Към съдържанието
Търсене

CVE-2026-98068: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rds_conn_shutdown() consume a concurrent drop rds_conn_shutdown() finishes by moving the path from RDS_CONN_DISCONNECTING to RDS_CONN_DOWN, and also accepts RDS_CONN_ERROR as the starting state of that final transition, so that a FIN processed in softirq context during the teardown does not derail the shutdown into a noisy error path. But consuming that RDS_CONN_ERROR also consumes the shutdown pass that came with it: rds_conn_path_drop() sets RDS_CONN_ERROR and then queues cp_down_w, and a pass that starts on a path already in RDS_CONN_DOWN is a no-op. For the FIN case that is harmless - the socket the FIN arrived on is the very socket the teardown just released. It is not harmless for a dropper that attached something to the path first. rds_tcp_accept_one() is such a dropper. Its path claim in rds_tcp_accept_one_path() transitions RDS_CONN_DOWN -> RDS_CONN_CONNECTING, and a concurrent drop - a FIN on a previous socket in softirq context, an administrative reset - can put the path into RDS_CONN_ERROR between that claim and the state check that follows, which accepts RDS_CONN_ERROR. The accept then installs the freshly accepted socket with rds_tcp_set_callbacks() while the queued teardown - which sampled tc->t_sock before this socket existed - is still running. rds_connect_path_complete() fails its transition to RDS_CONN_UP and drops the path again, queueing the pass that should reap the socket it just installed. If the in-flight shutdown's final transition consumes that drop's RDS_CONN_ERROR, the queued pass finds the path in RDS_CONN_DOWN and does nothing. The installed socket is never torn down: it sits established with its callbacks armed and its rds_tcp_connection on rds_tcp_tc_list, the peer sees a connection that nothing ever reads, and the path is wedged in RDS_CONN_DOWN until some later event drops it again. Reproduced with widened race windows as an ever-grow

    Засегнати продукти

    • Linux Linux: e97656d03ca0cea888a0b9d382abce8233771f31 преди f777c602d3e15d3414b53f760147687bd56b03f2; e97656d03ca0cea888a0b9d382abce8233771f31 преди 7cb11257aa3e5ef0bedfd5d55ac60bb00347aa97; e97656d03ca0cea888a0b9d382abce8233771f31 преди 4980ce260205001d582a7b3cb5eab29877777fbc; e97656d03ca0cea888a0b9d382abce8233771f31 преди 0ec75c69918b7f6a1a5e3fb6442925246a9ec86b; e97656d03ca0cea888a0b9d382abce8233771f31 преди bd1cb197a07111ca8d4f4c21411c56a3c85a9797; e97656d03ca0cea888a0b9d382abce8233771f31 преди 4cb9b6d3d31a2dbaa5469981c2c4c03e9acc7aca; e97656d03ca0cea888a0b9d382abce8233771f31 преди 2941561395066be856a53626d4ca973dd9c982b2; e97656d03ca0cea888a0b9d382abce8233771f31 преди 260c6308fe2e19ad519389d44d582e292aecc3af
    • Linux Linux: 4.12; преди 4.12; 5.10.271 до 5.10.*; 5.15.222 до 5.15.*; 6.1.189 до 6.1.*; 6.6.158 до 6.6.*; 6.12.111 до 6.12.*; 6.18.53 до 6.18.*; 7.2.7 до 7.2.*; от 7.3 нататък

    История

    • 25 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98068: Linux | freedomonline.bg