222 lines
12 KiB
JSON
222 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-98378",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.345Z",
|
|
"datePublished": "2026-10-09T07:34:18.626Z",
|
|
"dateUpdated": "2026-10-24T14:08:37.091Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-24T14:08:37.091Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes the ID in link->id.\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link\niterator takes a reference without this check.\n\nIf anon_inode_getfile() then fails, the creator removes the ID and frees\nits still-private link directly. The iterator is left with a dangling\nreference and its next bpf_link_put() accesses freed memory.\n\nTreat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as\nbpf_link_by_id() does.\n\n BUG: KASAN: slab-use-after-free in bpf_link_put\n Write of size 8 by task exp/384\n Call Trace:\n bpf_link_put kernel/bpf/syscall.c:3372\n bpf_link_seq_next kernel/bpf/link_iter.c:33\n bpf_seq_read kernel/bpf/bpf_iter.c:158\n vfs_read fs/read_write.c:572\n ksys_read fs/read_write.c:716\n do_syscall_64 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121\n Kernel panic - not syncing: KASAN: panic_on_warn set ..."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - Both required paths are local: bpf(BPF_LINK_CREATE/BPF_ITER_CREATE) prepares the bpf_link iterator, and read() reaches bpf_seq_read() -> bpf_link_seq_next() -> the patched bpf_link_get_curr_or_next(); no network data enters this state.\nAC:L - The attacker can fill fs.file-max so anon_inode_getfile() returns -ENFILE, then run the iterator reader and repeated BPF_LINK_CREATE calls concurrently, controlling both sides of the IDR insert/remove race.\nPR:L - BPF_PROG_LOAD for BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON, but bpf_token_capable() accepts them in a delegated bpffs token's user namespace; this permits a namespace-root local user, while a bare user namespace does not.\nUI:N - After preparing the iterator and program FDs, the attacking process itself issues read() and concurrent BPF_LINK_CREATE calls; no victim action is required.\nS:U - bpf_link_get_curr_or_next() leaves a dangling object inside the same host kernel that services the BPF syscalls; it crosses no guest/host, IOMMU, or separate security authority boundary.\nC:H - The iterator retains a freed struct bpf_link pointer; reclaiming that slab object makes later bpf_link_put()/bpf_link_free() consume attacker-influenced refcnt, ops, and prog fields, supporting kernel-memory disclosure.\nI:H - bpf_link_put() performs atomic64_dec_and_test() on the freed object's first eight bytes and can initialize and queue its reclaimed work_struct, so controlled reuse supports arbitrary corruption or control-flow hijacking.\nA:H - The demonstrated read() path reaches bpf_link_seq_next() and bpf_link_put() after the link is freed, producing a KASAN use-after-free and kernel panic; the same stale write can crash a non-KASAN kernel."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/bpf/syscall.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
|
|
"lessThan": "68930f8d40ab4c10ca3b019f076136758fd100a8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
|
|
"lessThan": "c251ed48bd9063cf7de6049421e78b6de989060f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
|
|
"lessThan": "798a61edbc436cacdb659927d067368eeb1e30e2",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
|
|
"lessThan": "6e271f093d15d323f42de26f66556af53fa8e19f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
|
|
"lessThan": "87ce4b53b7436b50fc984f0a6afaf77f68ac5573",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
|
|
"lessThan": "50e80e2bb5e2be8515205b9c496b9640ddefa434",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/bpf/syscall.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.19",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.19",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.189",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.158",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.112",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.55",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.9",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.1.189"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.6.158"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.12.112"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.18.55"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "7.2.9"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/68930f8d40ab4c10ca3b019f076136758fd100a8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c251ed48bd9063cf7de6049421e78b6de989060f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/798a61edbc436cacdb659927d067368eeb1e30e2"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6e271f093d15d323f42de26f66556af53fa8e19f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/87ce4b53b7436b50fc984f0a6afaf77f68ac5573"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/50e80e2bb5e2be8515205b9c496b9640ddefa434"
|
|
}
|
|
],
|
|
"title": "bpf: Skip unsettled links in link iterator",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |