 70e20456bcbf7f3ae145bb96e5548f827a37c640; 5342b77c4123ba39f911d92a813295fb3bb21f69 преди a235b20972bbd98ca1fb127d6269434edc607f19; 5342b77c4123ba39f911d92a813295fb3bb21f69 преди 486577db807891d0f964fdf13c1640c7f54b0ad1; 5342b77c4123ba39f911d92a813295fb3bb21f69 преди d6f25e5bd777b05880da8673daf74a8419480545; 5342b77c4123ba39f911d92a813295fb3bb21f69 преди 2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d
  • Linux Linux: 2.6.32; преди 2.6.32; 5.10.270 до 5.10.*; 5.15.221 до 5.15.*; 6.1.188 до 6.1.*; 6.6.157 до 6.6.*; 6.12.109 до 6.12.*; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

История

  • 11 септември 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-81001: Linux | freedomonline.bg