Към съдържанието
Търсене

CVE-2026-98698: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element. crypt_len is then zero and aes_siv_encrypt() is called with an empty plaintext. kmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the unconditional sg_init_one() puts an invalid page into the scatterlist. With CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf(); without the debug check the bogus page is handed to the crypto backend. AES-SIV is defined for empty plaintext and the S2V result is then the complete output, so handle this case before the CTR step, which has nothing to encrypt.

    Засегнати продукти

    • Linux Linux: 39404feee691a2dc524a629ed6eb5cfe5d8898d1 преди de3297c8e521c0b0ddc89ece6fee84e25da9ecf0; 39404feee691a2dc524a629ed6eb5cfe5d8898d1 преди ce70c87252a14020cb40032efe208efc6e61b1ee; 39404feee691a2dc524a629ed6eb5cfe5d8898d1 преди d8c5dbbf584a1baaa008988ac64dd4495f7086bd; 39404feee691a2dc524a629ed6eb5cfe5d8898d1 преди 0b1e4a7eeb6a301ee33bd318982927cbdbae9f36; 39404feee691a2dc524a629ed6eb5cfe5d8898d1 преди 2f5b62f6534d336a62fdb9e88b186dd70b4323ef; 39404feee691a2dc524a629ed6eb5cfe5d8898d1 преди 452f1c9b76f7a122bbc4630b9691bda4809677c4; 39404feee691a2dc524a629ed6eb5cfe5d8898d1 преди 20f939b0c151d1d28e6b62a76b2454fa6fe877f2; 39404feee691a2dc524a629ed6eb5cfe5d8898d1 преди 5bfd4b0b40b79781d900cb2f7da0685070f53c67
    • Linux Linux: 4.10; преди 4.10; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.113 до 6.12.*; 6.18.56 до 6.18.*; 7.2.10 до 7.2.*; от 7.3 нататък

    История

    • 18 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98698: Linux | freedomonline.bg