Към съдържанието
Търсене

CVE-2026-98069: Linux

8.1

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, при специфични условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rds_conn_shutdown() rds_conn_shutdown() quiesces the transmit and receive-refill paths by waiting for RDS_IN_XMIT and RDS_RECV_REFILL to be sampled clear, and then runs the transport shutdown and rds_conn_path_reset(). Sampling the bits clear is not the same as owning them: the moment after the wait_event() returns, rds_send_xmit() can re-acquire RDS_IN_XMIT (or rds_ib_recv_refill() can re-acquire RDS_RECV_REFILL) and run concurrently with the teardown. The sender does recheck the connection state after taking the lock, but that recheck is a classic store-buffering pattern: teardown writes the state and reads the bit while the sender writes the bit and reads the state. acquire_in_xmit() is only an acquire operation, so on weakly ordered architectures both sides can miss each other's write, and the transmit path then runs while the transport zeroes its rings (e.g. rds_ib_ring_init()) and rds_send_path_reset() rewrites the transmit state under it. Oracle UEK fixed the same class of crashes - a 14-year tail of BUG_ON()s in rds_ib_sub_signaled(), unexpected op-codes and NULL dereferences in rds_ib_send_cqe_handler() during failover testing - by making the teardown path *acquire* the fastpath bit locks instead of testing them ("rds: Make sure transmit path and connection tear-down does not run concurrently"). Ownership of a single word is decided by RMW atomicity, so no cross-variable ordering is needed. Do the same here: take both locks before calling the transport shutdown, hold them across rds_conn_path_reset(), and release them explicitly with a wake-up afterwards. Both are released with clear_bit_unlock(), so that the ring re-initialization done by the transport shutdown and the transmit state rewritten by rds_send_path_reset() are ordered before either bit is seen clear by the next acquire_in_xmit() or acquire_refill(). The fastpath users of these bi

    Засегнати продукти

    • Linux Linux: 0f4b1c7e89e699f588807a914ec6e6396c851a72 преди 7f4f21e4439df30d9aca9fb3bac38191a2f34729; 0f4b1c7e89e699f588807a914ec6e6396c851a72 преди 1f900f585cbb0fbe6aa00c31c9f5bb63ee614456; 0f4b1c7e89e699f588807a914ec6e6396c851a72 преди 32e21bcf4b5b11454bf57c4bb3bf019b71512ace; 0f4b1c7e89e699f588807a914ec6e6396c851a72 преди 2e46248e375a516301884719f08b6015c79a6456; 0f4b1c7e89e699f588807a914ec6e6396c851a72 преди 7febb113795d5de5b690b208f4b0e64a5fad1201; 0f4b1c7e89e699f588807a914ec6e6396c851a72 преди 900e96c9749a06833801f60c393aa1d405ea226c; 0f4b1c7e89e699f588807a914ec6e6396c851a72 преди 1fe627e5db5c3f53a9f9f9c8a66671755d306955; 0f4b1c7e89e699f588807a914ec6e6396c851a72 преди 813f3582ac7ae9f60f917937d54660e0952d5f2d
    • Linux Linux: 2.6.37; преди 2.6.37; 5.10.271 до 5.10.*; 5.15.222 до 5.15.*; 6.1.189 до 6.1.*; 6.6.158 до 6.6.*; 6.12.111 до 6.12.*; 6.18.53 до 6.18.*; 7.2.7 до 7.2.*; от 7.3 нататък

    История

    • 25 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98069: Linux | freedomonline.bg