Към съдържанието
Търсене

CVE-2026-98548: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary addresses, processing the ERROR chunk takes the non-fatal stale-cookie retry path sctp_sf_do_5_2_6_stale(), which queues SCTP_CMD_DEL_NON_PRIMARY while keeping the association alive. sctp_cmd_del_non_primary() removes every non-primary transport - including the very transport this packet arrived on, which is still referenced by the receive lookup and shared by all chunks of the packet via chunk->transport. sctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from the removed transport, but right afterwards the bundled DATA chunk makes sctp_assoc_bh_rcv() re-register asoc->peer.last_data_from = chunk->transport unconditionally, undoing the redirection with the just-removed transport. Once the packet is done, the receive reference is dropped and the transport is RCU-freed, while the surviving association keeps the dangling last_data_from. A later FWD-TSN (or the delayed SACK timer) makes sctp_gen_sack() dereference it (->param_flags and friends), and sctp_make_sack()/sctp_outq_select_transport() may write to the freed object and link it into the live transport list. This is a use-after-free triggerable by any malicious SCTP peer (or a local unprivileged user acting as one) with no capabilities required: BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660 Read of size 4 at addr ffff88800e1e356c by task poc/115 Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <- sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv Allocated: sctp_transport_new <- sctp_assoc_add_peer <- sctp_process_init (INIT-ACK processing) Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core (call_rcu queued by sctp_transport_put at end of sctp_rcv) The bugg

    Засегнати продукти

    • Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 854c053c71459f8db7ef07db9cfa4eec5f5206f2; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 965e21ea16acb394d5e5801998ca9b0adc669665; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 1cd246b214dc9acf4e2f11d58c035e1e672fe7d2; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди d68c9287b3ca0d6faadc61fbcb18d1a6b5493321; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди ec23855274a73906b02f0d124fefd9cb3c008b1d; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 6df536c5acbc0abd6f119d02e24f4a2ed97707f4; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 4498467a8af06cfa3d71cb04bd7c4170dec8f449
    • Linux Linux: 2.6.12; преди 2.6.12; 5.10.271 до 5.10.*; 5.15.222 до 5.15.*; 6.1.189 до 6.1.*; 6.6.158 до 6.6.*; 6.12.112 до 6.12.*; 6.18.55 до 6.18.*; 7.2.9 до 7.2.*; от 7.3 нататък

    История

    • 18 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98548: Linux | freedomonline.bg