Към съдържанието
Търсене

CVE-2026-93208: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: kasan: fix cache shrink race with CPU hotplug kasan_quarantine_remove_cache() first invokes per_cpu_remove_cache() on all online CPUs. Each callback moves objects belonging to the cache from cpu_quarantine to the CPU's shrink_qlist, where they can later be freed from task context. kmem_cache_destroy() invokes the quarantine removal path while holding cpus_read_lock(), but kmem_cache_shrink() does not. The latter can therefore race with CPU offlining as follows: kmem_cache_shrink() CPU hotplug ------------------- ----------- on_each_cpu() CPU1 moves objects to CPU1's shrink_qlist on_each_cpu() returns CPU1 goes offline kasan_cpu_offline() drains cpu_quarantine leaves shrink_qlist untouched for_each_online_cpu() skips CPU1 The objects left on CPU1's shrink_qlist are not returned to the slab allocator. This may prevent kmem_cache_shrink() from releasing slabs that would otherwise become empty. If CPU1 remains offline, a later kmem_cache_destroy() also skips the list and can report that the cache still contains objects. An intermittent occurrence was observed with a virtio-9p filesystem. The mount and umount commands both returned 0, but the kernel logged the following during the userspace-triggered teardown: [ 2994.380134][ T111] BUG 9p-fcall-cache-1 (Tainted: G B ): Objects remaining on __kmem_cache_shutdown() [ 2994.381140][ T111] Object 0xff11000004361118 @offset=4376 [ 2994.381607][ T111] Allocated in p9_fcall_init+0x201/0x400 age=19564 cpu=1 pid=104 [ 2994.382591][ T111] p9_fcall_init+0x201/0x400 [ 2994.382810][ T111] p9_tag_alloc+0x12f/0x700 [ 2994.382982][ T111] p9_client_prepare_req+0x102/0x3e0 [ 2994.383165][ T111] p9_client_rpc+0x1ab/0xa50 [ 2994.3

    Засегнати продукти

    • Linux Linux: 07d067e4f2ceb72b9f681995cc53828caaba9e6e преди eab61c0781cbe899e074c0009af304f3b337e0c9; 07d067e4f2ceb72b9f681995cc53828caaba9e6e преди 7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a; 07d067e4f2ceb72b9f681995cc53828caaba9e6e преди 709c3646545e0a1f99a5816384c633f6552c5a98; 07d067e4f2ceb72b9f681995cc53828caaba9e6e преди 30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3; 07d067e4f2ceb72b9f681995cc53828caaba9e6e преди 3119d58e4ef8719d669911d38a53fc00086ac48b; 07d067e4f2ceb72b9f681995cc53828caaba9e6e преди 8790303cbaac52a11dfed4aab261f8ea60682525
    • Linux Linux: 5.19; преди 5.19; 6.1.191 до 6.1.*; 6.6.157 до 6.6.*; 6.12.109 до 6.12.*; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

    История

    • 24 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-93208: Linux | freedomonline.bg