Към съдържанието
Търсене

CVE-2026-99053: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping its RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS handlers then lock and access the node, racing with timer-driven cleanup of a down peer. Generic netlink serialization does not exclude the node timer. The following interleaving can leave a handler using a freed node: CPU 0: find the node under RCU and release the node read lock CPU 1: tipc_node_timeout() clears the links and unlinks the down node CPU 1: drop the list and timer references, queuing tipc_node_free() CPU 0: leave the RCU read-side critical section CPU 1: complete the grace period and free the node CPU 0: acquire the node lock through the stale pointer LINK_SET also uses the node's media address after releasing the node lock, when passing queued packets to tipc_bearer_xmit(). KASAN on v7.3-rc5 reported: BUG: KASAN: slab-use-after-free in _raw_read_lock_bh Write of size 4 at addr ffff88807e06f008 by task poc/92 Call Trace: _raw_read_lock_bh kernel/locking/spinlock.c:287 tipc_nl_node_set_link net/tipc/node.c:2475 genl_family_rcv_msg_doit net/netlink/genetlink.c:1114 genl_rcv_msg net/netlink/genetlink.c:1209 netlink_rcv_skb net/netlink/af_netlink.c:2575 Allocated by task 0: tipc_node_create net/tipc/node.c:539 tipc_node_check_dest net/tipc/node.c:1196 tipc_disc_rcv net/tipc/discover.c:252 Freed by task 92: kfree mm/slub.c:6801 rcu_core kernel/rcu/tree.c:2919 Last potentially related work creation: __call_rcu_common.constprop.0 kernel/rcu/tree.c:3181 tipc_node_timeout net/tipc/node.c:814 Acquire a reference to the selected node wi

    Засегнати продукти

    • Linux Linux: 6a939f365bdb03a74b4617bdb4402fc08da088b9 преди 384edc67201f8561b7de952647b923f0524b1f36; 6a939f365bdb03a74b4617bdb4402fc08da088b9 преди 5b7e58e8be90f4e8530e7a60372d003dfa7fd666; 6a939f365bdb03a74b4617bdb4402fc08da088b9 преди 92f3b3368722631e933a4db0cf8bd578ed08cd9c; 6a939f365bdb03a74b4617bdb4402fc08da088b9 преди b60259d4047fbb735476c729dcf9306a038b6110; 6a939f365bdb03a74b4617bdb4402fc08da088b9 преди f17e70206a1e763fcca2578a8db3c4eed0f843a9; 6a939f365bdb03a74b4617bdb4402fc08da088b9 преди 1428c5f1d346a2e1ac9156713975a72246957009; 6a939f365bdb03a74b4617bdb4402fc08da088b9 преди 3c3b308ee6e25729a6cf09b69cdd0e093220d40b; 6a939f365bdb03a74b4617bdb4402fc08da088b9 преди 17e73bae400f6a434dc006e3bee92c94cf781954
    • Linux Linux: 4.19; преди 4.19; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.113 до 6.12.*; 6.18.57 до 6.18.*; 7.2.11 до 7.2.*; от 7.3 нататък

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99053: Linux | freedomonline.bg