Към съдържанието
Търсене

CVE-2026-99227: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap io_waitid packs the cancellation state into bit 31 of ->refs and uses bits 30:0 as a 31-bit reference counter: #define IO_WAITID_CANCEL_FLAG BIT(31) #define IO_WAITID_REF_MASK GENMASK(30, 0) __io_waitid_cancel() marks a request canceled, then increments the low bits of ->refs to claim completion ownership. When another path owns the request, the increment remains even though cancellation returns false. The request remains discoverable by cancellation, so repeated failed attempts can wrap the 31-bit reference field to zero. A later cancellation can claim ownership and complete the request a second time. Use atomic_fetch_or() when setting the cancel flag and inspect the old flag value. The first cancel attempt continues to the existing ownership increment, preserving its wake and issuer handoff semantics. Later attempts see the cancel flag and return without incrementing the reference field. This makes repeated failed cancellation attempts idempotent while leaving the first-cancel state transitions unchanged.

    Засегнати продукти

    • Linux Linux: f31ecf671ddc498f20219453395794ff2383e06b преди 20b67288574c7c3df6b8ea7ed3b7af90a868006f; f31ecf671ddc498f20219453395794ff2383e06b преди 5bfeee1774791602a0d53eb717f00f172127a017; f31ecf671ddc498f20219453395794ff2383e06b преди 857aa2012b91cad6fdef54a4b6c632d9d0b6e64f; f31ecf671ddc498f20219453395794ff2383e06b преди 22fb4a4518e305164c7f203608287564de292f34; f31ecf671ddc498f20219453395794ff2383e06b преди 98787d3fa4e99564d2b2bc21255b21f670c450d0
    • Linux Linux: 6.7; преди 6.7; 6.12.115 до 6.12.*; 6.18.60 до 6.18.*; 7.2.14 до 7.2.*; 7.3.1 до 7.3.*; от 7.4-rc1 нататък

    История

    • 2 ноември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99227: Linux | freedomonline.bg