187 lines
9.5 KiB
JSON
187 lines
9.5 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-99171",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.399Z",
|
|
"datePublished": "2026-10-28T10:35:26.598Z",
|
|
"dateUpdated": "2026-10-30T12:42:35.809Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:42:35.809Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: free the sbi after a grace period\n\nIf the \"nocase\" mount option ntfs3 uses custom hash and dentry compare\nfunctions. Both access ntfs3 superblock private information in rcu\npathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any\nrcu delay. A lookup that's still inside the filesystem when the last\nreference to the mount is dropped causes a UAF. With a pathwalk held up\nin ntfs_d_hash() while the last reference to the mount goes away:\n\n BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940\n Read of size 8 at addr ff1100010453c850 by task walker/99\n Call Trace:\n <TASK>\n ntfs_nls_to_utf16+0x752/0x940\n ntfs_d_hash+0x22b/0x500\n link_path_walk+0x11ad/0x1d30\n path_lookupat+0x63/0xb00\n filename_lookup+0x1f1/0x5b0\n vfs_statx+0xd7/0x3b0\n [...]\n Allocated by task 95:\n __kmalloc_cache_noprof+0x249/0x560\n ntfs_init_fs_context+0x2db/0x5a0\n alloc_fs_context+0x52e/0xc70\n [...]\n Freed by task 98:\n kfree+0x1db/0x5b0\n deactivate_locked_super+0x9c/0xf0\n cleanup_mnt+0x9f/0x130\n task_work_run+0x131/0x250\n\nThe bug is currently masked by the grace period in namespace_unlock()\nfor umount(2). Keep the necessary information until the filesystem\nprivate info is freed and free it with an rcu delay.\n\nntfs3_free_sbi() now runs from an rcu callback and drops the upcase\ntable via ntfs_put_shared(). So switch s_shared_lock over to\nspin_lock_bh(). Otherwise the callback can deadlock against a task\nholding the lock on the same cpu."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/ntfs3/ntfs_fs.h",
|
|
"fs/ntfs3/super.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
|
|
"lessThan": "c39150784a801dbbfaf4fbfa284cb610552a5039",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
|
|
"lessThan": "36e6753daf9bb64563dcb5a3bb22f7699d973fa2",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
|
|
"lessThan": "c8b1a4840467930e01f1a9374d991d7a8a2896c1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
|
|
"lessThan": "7abecef26a9be8f9de70659a3092250461a52072",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
|
|
"lessThan": "c01b091b06412d3b1b53d8c2925f6de586c8a2fc",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/ntfs3/ntfs_fs.h",
|
|
"fs/ntfs3/super.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.161",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.115",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.59",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.13",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.6.161"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.12.115"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.18.59"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "7.2.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c39150784a801dbbfaf4fbfa284cb610552a5039"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/36e6753daf9bb64563dcb5a3bb22f7699d973fa2"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c8b1a4840467930e01f1a9374d991d7a8a2896c1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/7abecef26a9be8f9de70659a3092250461a52072"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c01b091b06412d3b1b53d8c2925f6de586c8a2fc"
|
|
}
|
|
],
|
|
"title": "ntfs3: free the sbi after a grace period",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |