Към съдържанието
Търсене

CVE-2026-98007: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.

    Засегнати продукти

    • Linux Linux: bfc5c19b4b48840627af0d0f1c8f4461b276e508 преди 2ff38b3552af53238aee6c877ae64cc798d46fce; bb124da69c47dd98d69361ec13244ece50bec63e преди 656d40d1ca228ee21a9b3280432479fc9eae75ab; bb124da69c47dd98d69361ec13244ece50bec63e преди e2e1161e03fecff6d2229a81b024337144bfcd97; bb124da69c47dd98d69361ec13244ece50bec63e преди f8ae8275c721334ee50fafdd986fb83294eb941a; bb124da69c47dd98d69361ec13244ece50bec63e преди c3fd8e5fd100f122bad503bdc0e9277219533253; 6.6.15 преди 6.6.158
    • Linux Linux: 6.7; преди 6.7; 6.6.158 до 6.6.*; 6.12.111 до 6.12.*; 6.18.53 до 6.18.*; 7.2.7 до 7.2.*; от 7.3 нататък

    История

    • 25 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98007: Linux | freedomonline.bg