310 lines
16 KiB
JSON
310 lines
16 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-46259",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2026-05-13T15:03:33.108Z",
|
||
"datePublished": "2026-06-03T15:49:56.428Z",
|
||
"dateUpdated": "2026-10-19T19:36:56.158Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T12:30:48.120Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix missing RCU protection when reading real_parent in do_task_stat()\n\nWhen reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent\nwithout proper RCU protection, which leads to:\n\n cpu 0 cpu 1\n ----- -----\n do_task_stat\n var = task->real_parent\n release_task\n call_rcu(delayed_put_task_struct)\n task_tgid_nr_ns(var)\n rcu_read_lock <--- Too late to protect task->real_parent!\n task_pid_ptr <--- UAF!\n rcu_read_unlock\n\nThis patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add\nproper RCU protection for accessing task->real_parent."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - Exploitation requires local `open()`/`read()` on procfs (`/proc/[pid]/stat` or thread `stat`); there is no network, adjacent-radio, or physical-device path to `do_task_stat()`.\nAC:L - An attacker can reliably race by running concurrent `read()` loops on `/proc/child/stat` while another thread exits and reaps the parent via `wait4()`, controlling both sides of the `release_task()`/`call_rcu()` window.\nPR:L - Triggering the bug needs only an unprivileged local account that can read procfs (default `hidepid=off` allows reading other users’ `stat`); no real root or init-namespace-only capability is required.\nUI:N - Exploitation is fully attacker-driven through syscalls and process lifecycle control; no victim user action (clicks, mounts, etc.) is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain, not a cross-boundary escape such as VM guest-to-host.\nC:H - The UAF dereferences freed `task_struct` memory via `task_pid_ptr()`/`__task_pid_nr_ns()`, enabling disclosure of stale slab contents and kernel pointers that can be groomed into an arbitrary-read primitive.\nI:H - Use-after-free on a `task_struct` slab object can be leveraged with heap grooming for control of freed memory and potential arbitrary write or code execution, not merely a bounded or cosmetic change.\nA:H - Concurrent UAF access to a freed parent `task_struct` can cause kernel oops/panic (KASAN reports slab-use-after-free class failures) even when full exploitation is not attempted."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/proc/array.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
|
||
"lessThan": "fefa0fcd78be465b7ad4c497fa6ec90d64194c04",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
|
||
"lessThan": "c93a33f28f915d446eea6fb3f0e1def0b3af1982",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
|
||
"lessThan": "1c8dc5b5517546c68ffae40b948336122bb61306",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
|
||
"lessThan": "0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
|
||
"lessThan": "73ec7c96601d61d52310c659145bb06d933a0fa6",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
|
||
"lessThan": "4f9ae386861e280b7631ca252f798d25575627ee",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
|
||
"lessThan": "dd8b13cb4ff1a4545a214ed897fdf2bc341155b6",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
|
||
"lessThan": "76149d53502cf17ef3ae454ff384551236fba867",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/proc/array.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "2.6.26",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "2.6.26",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.252",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.202",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.165",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.128",
|
||
"lessThanOrEqual": "6.6.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.12.75",
|
||
"lessThanOrEqual": "6.12.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.18.14",
|
||
"lessThanOrEqual": "6.18.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.19.4",
|
||
"lessThanOrEqual": "6.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "7.0",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.26",
|
||
"versionEndExcluding": "5.10.252"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.26",
|
||
"versionEndExcluding": "5.15.202"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.26",
|
||
"versionEndExcluding": "6.1.165"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.26",
|
||
"versionEndExcluding": "6.6.128"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.26",
|
||
"versionEndExcluding": "6.12.75"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.26",
|
||
"versionEndExcluding": "6.18.14"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.26",
|
||
"versionEndExcluding": "6.19.4"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.26",
|
||
"versionEndExcluding": "7.0"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/fefa0fcd78be465b7ad4c497fa6ec90d64194c04"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/c93a33f28f915d446eea6fb3f0e1def0b3af1982"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1c8dc5b5517546c68ffae40b948336122bb61306"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/73ec7c96601d61d52310c659145bb06d933a0fa6"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/4f9ae386861e280b7631ca252f798d25575627ee"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/dd8b13cb4ff1a4545a214ed897fdf2bc341155b6"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/76149d53502cf17ef3ae454ff384551236fba867"
|
||
}
|
||
],
|
||
"title": "procfs: fix missing RCU protection when reading real_parent in do_task_stat()",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2026-46259",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2026-10-16T15:21:25.410048Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"type": "CWE",
|
||
"cweId": "CWE-416",
|
||
"description": "CWE-416 Use After Free"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-10-19T19:36:56.158Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |