Към съдържанието
Търсене

CVE-2026-98979: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount namespace must not be NULL, i.e., unmounted. Problem is that clone_private_mount() has MNT_NS_INTERNAL which makes that trivially true. So that passes the test and attach_recursive_mnt() accepts that as a mount point and funny enough, count_mounts() dereferences MNT_NS_INTERNAL. The problem is it is an error pointer... So we can reach this in userspace via fanotify. A filesystem mark on the lower filesystem of an overlay reports paths on the layer clone and reading the event hands out a descriptor on it. For example with debugfs as the lower layer it goes kaboom: openat(evfd, "tracing", O_DIRECTORY) Oops: general protection fault KASAN: null-ptr-deref in range [0x1d0-0x1d7] RIP: 0010:count_mounts+0x35/0x200 attach_recursive_mnt finish_automount And since that sleeping beauty happens under namespace_sem held for writing every mount operation on the system blocks from then on. Congrats. Use is_mounted() instead which rejects unmounted and internal mounts alike. The open fails with EINVAL just as it did before clone_private_mount() used MNT_NS_INTERNAL.

    Засегнати продукти

    • Linux Linux: df820f8de4e481222b17f9bcee7b909ae8167529 преди d8c7f74adf5de78035d41aa33c8f71e12b3ca430; df820f8de4e481222b17f9bcee7b909ae8167529 преди c88546071d30417ab9e55821c83f4dc7756cff6f; df820f8de4e481222b17f9bcee7b909ae8167529 преди c98e74d73a3356ab00fc6bb9dec3c77da1ec1ce4; df820f8de4e481222b17f9bcee7b909ae8167529 преди 95fb7c259b86f5521f04973040ad492f2bef6f82; df820f8de4e481222b17f9bcee7b909ae8167529 преди 35f2013f83ef16f9f0331c4c3a8e8d161580d574; df820f8de4e481222b17f9bcee7b909ae8167529 преди 494c57572d2d5bc2839553ed41aabe92ed0f587c; df820f8de4e481222b17f9bcee7b909ae8167529 преди 776e20e4fdc23c23687b511ffdc80047878049d3; df820f8de4e481222b17f9bcee7b909ae8167529 преди ba985ce08471c555af2a2fbe217c1bc2e72a6d8c
    • Linux Linux: 5.8; преди 5.8; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.113 до 6.12.*; 6.18.57 до 6.18.*; 7.2.11 до 7.2.*; от 7.3 нататък

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98979: Linux | freedomonline.bg