Към съдържанието
Търсене

CVE-2026-98947: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci_transport_recv_dgram_cb() During the closure of a datagram socket, the vmci_transport_recv_dgram_cb() function may be called, which will add the packets to the socket's backlog; then, after the receive queue is cleared, the __release_sock() function will move the packet back from the socket's backlog to the receive queue, which will lead to a memory leak. sock_close __sock_release __vsock_release // take ownership by user-space lock_sock_nested sock_set_flag(sk, SOCK_DEAD) vmci_transport_release vmci_dispatch_dgs vmci_datagram_invoke_guest_handler vmci_transport_recv_dgram_cb sk_receive_skb if (!sock_owned_by_user(sk)) [...] (!) else if sk_add_backlog() [...] (!) skb_queue_purge(&sk->sk_receive_queue) release_sock __release_sock // move all packets from the backlog // to the receive queue (!) sk_backlog_rcv vsock_queue_rcv_skb [...] __sock_queue_rcv_skb if (!sock_flag(sk, SOCK_DEAD)) // Since the socket is "dead", the function will not // be called sk->sk_data_ready(sk) sock_release_ownership(sk); sock_put Add a receive queue cleanup in the socket destructor to fix this. syzkaller report: unreferenced object 0xffff8880117bfb80 (size 240): comm "irq/56-vmw_vmci", pid 205, jiffies 4295064448 (age 73.992s) hex dump (first 32 bytes): 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&..... 00 00 00 00 00 00

    Засегнати продукти

    • Linux Linux: d021c344051af91f42c5ba9fdedc176740cbd238 преди 0f8e2b2045355a0ee2008125e573435504b13cee; d021c344051af91f42c5ba9fdedc176740cbd238 преди 4835dbcde5cc3ae37e0d0796052056b35fcae8bf; d021c344051af91f42c5ba9fdedc176740cbd238 преди 9907db2b8e7ba70b442bb9dec86526a6511fac62; d021c344051af91f42c5ba9fdedc176740cbd238 преди 7c24a4e87e219072e5e106f6791146cbf3b056b3
    • Linux Linux: 3.9; преди 3.9; 6.12.113 до 6.12.*; 6.18.57 до 6.18.*; 7.2.11 до 7.2.*; 7.3 до *

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98947: Linux | freedomonline.bg