Към съдържанието
Търсене

CVE-2026-99061: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user space process that created the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device interface is removed twice and the kernel crashes. The two paths are: - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P device. nl80211_del_interface() holds RTNL and the wiphy mutex and calls brcmf_p2p_del_vif(), which disables discovery and waits up to 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(), which unregisters the wdev and frees the vif and the ifp. - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives, and calls brcmf_remove_interface(ifp, false) for the same ifp. brcmf_p2p_ifp_removed() reads ifp->vif and then blocks on rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls cfg80211_unregister_wdev() on the wdev that was already unregistered and freed. The second list_del_rcu() of wdev->list faults on LIST_POISON2: brcmfmac: brcmf_p2p_del_vif delete P2P vif brcmfmac: brcmf_p2p_deinit_discovery enter brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared brcmfmac: brcmf_detach Enter brcmfmac: brcmf_bus_change_state 1 -> 0 brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed [1.5 s later, brcmf_p2p_del_vif() timed out] brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed Unable to handle kernel paging request at virtual address dead000000000122 Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211] Call trace: _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211] cfg80211_unre

    Засегнати продукти

    • Linux Linux: 9831bcb987df4aff6a1d85975f1dda4c654f298d преди 75e917473e20dea61f837f9afb5fc3435c9200d2; 9831bcb987df4aff6a1d85975f1dda4c654f298d преди c4c0659eb74f807e0e73742b101a07b0bb703d97; 9831bcb987df4aff6a1d85975f1dda4c654f298d преди 0f84eec09039deb9229fd35c55912a2397d3ae55; 9831bcb987df4aff6a1d85975f1dda4c654f298d преди 7b79131e357c4786765b20a994ad40d4d35f2163; 9831bcb987df4aff6a1d85975f1dda4c654f298d преди 2e0c8c60a11b3177e7432c71d41249e276a0825f; 9831bcb987df4aff6a1d85975f1dda4c654f298d преди eef16a74ff8ed2a838d6bb862bb2c7783fce7466; 9831bcb987df4aff6a1d85975f1dda4c654f298d преди 47ca6395a1d91545cc9403f9218bc61be941a0c3; 9831bcb987df4aff6a1d85975f1dda4c654f298d преди 08a3f02fea636e97a7422d1512f76dacdb5b0887
    • Linux Linux: 4.4; преди 4.4; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.113 до 6.12.*; 6.18.57 до 6.18.*; 7.2.11 до 7.2.*; 7.3 до *

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99061: Linux | freedomonline.bg