Към съдържанието
Търсене

CVE-2026-89854: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free. Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed.

    Засегнати продукти

    • Linux Linux: fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 преди 8c1ebcade6aac58137f2645b579894301febabf3; fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 преди 1d8bbc4344b9367d9d54731475d745fbc9ea28f2; fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 преди 2c3b17ee53f034936f7398dbf4d143e608b7c35c; fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 преди ae09260be7454ed7630a913f147591a25e3a9d09; fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 преди fcf0804dfe05862007189ac9dc4dc2063be36de1; fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 преди 8286a9095fb59751fba171afa2b4f590271c87d5; fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 преди 122bf170c94a3797531b12fee580639a5dc893ed; fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 преди 33d102102d925357c5fd172dd6672a27d74b3215
    • Linux Linux: 3.14; преди 3.14; 5.10.270 до 5.10.*; 5.15.221 до 5.15.*; 6.1.188 до 6.1.*; 6.6.157 до 6.6.*; 6.12.110 до 6.12.*; 6.18.51 до 6.18.*; 7.2.5 до 7.2.*; от 7.3 нататък

    История

    • 16 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-89854: Linux | freedomonline.bg