Към съдържанието
Търсене

CVE-2026-99127: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: page_pool: keep frag_offset aligned for odd-sized requests page_pool_alloc_frag_netmem() rounds the requested fragment size with size = ALIGN(size, dma_get_cache_alignment()); dma_get_cache_alignment() returns 1 unless the architecture defines ARCH_DMA_MINALIGN, which DMA-coherent architectures such as x86 do not. There the ALIGN() is a no-op and pool->frag_offset advances by the raw, unrounded size. A single caller asking for an odd size then leaves frag_offset misaligned for every fragment carved out of that page afterwards. The pool is shared, so the damage is not confined to the caller that caused it. The per-cpu system_page_pool used by generic XDP hits this. skb_pp_cow_data() allocates its fragments with the raw packet length: size = min_t(u32, len, PAGE_SIZE); truesize = size; page = page_pool_dev_alloc(pool, &page_off, &truesize); leaving frag_offset odd for whatever is carved out of that page next. Its own head allocation is already aligned -- SKB_HEAD_ALIGN(size) plus the XDP_PACKET_HEADROOM its callers pass -- so it is a later user of the shared pool that pays: page_pool_dev_alloc_va() returns a misaligned buffer, napi_build_skb() installs it as skb->head, and skb_shinfo(skb) == skb->head + skb->end is misaligned with it. skb_shinfo()->dataref is a 4-byte atomic_t at offset 0x20, so the atomic_inc() in __skb_clone() straddles a cache line. On x86 with split lock detection -- fatal for kernel split locks by default -- this panics the machine: Oops: Split lock detected RIP: 0010:skb_clone+0x154/0x1e0 Call Trace: <IRQ> raw_local_deliver+0x1ed/0x2c0 ip_protocol_deliver_rcu+0x54/0x1c0 ip_local_deliver_finish+0x85/0x100 ip_local_deliver+0x67/0x100 __netif_receive_skb_one_core+0x85/0xa0 process_backlog+0x87/0x130 Reproduced by attaching any generic-mode XDP program to loopback and opening a RAW IPPROTO_UDP socket, which makes raw_local_deliver() clone

    Засегнати продукти

    • Linux Linux: 53e0961da1c7bbdabd1abebb20de403ec237ec09 преди 8ab058f49e801803c4a755b09fe4a920d194da7f; 53e0961da1c7bbdabd1abebb20de403ec237ec09 преди 31e1a71995f23446c9d9e6ba170a6b16b110d243; 53e0961da1c7bbdabd1abebb20de403ec237ec09 преди ccc28e498ef1c6eaaa16e61c6edb52c32a4f14bb; 53e0961da1c7bbdabd1abebb20de403ec237ec09 преди 22b67b0f59f5a7f4fa1e6043a1987e167c5d06d2; 53e0961da1c7bbdabd1abebb20de403ec237ec09 преди 813a72beaa5d3f4bb135e0def9b3f07a3511ca0e; 53e0961da1c7bbdabd1abebb20de403ec237ec09 преди dca1b51693c81eaf77e50980be373e01ae857394; 53e0961da1c7bbdabd1abebb20de403ec237ec09 преди dc0df5a0c62ccea1d0e08d39a4dc9064de81d411
    • Linux Linux: 5.15; преди 5.15; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.161 до 6.6.*; 6.12.115 до 6.12.*; 6.18.59 до 6.18.*; 7.2.13 до 7.2.*; от 7.3 нататък

    История

    • 28 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници