Към съдържанието
Търсене

CVE-2026-89477: Linux

7.5

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and sctp_process_strreset_resp() complete a pending stream reconfiguration request by stopping the reconf timer on the transport it was sent on: t = asoc->strreset_chunk->transport; if (timer_delete(&t->reconf_timer)) sctp_transport_put(t); chunk->transport is assigned by __sctp_packet_append_chunk() when the chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms the reconf timer at that same point. A request already published in asoc->strreset_chunk but not yet transmitted has neither, so completing it dereferences NULL. Two ways to get there. sctp_send_asconf_del_ip() sets asoc->src_out_of_asoc_ok without sending anything when the address being removed is the association's last one, and sctp_outq_flush_ctrl() then leaves every non-ASCONF control chunk queued; as only sctp_process_asconf_ack() clears that flag, it persists. An unprivileged process that removes such an address and then asks for a stream reset panics the kernel from softirq. A peer needs neither ASCONF nor local help: sctp_cmd_interpreter() uncorks the outqueue only once the whole packet has been processed, so a reply built while walking a RECONF chunk stays untransmitted for the rest of that walk, and one RECONF chunk carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request, Response] -- or two RECONF chunks in one packet -- reaches the same dereference. KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef] RIP: 0010:timer_delete+0x67/0x110 Call Trace: <IRQ> sctp_process_strreset_addstrm_out (net/sctp/stream.c:832) sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212) sctp_do_sm (net/sctp/sm_sideeffect.c:1172) sctp_assoc_bh_rcv (net/sctp/associola.c:1044) sctp_rcv (net/sctp/input.c:243) ip_local_deliver (net/ipv4/ip_input.c:262) proce

Засегнати продукти

  • Linux Linux: 81054476453640159149cb6704e834893e16736b преди 79ff751311e80fa0370007e46a79a6d601685e75; 81054476453640159149cb6704e834893e16736b преди 53141db979687eae7dc6d29414cefc77034f967e; 81054476453640159149cb6704e834893e16736b преди 68891125af5a5dfbca728809a16637a869bbe0df; 81054476453640159149cb6704e834893e16736b преди b2d6d873b4dfb5b84194061c4b40a1cd85b92ca4; 81054476453640159149cb6704e834893e16736b преди 77ea60f2d24002c308f224db44a4542c466489af; 81054476453640159149cb6704e834893e16736b преди 25419f516ea84b1e7d3d55aae5215ac86ece0c66; 81054476453640159149cb6704e834893e16736b преди 0ee697defc0594f1da810ed75d9d643fb46f5318; 81054476453640159149cb6704e834893e16736b преди 2db9bfa3e27bdea15e05ea70b56bad3d21e570ec
  • Linux Linux: 4.11; преди 4.11; 5.10.270 до 5.10.*; 5.15.221 до 5.15.*; 6.1.188 до 6.1.*; 6.6.157 до 6.6.*; 6.12.109 до 6.12.*; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

История

  • 11 септември 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-89477: Linux | freedomonline.bg