Към съдържанието
Търсене

CVE-2026-90206: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: nvmet: fix max_qid race between configfs and controller allocation The function nvmet_subsys_attr_qid_max_store() can race against nvmet_alloc_ctrl() when a subsystem's max_qid limit is modified. Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes: ctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1); and at this exact point, a userspace process changes max_qid to 128, nvmet_subsys_attr_qid_max_store() will set the new max_qid value. It attempts to delete active controllers to force a reconnect, but the new controller won't be deleted because it hasn't been added to the subsys->ctrls list yet. nvmet_alloc_ctrl() then proceeds and adds the new controller to the subsys->ctrls list. Later, when nvmet_install_queue() is called, it will see max_qid set to 128, but the memory allocated for sqs is only sized for 64 entries. This results in a KASAN out-of-bounds warning and potential memory corruptions. Fix this by protecting the queue allocations and list insertion in nvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because nvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem) to modify the attribute, this safely prevents the configfs writer from modifying max_qid during controller creation. Copy the max_qid from the subsystem to the controller's structure during the allocation; ctrl->max_qid never changes as long as the controller remains in LIVE state, so this will prevent similar race conditions.

    Засегнати продукти

    • Linux Linux: 3e980f5995e0bb4d86fef873a9c9ad66721580d0 преди cae0f5ed6ce7af3f7e0003c417f1953a350f55bf; 3e980f5995e0bb4d86fef873a9c9ad66721580d0 преди af811970da4f0a928f5a1b1a946a04f755ce86f2; 3e980f5995e0bb4d86fef873a9c9ad66721580d0 преди a1b88a1782eb6b368071dcda548a41b5c23d8cd2; 3e980f5995e0bb4d86fef873a9c9ad66721580d0 преди 6e6f8e3bfc66dff1833a48ecfd857268cff3be84; 3e980f5995e0bb4d86fef873a9c9ad66721580d0 преди 2c23fc91789dfd9db746edb3ae9b90d65fabd410; 3e980f5995e0bb4d86fef873a9c9ad66721580d0 преди f1a8846e06388113dfdbb89dee005083fa9afdf9
    • Linux Linux: 6.1; преди 6.1; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.2.6 до 7.2.*; от 7.3 нататък

    История

    • 17 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-90206: Linux | freedomonline.bg