Към съдържанието
Търсене

CVE-2026-98981: Linux

8.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the entry from the filesystem, call detach_mounts() on the entry with the inode locked and then call d_delete() once the inode is unlocked. The thing is that between detach_mounts() and d_delete() the dentry is still hashed and positive. But after detach_mounts() nothing covers the dentry anymore. A lookup that finds this dentry in the dcache can uncover what the mounts hid. That's a problem when unlinking files or directories that are mountpoints in other mount namespaces. Everybody who had the underlying entry covered can race the detach_mount() call until d_delete() has run. The race window isn't all that small. It encompasses namespace_unlock() with a full synchronize_rcu_expedited() grace period and the inode_unlock() of the entry. In my experiments three walkers that kept trying read an overmounted file in 11938 of the 16140 unlinks that removed its mountpoint from a bind mount of the filesystem within a minute. Fun fact, d_invalidate() has the same ordering problem but gets it right. It unhashes the dentry first and detaches the mounts afterwards. Let's do the same in __detach_mounts(): - A lookup that hasn't found the dentry yet misses it in the dcache and waits for the directory lock that the caller holds until the name is gone for good. - A lockless lookup that found it already fails the mount_lock check while the dentry still counts as a mountpoint and the d_seq check once it doesn't, and retries. This fixes the lockless path. We still need to fix the reference count lookup in a follow-up patch. So d_drop() the dentry. The dentry stays positive and held but can't be found anymore. Then proceed with the detach and unlink. Reproducer: The reads were counted with the program below, three walkers for 60 s in a VM with 4 CPUs. The race window is stretched with the debug patch

    Засегнати продукти

    • Linux Linux: 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe преди b3fa3811ffffa130586c4ff8f7299b7fc69216d5; 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe преди 97cc290c57ea04337fd33912d780367add41525c; 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe преди bb917ec497f6099c6cb9375596e085a5f6b52ff2; 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe преди db90eecbde319527aa9480c039d32a0f5fe80574; 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe преди 8d71bfc9b3fc15d7103e82ea9dc5057541866e46; 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe преди d29cd99db3db74cf3447be74d25740981789d461; 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe преди 8300de4aa5d09061bfcf2af5b52c0cdba3873185; 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe преди 528b383dc35d1e5caf64ddf5d35f983ae543b0d0
    • Linux Linux: 3.18; преди 3.18; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.2.11 до 7.2.*; от 7.3 нататък

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98981: Linux | freedomonline.bg