Към съдържанието
Търсене

CVE-2026-89969: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as queue->left = hdr->hlen - queue->offset + hdgst; and reads that many more bytes into &queue->pdu + queue->offset, without ever bounding the result against sizeof(queue->pdu). A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the union. Once a header digest has been negotiated (hdgst = 4), a second ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the 128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and queue->data_digest. Those bytes are attacker-controlled (an ICReq carries no digest), and the duplicate ICReq is only rejected later, after the overflow. A remote unauthenticated host can thus corrupt kernel memory adjacent to the receive buffer. Reject any PDU whose declared length would read past the end of queue->pdu before the second recv.

    Засегнати продукти

    • Linux Linux: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 преди a3f0bcfbaf3312a5754d1ce020a07d394669eb25; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 преди 4f84d42c53c49557fb1ef285c683b0a81b576c74; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 преди 58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 преди cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 преди 3a385e0c39efbe34db8edd95900c123113ae3450; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 преди dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 преди d95d342bc0ea82dc79e6362b2f1f997431750e4c; 872d26a391da92ed8f0c0f5cb5fef428067b7f30 преди 14cc5a7e77731497d5bea70f3bb05df7eda982e4
    • Linux Linux: 5.0; преди 5.0; 5.10.270 до 5.10.*; 5.15.221 до 5.15.*; 6.1.188 до 6.1.*; 6.6.157 до 6.6.*; 6.12.110 до 6.12.*; 6.18.51 до 6.18.*; 7.2.5 до 7.2.*; от 7.3 нататък

    История

    • 16 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-89969: Linux | freedomonline.bg