Към съдържанието
Търсене

CVE-2026-99131: Linux

8.2

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the file's size was big enough to exceed the quota's hardlimit. Commit eba0549bc7d1 replaced a capable() call by a has_capability_noaudit() to prevent unnecessary selinux audit messages. Turns out that both calls have slightly different semantics even though their documentation seems similar. Where in a nutshell: capable() - Tests the task's effective credentials has_ns_capability_noaudit() - Tests the task's real credentials This most of the time has no practical difference but in some cases like changing attrs (specifically group id in this case) through a NFS client this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively bypassing quota accounting checks. Using instead ns_capable_noaudit() should fix this issue and prevent selinux audit messages. This also fix the remaining calls to has_capability_noaudit()

    Засегнати продукти

    • Linux Linux: eba0549bc7d100691c13384b774346b8aa9cf9a9 преди 29f994db0447104a7a52fb6495193c80007cb66a; eba0549bc7d100691c13384b774346b8aa9cf9a9 преди e84bfb08016496ec5ce09a5ef9c813f23c060781; eba0549bc7d100691c13384b774346b8aa9cf9a9 преди 87881f816ab721d8a727cba20c36b9c71b489c8e; eba0549bc7d100691c13384b774346b8aa9cf9a9 преди 19a1a22029ad3ae3604c763af6bd1195cb73648f; eba0549bc7d100691c13384b774346b8aa9cf9a9 преди 7809ac0161c7c5f52ed348fb1ec683b2b454a83e; eba0549bc7d100691c13384b774346b8aa9cf9a9 преди e2f62a9744ebad3bcb6347a648e615026e9efeff
    • Linux Linux: 5.18; преди 5.18; 6.1.191 до 6.1.*; 6.6.161 до 6.6.*; 6.12.115 до 6.12.*; 6.18.59 до 6.18.*; 7.2.13 до 7.2.*; от 7.3 нататък

    История

    • 28 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99131: Linux | freedomonline.bg