Към съдържанието
Търсене

CVE-2026-99015: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci_sock_bind() clears hci_pi(sk)->hdev and drops the device reference under only the socket lock, whereas send_monitor_control_replay() holds hci_sk_list.lock for reading. Replay can observe a non-NULL hdev, then bind can clear it and drop the last reference before create_monitor_ctrl_open() reads hdev->id. This can cause a NULL pointer dereference if the pointer is reloaded, or a use-after-free if the old pointer is retained. The kernel reported: KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] RIP: 0010:create_monitor_ctrl_open+0x579/0x800 Call Trace: hci_sock_bind+0xd96/0x1190 __sys_bind+0x166/0x200 __x64_sys_bind+0x6d/0xb0 do_syscall_64+0xdd/0x4a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The same missing serialization lets hci_send_to_sock() select a socket for the old device and queue its frame after bind has detached the socket or installed a new binding. Take hci_sk_list.lock for writing when clearing the device pointer and resetting the socket state. This waits for existing replay and delivery readers to finish before detachment and prevents later readers from using the old binding. Keep hci_dev_put() outside the critical section because the final device release can sleep.

    Засегнати продукти

    • Linux Linux: f2f856b65ac4b77049c76c0e89ecd3a177e9fcd1 преди 88f47e66b1a6e0bfc350676937f3b552b434e74c; e04480920d1eec9c061841399aa6f35b6f987d8b преди 304adbdb96b0491c2b377e216b0bf417fc8e69a9; e04480920d1eec9c061841399aa6f35b6f987d8b преди 362126f739889436048f5573ebc87466d2525fd9; e04480920d1eec9c061841399aa6f35b6f987d8b преди 37cef0c8fb537f40600910d2c2e5f2d5509305f3; e04480920d1eec9c061841399aa6f35b6f987d8b преди 76f2e2665697340ac719e7ff1bf148dd014e55c1; e04480920d1eec9c061841399aa6f35b6f987d8b преди c3d2799877906d0c8392d96e14216cd82b020330; e04480920d1eec9c061841399aa6f35b6f987d8b преди e660a22402944f2615a16fde7129a3c497537329; e04480920d1eec9c061841399aa6f35b6f987d8b преди 381a0925c556a8d91a80a9b9e3e86651d60ffee3; d6ef8bb00aa65eceb413fc165a55086459863e38; 0e77f979a97d3d517fad0b51249ba6fb8ae2d365; 0782c8c7f80c9dd457acdfe16fd0f339f0e73093; 3719acc161d5c1ce09912cc1c9eddc2c5faa3c66; ff29fe26ab8679bc13a3f0bf5b2911535a1cfc35; 75dd00b755ebfa9b24eaedc9f42e9adfc00ae00c; 5.10.58 преди 5.10.273; 4.4.281 преди 4.5; 4.9.280 преди 4.10; 4.14.244 преди 4.15; 4.19.203 преди 4.20; 5.4.140 преди 5.5; 5.13.10 преди 5.14
    • Linux Linux: 5.14; преди 5.14; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.113 до 6.12.*; 6.18.57 до 6.18.*; 7.2.11 до 7.2.*; от 7.3 нататък

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99015: Linux | freedomonline.bg