Към съдържанието
Търсене

CVE-2026-98098: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipc_named_node_up() on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry (publication) into the TIPC name table. If the number of these publications exceeds TIPC_MAX_PUBL (65535), protocol service types (such as node state and link state) are no longer inserted into the name table. This causes two issues: 1. User-space applications subscribing to node or link up/down events stop receiving notifications. 2. A NULL pointer dereference can occur: BUG: kernel NULL pointer dereference, address: 00000000000000d0 ... CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc4-default+ #5 PREEMPT(full) ... RIP: 0010:tipc_named_node_up (./include/linux/skbuff.h:2251 net/tipc/name_distr.c:195 net/tipc/name_distr.c:221) ... Call Trace: <IRQ> tipc_node_write_unlock (net/tipc/node.c:428) tipc_rcv (net/tipc/node.c:934 net/tipc/node.c:2189) tipc_udp_recv (net/tipc/udp_media.c:389) Thread 1 (tipc_net_finalize) | Thread 2 (named_distribute) -----------------------------|----------------------------- | ... | list_for_each_entry(publ, pls, binding_node) { | ... | __skb_queue_tail(list, skb); | ... | } | ... | hdr = buf_msg(skb_peek_tail(list)); ... | tipc_nametbl_publish(); | If 'tipc_nametbl_publish()' (Thread 1) fails because the number of local publications reaches TIPC_MAX_PUBL, list (Thread 2) will be empty. As a result, NULL is passed to 'buf_msg()', leading to a NULL pointer dereference. Fix these issues by allowing

    Засегнати продукти

    • Linux Linux: a5e7ac5ce134d8f72f59631011fafa7bbf7ca174 преди 246a4b4aace490664927042e93400a6f940d197f; a5e7ac5ce134d8f72f59631011fafa7bbf7ca174 преди 6188cf0c989dea60f2efe800eaebb7d0bd16e2b2; a5e7ac5ce134d8f72f59631011fafa7bbf7ca174 преди b5344e459996afb45e30fdc407b41e6674793b21; a5e7ac5ce134d8f72f59631011fafa7bbf7ca174 преди 68619f965329d2f7b113a3d5811aa23198f39105; a5e7ac5ce134d8f72f59631011fafa7bbf7ca174 преди ad805326d874062f8bc72a94884f86046148cde3; a5e7ac5ce134d8f72f59631011fafa7bbf7ca174 преди d0d82f1214f321143c5dbc2e48e4a4e6c4226895; a5e7ac5ce134d8f72f59631011fafa7bbf7ca174 преди b3b76e9f4f2476f1135b2ba7743a821db4a0df4b
    • Linux Linux: 3.15; преди 3.15; 5.15.222 до 5.15.*; 6.1.189 до 6.1.*; 6.6.158 до 6.6.*; 6.12.111 до 6.12.*; 6.18.53 до 6.18.*; 7.2.7 до 7.2.*; от 7.3 нататък

    История

    • 25 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници