256 lines
14 KiB
JSON
256 lines
14 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-72172",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-08-09T03:40:39.910Z",
|
|
"datePublished": "2026-08-15T05:53:37.795Z",
|
|
"dateUpdated": "2026-10-16T18:45:00.307Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-23T12:47:00.343Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mm_init: fix uninitialized struct pages for ZONE_DEVICE\n\nIf DAX memory is hotplugged into an unoccupied subsection of an early\nsection, section_activate() reuses the unoptimized boot memmap. However,\ncompound_nr_pages() still assumes that vmemmap optimization is in effect\nand initializes only the reduced number of struct pages. As a result, the\nremaining tail struct pages are left uninitialized, which can later lead\nto unexpected behavior or crashes.\n\nFix this by treating early sections as unoptimized when calculating how\nmany struct pages to initialize."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The flaw is in memmap_init_zone_device() reached via memremap_pages()/devm_memremap_pages() during device-DAX driver probe or ZONE_DEVICE hotplug (e.g., dev_dax_probe, Hyper-V VTL), not via network protocols; subsequent impact is triggered by local mmap/page-fault/get_user_pages activity on the DAX device.\nAC:L - After device-DAX with compound vmemmap (vmemmap_shift>0) is hotplugged into an unoccupied early-section subsection, uninitialized tail struct pages remain indefinitely; an attacker only needs to access that memory (e.g., mmap /dev/dax) to invoke kernel page-metadata operations, without races or uncontrollable victim state.\nPR:L - While initial ZONE_DEVICE hotplug requires administrator device-DAX configuration (daxctl/ndctl, driver bind), on a configured persistent-memory or cloud server unprivileged local users with /dev/dax access can trigger kernel use of the corrupt struct pages via mmap and page faults without CAP_SYS_ADMIN in the init namespace.\nUI:N - Exploitation requires no victim interaction beyond the attacker (or any local user) running programs that mmap or access the already-provisioned DAX device; no mount, click, or plug/unplug action by another user is needed at exploit time.\nS:U - Impact is kernel memory corruption, information disclosure, and denial of service within the host kernel security boundary; it does not inherently cross VM/host, IOMMU, or sandbox isolation even though cloud persistent-memory deployments are a plausible high-impact scenario.\nC:H - Uninitialized tail struct page metadata (flags, refcount, pgmap/lru fields) is later interpreted as valid by the MM subsystem; garbage contents can be read through page-table walks, refcount checks, and folio lookups, yielding kernel memory disclosure comparable to other uninitialized-page corruption bugs.\nI:H - Corrupt struct page fields can drive incorrect refcounting, compound-head/tail linkage, and ZONE_DEVICE pgmap handling, enabling heap-style memory corruption and potential arbitrary kernel write or control-flow hijack, not merely bounded data modification.\nA:H - The fix commit and call path explicitly warn of unexpected behavior and crashes; operations on uninitialized struct pages can provoke kernel oops, BUG_ON, use-after-free, or panic during page allocation, migration, or DAX fault handling, giving reliable denial of service."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/mm_init.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6fd3620b342861de9547ea01d28f664892ef51a1",
|
|
"lessThan": "c5ef574d57e4a701485c13f26822328c91f05413",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6fd3620b342861de9547ea01d28f664892ef51a1",
|
|
"lessThan": "511a60e71aec308b24722cffc1912bf6befb87bf",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6fd3620b342861de9547ea01d28f664892ef51a1",
|
|
"lessThan": "11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6fd3620b342861de9547ea01d28f664892ef51a1",
|
|
"lessThan": "da5234df0941665f3a3f5b80f3dab94046537be0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6fd3620b342861de9547ea01d28f664892ef51a1",
|
|
"lessThan": "b91e27bce37cab9f35de0059278ebe457ca9878b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6fd3620b342861de9547ea01d28f664892ef51a1",
|
|
"lessThan": "cd681403a87085562499d60325b7b45d3be11217",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"mm/mm_init.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.19",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.19",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.184",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.145",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.97",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.40",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.5",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.1.184"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.6.145"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.12.97"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.18.40"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "7.1.5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c5ef574d57e4a701485c13f26822328c91f05413"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/511a60e71aec308b24722cffc1912bf6befb87bf"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/da5234df0941665f3a3f5b80f3dab94046537be0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b91e27bce37cab9f35de0059278ebe457ca9878b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/cd681403a87085562499d60325b7b45d3be11217"
|
|
}
|
|
],
|
|
"title": "mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-72172",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-16T18:43:19.574652Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-16T18:45:00.307Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |