Към съдържанието
Търсене

CVE-2026-89483: Linux

7.5

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup_discard() always maps sizeof(struct nvme_dsm_range) * NVME_DSM_MAX_RANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of Ranges' field - the Fixes: commit records two that read past the declared ranges. A single-range discard fills only the first 16 bytes. Normally the buffer comes from kzalloc() and the other 4080 bytes are zero. When that allocation fails the code falls back to the per-controller ctrl->discard_page, which nvme_init_ctrl() obtains with alloc_page(GFP_KERNEL) and nothing ever zeroes, so those 4080 bytes are whatever the page last held and are handed to the controller. Reaching it requires the kzalloc(GFP_ATOMIC | __GFP_NOWARN) to fail, that is memory pressure; it is not remotely triggerable. Failing the allocation under KMSAN reproduces it, with the leaked tail full of vmemmap struct page pointers. The extent in the report is a partial transfer of the payload, not the whole 4096 bytes; the 16-byte boundary in it is the one declared range: [ 11.991601] BUG: KMSAN: uninit-value in dma_map_phys+0x14c8/0x1900 [ 11.991969] dma_map_phys+0x14c8/0x1900 [ 11.992220] dma_map_page_attrs+0xcf/0x130 [ 11.992485] e1000_xmit_frame+0x4099/0x6d10 [ 11.992768] dev_hard_start_xmit+0x22f/0xa80 [ 11.993068] sch_direct_xmit+0x35c/0xcb0 [ 11.993315] __dev_queue_xmit+0x1ee5/0x5eb0 [ 11.993608] ip_finish_output2+0x1903/0x1c30 [ 11.993881] ip_finish_output+0x288/0x870 [ 11.994125] ip_output+0x15e/0x400 [ 11.994365] __ip_queue_xmit+0x1e85/0x1fb0 [ 11.994639] ip_queue_xmit+0x60/0x80 [ 11.994899] __tcp_transmit_skb+0x4e71/0x5fa0 [ 11.995210] tcp_write_xmit+0x3a36/0x9160 [ 11.995533] __tcp_push_pending_frames+0xc5/0x3c0 [ 11.995854] tcp_push+0x7dc/0x840 [ 11.996076] tcp_sendmsg_locked+0x766c/0x8400 [ 11.996371] tcp_sendmsg+0x4b/0x90 [

Засегнати продукти

  • Linux Linux: 530436c45ef2e446c12538a400e465929a0b3ade преди 76139b5bbf531e675934b97227be3521c7fdd537; 530436c45ef2e446c12538a400e465929a0b3ade преди 3f84d2bd0d8ae8c7e8e0f8fc3cbf018a282971a1; 530436c45ef2e446c12538a400e465929a0b3ade преди 415f2772ebcbc7f3f1ab1a71915dab82cee3465e; 530436c45ef2e446c12538a400e465929a0b3ade преди 66b5af23b6f956e57f8205c46aa80b054631be34; 530436c45ef2e446c12538a400e465929a0b3ade преди dc4d4b70a863f7e39ef8bd137634be4e6db8b084; 530436c45ef2e446c12538a400e465929a0b3ade преди 67551d8430df94c827e1830bd3a5fae1f66a5219; 530436c45ef2e446c12538a400e465929a0b3ade преди f5827817b4fc7feeabf4f53fb4b626e6edc52fef; 530436c45ef2e446c12538a400e465929a0b3ade преди bededeaaeff404978a5a8e2a605a6c3017cddd3e; ffa56cbdd2409b522b4cb56461bea1c45889417b; 8b0acb768a06083b0d28bace1481c1f6679e76f4; 4.19.92 преди 4.20; 5.4.7 преди 5.5
  • Linux Linux: 5.5; преди 5.5; 5.10.270 до 5.10.*; 5.15.221 до 5.15.*; 6.1.188 до 6.1.*; 6.6.157 до 6.6.*; 6.12.109 до 6.12.*; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

История

  • 11 септември 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-89483: Linux | freedomonline.bg