CVSS
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Описание
Оригинално описание
In the Linux kernel, the following vulnerability has been resolved: exfat: fix valid_size extension over a shared writable mapping When a shared writable mapping has its valid_size extended by a buffered write or a page fault, exfat zeroes the page-cache gap below the new valid_size. A store through the mapping can race with this zeroing and be overwritten. Fix this by zeroing the gap lazily. Drop ->map_pages so that every first write fault goes through exfat_page_mkwrite(), which advances valid_size to cover the faulting page. With fault-around enabled, a store could install a writable PTE, skip ->page_mkwrite(), and land past valid_size without advancing it. Extending valid_size one faulting page at a time also leaves never-written pages in a large mapping alone. The gap is filled with block granularity, zeroing only the not-uptodate blocks and preserving blocks that may hold data stored through the mapping. On the buffered-write path the invalidate lock is held and the gap is unmapped before zeroing, so a racing store re-faults and, under the inode lock, completes only after the gap has been zeroed and valid_size covers it.
Засегнати продукти
- Linux Linux: 82a81a7352bcf5f2756ac33d47ee0582737e9a85 преди 24f20986b253c3e4eb13ebe3c2007d1d352408a6; 82a81a7352bcf5f2756ac33d47ee0582737e9a85 преди 1135704ed22f54873eb0498a232611d9eca30dd4
- Linux Linux: 7.2; преди 7.2; 7.2.6 до 7.2.*; от 7.3 нататък
История
- 17 септември 2026 Публикувано