Към съдържанието
Търсене

CVE-2026-99204: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debug_state_print() walks reco.node_data and formats their fields. The formatter holds dlm->spinlock, but the recovery participant list is protected by dlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches the list under dlm_reco_state_lock and frees the detached records after releasing it. A concurrent debugfs open can therefore read freed memory. Protect the participant traversal and field reads in debug_state_print() with dlm_reco_state_lock, matching the existing list writers. This also serializes the traversal against list_add_tail() during recovery-area initialization. Make the existing lock available to the debug code through dlmcommon.h; the lock remains internal to the OCFS2 DLM module. Release dlm->spinlock after formatting the other domain state and before acquiring dlm_reco_state_lock, so the debug reader does not nest the two locks. Leave recovery list insertion, detachment and freeing unchanged. KASAN report as below: BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0 Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896 CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x93/0xd0 print_report+0xce/0x630 ? debug_state_open+0x1169/0x12d0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x20e/0x420 ? debug_state_open+0x1169/0x12d0 kasan_report+0xe0/0x110 ? debug_state_open+0x1169/0x12d0 debug_state_open+0x1169/0x12d0 ? __pfx_debug_state_open+0x10/0x10 full_proxy_open_regular+0x193/0x310 do_dentry_open+0x595/0x12d0

    Засегнати продукти

    • Linux Linux: 007dce53a29ccffc000ab5373d188f73881390fd преди 03f2fdcc94238a5127ff8a21a4544fd6118cfc7b; 007dce53a29ccffc000ab5373d188f73881390fd преди 1c1dbaa16d70cf3d6b9b21503fc188f560376866; 007dce53a29ccffc000ab5373d188f73881390fd преди c8bc0d0f2ca3df37ef4d9c69ac5fb7d417d9b035; 007dce53a29ccffc000ab5373d188f73881390fd преди 403669041cb77bb5ffc5ce92bcfb49b2da3d989d; 007dce53a29ccffc000ab5373d188f73881390fd преди 25de9d3b5a81ba7bd52fdc9601f9ea7d1d3d6ae8; 007dce53a29ccffc000ab5373d188f73881390fd преди 04d4571c00db61a9664f387752fa05cb3c08a537; 007dce53a29ccffc000ab5373d188f73881390fd преди 2bc426a32bfb78868c7f76d9547132837b6b5284; 007dce53a29ccffc000ab5373d188f73881390fd преди 4c435828932bf46f29860e4a0375bcae101b778a
    • Linux Linux: 2.6.26; преди 2.6.26; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.161 до 6.6.*; 6.12.115 до 6.12.*; 6.18.59 до 6.18.*; 7.2.13 до 7.2.*; от 7.3 нататък

    История

    • 28 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99204: Linux | freedomonline.bg