Към съдържанието
Търсене

CVE-2026-90036: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but no reference keeping the client alive. When the per-net laundromat reaps such a lock, freeing the nbl drops the owner reference held through flc_owner, and the final nfs4_put_stateowner() takes the client's cl_lock. Because the laundromat detaches the nbl first, __destroy_client() no longer finds it, so a concurrent force_expire_client() can free the client before nfs4_put_stateowner() runs, dereferencing cl_lock in freed memory. Pin the client with cl_rpc_users before dropping nn->blocked_locks_lock, and skip clients already expiring, whose blocked locks __destroy_client() frees while holding an owner reference. Take nn->client_lock outside nn->blocked_locks_lock. Every other site holds nn->blocked_locks_lock as a leaf, acquiring no further lock, so placing nn->client_lock outside it cannot form a lock-order cycle.

    Засегнати продукти

    • Linux Linux: 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b преди 0d53a47c913d0bce3b5ec35c28cbcca4d015f33d; 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b преди 7081224a59a0ca4edcd62c068588f4d900199a18; 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b преди cd489b03587378645fe0d20142a33f1ed60bac98; 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b преди 6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0; 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b преди 9026932ac8be4d0ae01db47f23619a98cc57b671
    • Linux Linux: 4.9; преди 4.9; 6.6.160 до 6.6.*; 6.12.111 до 6.12.*; 6.18.51 до 6.18.*; 7.2.5 до 7.2.*; от 7.3 нататък

    История

    • 16 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници