Към съдържанието
Търсене

CVE-2026-89659: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive. The client survives its stateids only because __destroy_client() drains cl_delegations and cl_revoked before free_client() runs. nfs4_laundromat() breaks that invariant: it unhashes an expired delegation from cl_delegations, drops deleg_lock, then revoke_delegation() relinks it onto cl_revoked under cl_lock. In that window the delegation is on neither list, so client_has_state() can report no remaining state. Every teardown path first requires cl_rpc_users to be zero, but the laundromat holds no such reference. A client whose recalled delegation has just timed out can therefore reach free_client() while revoke_delegation() is still about to dereference cl_lock, a use-after-free. Pin the client with cl_rpc_users across the revoke so teardown blocks until it completes, then reap the delegation from cl_revoked. A client already expiring reaps its own, so skip it and leave the delegation on del_recall_lru.

Засегнати продукти

  • Linux Linux: 3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54 преди 2f9a200c0ea5b214609b8cea2b6666458bcb54cd; 3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54 преди 94f0c73797c30a35812ffb32d11b8737d245c405; 3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54 преди 0dd276b1324a5e08e83c6f675919946c9f0d61c9; 3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54 преди 3c0a53ee0b442348d8d2286d6960d3f07bb3a3d3; 3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54 преди 2a9d637c2a8fd8ac29ad9b29f28d122ef75c1a56; 3bd64a5ba1719c2bb6cba4493dfd3e23a7653e54 преди 4683ca76b3b7e5808338491c6eb3c20e6b4894d5
  • Linux Linux: 3.10; преди 3.10; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.111 до 6.12.*; 6.18.51 до 6.18.*; 7.2.4 до 7.2.*; 7.3 до *

История

  • 11 септември 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-89659: Linux | freedomonline.bg