248 lines
14 KiB
JSON
248 lines
14 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-64012",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-19T07:54:57.027Z",
|
|
"datePublished": "2026-07-19T14:56:26.608Z",
|
|
"dateUpdated": "2026-07-19T14:56:26.608Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-07-19T14:56:26.608Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n\nWhen sfb has children (eg qfq qdisc) whose peek() callback is\nqdisc_peek_dequeued(), we could get a kernel panic. When the parent of such\nqdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from\nits child (sfb in this case), it will do the following:\n 1a. do a peek() - and when sensing there's an skb the child can offer, then\n - the child in this case(sfb) calls its child's (qfq) peek.\n qfq does the right thing and will return the gso_skb queue packet.\n Note: if there wasnt a gso_skb entry then qfq will store it there.\n 1b. invoke a dequeue() on the child (sfb). And herein lies the problem.\n - sfb will call the child's dequeue() which will essentially just\n try to grab something of qfq's queue.\n\n[ 127.594489][ T453] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]\n[ 127.594741][ T453] CPU: 2 UID: 0 PID: 453 Comm: ping Not tainted 7.1.0-rc1-00035-gac961974495b-dirty #793 PREEMPT(full)\n[ 127.595059][ T453] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 127.595254][ T453] RIP: 0010:qfq_dequeue+0x35c/0x1650 [sch_qfq]\n[ 127.595461][ T453] Code: 00 fc ff df 80 3c 02 00 0f 85 17 0e 00 00 4c 8d 73 48 48 89 9d b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 0c 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b\n[ 127.596081][ T453] RSP: 0018:ffff88810e5af440 EFLAGS: 00010216\n[ 127.596337][ T453] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000\n[ 127.596623][ T453] RDX: 0000000000000009 RSI: 0000001880000000 RDI: ffff888104fd82b0\n[ 127.596917][ T453] RBP: ffff888104fd8000 R08: ffff888104fd8280 R09: 1ffff110211893a3\n[ 127.597165][ T453] R10: 1ffff110211893a6 R11: 1ffff110211893a7 R12: 0000001880000000\n[ 127.597404][ T453] R13: ffff888104fd82b8 R14: 0000000000000048 R15: 0000000040000000\n[ 127.597644][ T453] FS: 00007fc380cbfc40(0000) GS:ffff88816f2a8000(0000) knlGS:0000000000000000\n[ 127.597956][ T453] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 127.598160][ T453] CR2: 00005610aa9890a8 CR3: 000000010369e000 CR4: 0000000000750ef0\n[ 127.598390][ T453] PKRU: 55555554\n[ 127.598509][ T453] Call Trace:\n[ 127.598629][ T453] <TASK>\n[ 127.598718][ T453] ? mark_held_locks+0x40/0x70\n[ 127.598890][ T453] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 127.599053][ T453] sfb_dequeue+0x88/0x4d0\n[ 127.599174][ T453] ? ktime_get+0x137/0x230\n[ 127.599328][ T453] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 127.599480][ T453] ? qdisc_peek_dequeued+0x7b/0x350 [sch_qfq]\n[ 127.599670][ T453] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 127.599831][ T453] tbf_dequeue+0x6b1/0x1098 [sch_tbf]\n[ 127.599988][ T453] __qdisc_run+0x169/0x1900\n\nThe right thing to do in #1b is to grab the skb off gso_skb queue.\nThis patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked()\nmethod instead."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/sched/sch_sfb.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "e13e02a3c68d899169c78d9a18689bd73491d59a",
|
|
"lessThan": "e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e13e02a3c68d899169c78d9a18689bd73491d59a",
|
|
"lessThan": "1e70274d3b81de28973bcdbce40a512bcb181ff9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e13e02a3c68d899169c78d9a18689bd73491d59a",
|
|
"lessThan": "e125f5980b730c67c92a30cf150ec8c3d6777318",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e13e02a3c68d899169c78d9a18689bd73491d59a",
|
|
"lessThan": "6c153d97c100f5b282c424101d8ff63122306997",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e13e02a3c68d899169c78d9a18689bd73491d59a",
|
|
"lessThan": "84bfbfc0c48731bcce74cdf4f9c497547ec525e0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e13e02a3c68d899169c78d9a18689bd73491d59a",
|
|
"lessThan": "dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e13e02a3c68d899169c78d9a18689bd73491d59a",
|
|
"lessThan": "9ad3288632c859cf84183199832d822e7a70bdae",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e13e02a3c68d899169c78d9a18689bd73491d59a",
|
|
"lessThan": "1b9bc71153b01dbde8045b9edede4240f4f5520e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/sched/sch_sfb.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.39",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.39",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.259",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.210",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.176",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.143",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.93",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.35",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0.12",
|
|
"lessThanOrEqual": "7.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.39",
|
|
"versionEndExcluding": "5.10.259"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.39",
|
|
"versionEndExcluding": "5.15.210"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.39",
|
|
"versionEndExcluding": "6.1.176"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.39",
|
|
"versionEndExcluding": "6.6.143"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.39",
|
|
"versionEndExcluding": "6.12.93"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.39",
|
|
"versionEndExcluding": "6.18.35"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.39",
|
|
"versionEndExcluding": "7.0.12"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.39",
|
|
"versionEndExcluding": "7.1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1e70274d3b81de28973bcdbce40a512bcb181ff9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e125f5980b730c67c92a30cf150ec8c3d6777318"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6c153d97c100f5b282c424101d8ff63122306997"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/84bfbfc0c48731bcce74cdf4f9c497547ec525e0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9ad3288632c859cf84183199832d822e7a70bdae"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1b9bc71153b01dbde8045b9edede4240f4f5520e"
|
|
}
|
|
],
|
|
"title": "net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |