Към съдържанието
Търсене

CVE-2026-99180: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcu_read_lock(). The filesystems that use them, ext4, f2fs and tmpfs, drop the map with utf8_unload() from ->put_super(), which runs when the last reference to the mount goes away. A lookup that is still inside such a filesystem at that point reads a freed map. With a pathwalk held up in utf8_casefold_hash() while the last reference to a casefolded tmpfs goes away: BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950 Read of size 8 at addr ff110001030fe658 by task walker/98 Call Trace: <TASK> utf8nlookup+0x74c/0x950 utf8byte+0x160/0x1560 utf8_casefold_hash+0x167/0x230 generic_ci_d_hash+0xdd/0x1c0 link_path_walk+0x11ad/0x1d30 path_lookupat+0x63/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 [...] Allocated by task 94: __kmalloc_cache_noprof+0x249/0x560 utf8_load+0x4e/0x570 shmem_parse_opt_casefold.isra.0+0x92/0x270 [...] Freed by task 97: kfree+0x1db/0x5b0 shmem_put_super+0x72/0x170 generic_shutdown_super+0x14c/0x530 kill_anon_super+0x3a/0x60 deactivate_locked_super+0x9c/0xf0 cleanup_mnt+0x9f/0x130 So far that has been hard to hit. umount(2) waits for a grace period in namespace_unlock() before it drops the mount, so only a mount whose last reference goes away elsewhere, like the close of a file or a chdir out of a lazily unmounted directory, can race a walker. So it is reachable. Delay the free until a grace period has passed. The map and the data table it holds a reference to then outlive any pathwalk that found the superblock before the mount went away. The reference on the data table module is dropped from the rcu callback as well. utf8-core is built in whenever CONFIG_UNICODE is set, so there is no module exit that would ha

    Засегнати продукти

    • Linux Linux: b886ee3e778ec2ad43e276fd378ab492cf6819b7 преди 092e14e1479a39157ca01668d43e4649793f39ed; b886ee3e778ec2ad43e276fd378ab492cf6819b7 преди 6472455f2b015cad43adb790cb63fe1d3cff2f57; b886ee3e778ec2ad43e276fd378ab492cf6819b7 преди f96c2731a105d6663c606388f5dc21781e00ade5; b886ee3e778ec2ad43e276fd378ab492cf6819b7 преди 5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07; b886ee3e778ec2ad43e276fd378ab492cf6819b7 преди 69a0d6b31d05e856c7335509222f25321e3c69ca; b886ee3e778ec2ad43e276fd378ab492cf6819b7 преди 2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8; b886ee3e778ec2ad43e276fd378ab492cf6819b7 преди 6560c3d9a6925e3747d9ad8463e16010c31ba715; b886ee3e778ec2ad43e276fd378ab492cf6819b7 преди a96c5299bd7305eb984377681eb3222a57376405
    • Linux Linux: 5.2; преди 5.2; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.161 до 6.6.*; 6.12.115 до 6.12.*; 6.18.59 до 6.18.*; 7.2.13 до 7.2.*; от 7.3 нататък

    История

    • 28 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99180: Linux | freedomonline.bg