143 lines
7.4 KiB
JSON
143 lines
7.4 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-43285",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-05-01T14:12:55.999Z",
|
|
"datePublished": "2026-05-08T13:11:11.191Z",
|
|
"dateUpdated": "2026-05-11T22:21:36.072Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-05-11T22:21:36.072Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: do not access current->mems_allowed_seq if !allow_spin\n\nLockdep complains when get_from_any_partial() is called in an NMI\ncontext, because current->mems_allowed_seq is seqcount_spinlock_t and\nnot NMI-safe:\n\n ================================\n WARNING: inconsistent lock state\n 6.19.0-rc5-kfree-rcu+ #315 Tainted: G N\n --------------------------------\n inconsistent {INITIAL USE} -> {IN-NMI} usage.\n kunit_try_catch/9989 [HC1[1]:SC0[0]:HE0:SE1] takes:\n ffff889085799820 (&____s->seqcount#3){.-.-}-{0:0}, at: ___slab_alloc+0x58f/0xc00\n {INITIAL USE} state was registered at:\n lock_acquire+0x185/0x320\n kernel_init_freeable+0x391/0x1150\n kernel_init+0x1f/0x220\n ret_from_fork+0x736/0x8f0\n ret_from_fork_asm+0x1a/0x30\n irq event stamp: 56\n hardirqs last enabled at (55): [<ffffffff850a68d7>] _raw_spin_unlock_irq+0x27/0x70\n hardirqs last disabled at (56): [<ffffffff850858ca>] __schedule+0x2a8a/0x6630\n softirqs last enabled at (0): [<ffffffff81536711>] copy_process+0x1dc1/0x6a10\n softirqs last disabled at (0): [<0000000000000000>] 0x0\n\n other info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(&____s->seqcount#3);\n <Interrupt>\n lock(&____s->seqcount#3);\n\n *** DEADLOCK ***\n\nAccording to Documentation/locking/seqlock.rst, seqcount_t is not\nNMI-safe and seqcount_latch_t should be used when read path can interrupt\nthe write-side critical section. In this case, do not access\ncurrent->mems_allowed_seq and avoid retry."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/slub.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "af92793e52c3a99b828ed4bdd277fd3e11c18d08",
|
|
"lessThan": "353dd9934447b9193643ae1afd938607a74d4915",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "af92793e52c3a99b828ed4bdd277fd3e11c18d08",
|
|
"lessThan": "efd767ddcef0669bbd33c6a823ea0a88f06d4b29",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "af92793e52c3a99b828ed4bdd277fd3e11c18d08",
|
|
"lessThan": "144080a5823b2dbd635acb6decf7ab23182664f3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/slub.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.18",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.18",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.16",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.19.6",
|
|
"lessThanOrEqual": "6.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18",
|
|
"versionEndExcluding": "6.18.16"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18",
|
|
"versionEndExcluding": "6.19.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18",
|
|
"versionEndExcluding": "7.0"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/353dd9934447b9193643ae1afd938607a74d4915"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/efd767ddcef0669bbd33c6a823ea0a88f06d4b29"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/144080a5823b2dbd635acb6decf7ab23182664f3"
|
|
}
|
|
],
|
|
"title": "mm/slab: do not access current->mems_allowed_seq if !allow_spin",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |