Към съдържанието
Търсене

CVE-2026-90301: Linux

8.1

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, при специфични условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hb_region as the private data for the NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item() creates the configfs region. The approve handler can call o2hb_arm_timeout(), so a peer can touch the region timeout work before dev_store() has finished building the heartbeat runtime, or after teardown has started to shut that runtime back down. The final configfs put also has to keep reg alive until the last in-flight o2net callback drops its handler reference. o2net_unregister_handler_list() blocks future handler lookups, but it does not wait for sc_rx_work that already passed o2net_handler_get(). That drain needs to cover local listener teardown as well, where the o2net ordered workqueue may already be inside destroy_workqueue(). Fix the lifetime rule in both directions. Initialize the region delayed works before publishing reg through the o2net handler table, keep new or stopping regions non-armable with hr_stopping, and quiesce both delayed works on failed-start and teardown paths even when no heartbeat thread is left to call o2hb_disarm_timeout(). Then unregister handlers before tearing down handler-visible region state and make the drain wait for the active or destroying o2net ordered workqueue before release frees reg. The buggy scenario involves two paths, with each column showing the order within that path: region lifecycle: late negotiate callback: 1. make_item() registers the 1. o2net_process_message() gets a region handlers before heartbeat handler for reg. dev_store() has built a 2. The callback runs after the lookup runnable heartbeat context. lock is dropped and dereferences reg. 2. A failed start or rmdir 3. An approve or timeout path tries to stops the heartbeat thread, queue reg's delayed work, or release qui

    Засегнати продукти

    • Linux Linux: 34069b886f95356d68bf8315fa648c4ab3193cdd преди ed3c9aebd6bb5aa6ccc2a9177fab7a87ae895715; 34069b886f95356d68bf8315fa648c4ab3193cdd преди b672d4de13247369c8dc394ba83f2a896d9cc25c; 34069b886f95356d68bf8315fa648c4ab3193cdd преди f218d70f27bb326f5e9b2f33503e253851b3bafa; 34069b886f95356d68bf8315fa648c4ab3193cdd преди 9d44822ba34d6035690f725f9de602744a6e1946; 34069b886f95356d68bf8315fa648c4ab3193cdd преди b5a2907bdeced0949bcddc84b95ba7d4cb93841b; 34069b886f95356d68bf8315fa648c4ab3193cdd преди 011291b70ba4832e136b7b581825b2bc0f525bf6
    • Linux Linux: 4.7; преди 4.7; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.2.6 до 7.2.*; от 7.3 нататък

    История

    • 17 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-90301: Linux | freedomonline.bg