Към съдържанието
Търсене

CVE-2026-99174: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4_get_link() follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT). That reads s_mount_state in the ASSERT() of ext4_getblk() and again in ext4_es_lookup_extent(), and the lookup bumps the extent status hit or miss counter, all through sb->s_fs_info. ext4_put_super() destroys those counters, clears sb->s_fs_info and frees the sbi without waiting for a grace period. A pathwalk that is still in ext4_get_link() when the last reference to the mount goes away then dereferences a NULL s_fs_info, the freed sbi or the destroyed percpu counters. With a pathwalk held up in ext4_get_link() while the last reference goes away: KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] RIP: 0010:ext4_getblk+0xf0/0x640 Call Trace: <TASK> ext4_get_link+0x26c/0x410 pick_link+0xf96/0x1780 step_into_slowpath+0x9b8/0x1250 path_lookupat+0x484/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f So far that has been hard to hit. umount(2) waits for a grace period in namespace_unlock() before it drops the mount, so only a mount whose last reference goes away elsewhere, like the close of a file or a chdir out of a lazily unmounted directory, can race a walker. Keep sb->s_fs_info and free the sbi together with the extent status counters after a grace period. Split the counters out of ext4_es_unregister_shrinker() for that. The shrinker still gets wasted in ext4_put_super(), the counters go with the sbi.

    Засегнати продукти

    • Linux Linux: 6493792d3299b3e33f887ef8a150099d271faf9c преди cf3bd5824c985b350d150bcd76698ee5e993fcba; 6493792d3299b3e33f887ef8a150099d271faf9c преди b4b0598fad51a978fcbda9d55eef6b5bd3cbe7d8; 6493792d3299b3e33f887ef8a150099d271faf9c преди 4ce0e27ea610663a9cdc04e3bca38559147428d4; 6493792d3299b3e33f887ef8a150099d271faf9c преди 80d5db1686b05fad6f384be017714297d828a714; 6493792d3299b3e33f887ef8a150099d271faf9c преди 87d29b8b849738d52fe820d495fa0aa2d5a1ec82; 6493792d3299b3e33f887ef8a150099d271faf9c преди c17b44266a1f9fcb49b894d4611d1254bf1aa313
    • Linux Linux: 5.19; преди 5.19; 6.1.191 до 6.1.*; 6.6.161 до 6.6.*; 6.12.115 до 6.12.*; 6.18.59 до 6.18.*; 7.2.13 до 7.2.*; от 7.3 нататък

    История

    • 28 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99174: Linux | freedomonline.bg