Към съдържанието
Търсене

CVE-2026-89654: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex

Засегнати продукти

  • Linux Linux: 2f2dc053404febedc9c273452d9d518fb31fde72 преди 989343b7ee5b1a08778be0c7c4bf6030d3910807; 2f2dc053404febedc9c273452d9d518fb31fde72 преди 352a278d5a1965aae3f817ce5d24a67ee42d45d1; 2f2dc053404febedc9c273452d9d518fb31fde72 преди 820871e9dbeecd2533c4c5f5d91878ceaf02324c; 2f2dc053404febedc9c273452d9d518fb31fde72 преди 9646dfee880730aae4b379a4b8ee6c88ac735acd; 2f2dc053404febedc9c273452d9d518fb31fde72 преди 21d5be092d947f8d83f76f7ebf3989e7e9230a98; 2f2dc053404febedc9c273452d9d518fb31fde72 преди ee611a7509554c4ca1f54f6aefe592fb1df7ea70
  • Linux Linux: 2.6.34; преди 2.6.34; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.2.4 до 7.2.*; 7.3 до *

История

  • 11 септември 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-89654: Linux | freedomonline.bg