Към съдържанието
Търсене

CVE-2026-90125: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2_new_read_req() smb2_new_read_req() allocates the request buffer with smb2_plain_req_init() but only publishes it to the caller with *buf = req at the very end of the function. Two error returns sit in between: rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, (void **) &req, total_len); if (rc) return rc; if (server == NULL) return -ECONNABORTED; [...] rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->subreq.io_iter, true, need_invalidate); if (!rdata->mr) return -EAGAIN; On either of them the buffer is neither released nor handed back, so it is leaked. The caller cannot clean up after it: smb2_async_readv() does 'goto out' on a non-zero return, which skips the cifs_small_buf_release(buf) at async_readv_out, and buf has not been assigned at that point in any case. The write path has never had this problem. smb2_async_writev() registers the memory region inline and jumps to its release label instead of returning: wdata->mr = smbd_register_mr(...); if (!wdata->mr) { rc = -EAGAIN; goto async_writev_out; } Commit b7972092199f ("cifs: smbd: Retry on memory registration failure") changed both sides from -ENOBUFS to -EAGAIN in a single patch, which puts the two shapes next to each other. Only the -EAGAIN return is reachable in practice, because smb2_plain_req_init() calls smb2_reconnect() first and that already fails with -EIO when server is NULL, before anything is allocated. Both returns are given the same treatment here rather than leaving one of them correct only by accident. Because -EAGAIN is a replayable error, the failure also reaches the retry block at the end of smb2_async_readv(), which marks the subrequest NETFS_SREQ_NEED_RETRY, so a failing registration can be retried rather than ending the I/O, and every attempt that reaches it leaks another buffer. smb2_should_replay() short-

    Засегнати продукти

    • Linux Linux: bd3dcc6a22a9186ed78da51ce09e889803552189 преди 38daae149c2102d96833cc6acd79c8f98fcce208; bd3dcc6a22a9186ed78da51ce09e889803552189 преди 58066940076b90c16e821fd6f9767cd979cbdb5e; bd3dcc6a22a9186ed78da51ce09e889803552189 преди 12092ed28434bf41e08d41e3c5269eb6b337fc02; bd3dcc6a22a9186ed78da51ce09e889803552189 преди 442c5f1358ced0d4e716778ac06f1e323a7e4f21; bd3dcc6a22a9186ed78da51ce09e889803552189 преди 73f6bdb0380486ab37fe12cd74de20abfaf5d3ae; bd3dcc6a22a9186ed78da51ce09e889803552189 преди deb6468f4164640e4dc875f008aa449cf55987a5
    • Linux Linux: 4.16; преди 4.16; 6.1.191 до 6.1.*; 6.6.157 до 6.6.*; 6.12.110 до 6.12.*; 6.18.52 до 6.18.*; 7.2.6 до 7.2.*; от 7.3 нататък

    История

    • 17 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-90125: Linux | freedomonline.bg