Към съдържанието
Търсене

CVE-2026-97995: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.

    Засегнати продукти

    • Linux Linux: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b преди b1f39c2a676698cc64c8e105e08b25111a112ec6; a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b преди e03522a990cd2e0f1a736eaa349a9df9ab8541c3; a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b преди 8f6cfc3eca79b8e108d0823756101e2f4f9d811f; a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b преди 2e40c69b9c3448b9c6609cd02013da593b2e123b; a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b преди 177ee901aa2bab02e7f1f8edbb814fd5e386ed62; a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b преди a80c33488e0bbe642ed803b13a4ac8078a70b507; a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b преди f620c40ea6862feed84deb105568b21ec53a7830; a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b преди 894f98e73983f37354214a89a3a7fd35bf9e3072; f92b16b815efe8207090a9b5a767618fd89542ca; d2bbfac82b7942afc5d8e564d7087835280df495; a88e13d9a092fbb772d380944b44eb549ef131fe; dd807a784fd36f4136516d5858efb6473dda422c; 47cb14192bcbba3f15b1c3561e05e084e56fdef6; 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3; 9037306163a6ba5587e4b5ca511ac7be4fb7295b; 3.16.60 преди 3.17; 3.18.108 преди 3.19; 4.1.52 преди 4.2; 4.4.131 преди 4.5; 4.9.98 преди 4.10; 4.14.39 преди 4.15; 4.16.7 преди 4.17
    • Linux Linux: 4.17; преди 4.17; 5.10.271 до 5.10.*; 5.15.222 до 5.15.*; 6.1.189 до 6.1.*; 6.6.158 до 6.6.*; 6.12.111 до 6.12.*; 6.18.53 до 6.18.*; 7.2.7 до 7.2.*; от 7.3 нататък

    История

    • 25 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-97995: Linux | freedomonline.bg