Към съдържанието
Търсене

CVE-2026-98687: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tb_xdp_properties_request() allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set it to 63. After the fixed response fields are subtracted, the driver treats this as 48 data dwords. Commit 322e93448d90 ("thunderbolt: Clamp XDomain response data copy to allocation size") only bounds the copy against data_len. If data_len is at least 48, memcpy() reads 192 bytes from the 180-byte res->data array, causing a 12-byte heap out-of-bounds read. Commit 4db2bd2ed478 ("thunderbolt: Limit XDomain response copy to actual frame size") limits the earlier copy but does not constrain this header-derived length. Reject response data lengths that exceed the allocated source buffer before copying them into the assembled property block.

    Засегнати продукти

    • Linux Linux: d1ff70241a275133e1a0258b7c23588b122276c8 преди 9fba032802b5858bc6186b34f8e966429ff155ab; d1ff70241a275133e1a0258b7c23588b122276c8 преди 7c028d2ae85eca86b82cab1163a9ac1187a2e666; d1ff70241a275133e1a0258b7c23588b122276c8 преди 37ea4304bd9f57ebe719409f010915495467f05c; d1ff70241a275133e1a0258b7c23588b122276c8 преди b270c1074860de74da0d6b5250fb06b359b9d509; d1ff70241a275133e1a0258b7c23588b122276c8 преди a766a86ff48acee76aeb8e2575771040749e509d; d1ff70241a275133e1a0258b7c23588b122276c8 преди 2f97f929dad9eb3e1f63b721d2dd49bf9bc68efa; d1ff70241a275133e1a0258b7c23588b122276c8 преди 737a1d2e9642d5f718bd29aa4a98b9eef3832f0a; d1ff70241a275133e1a0258b7c23588b122276c8 преди 80756e263846ab694984e749e8c626897331438f
    • Linux Linux: 4.15; преди 4.15; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.113 до 6.12.*; 6.18.56 до 6.18.*; 7.2.10 до 7.2.*; 7.3 до *

    История

    • 18 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98687: Linux | freedomonline.bg