PT-2026-61227 · Linux · Linux
CVE-2026-63910
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
dma-buf: fix UAF in dma buf fd() tracepoint
Once FD ADD() returns, the fd is live in the file descriptor table
and a thread sharing that table can close() it before DMA BUF TRACE()
runs. The close drops the last reference, fput() frees the dma buf,
and the tracepoint then dereferences dmabuf to take dmabuf->name lock
-- slab-use-after-free.
Split FD ADD() back into get unused fd flags() + fd install() and
emit the tracepoint between them. While the fdtable slot is reserved
with a NULL file pointer, a racing close() returns -EBADF without
entering fput(), so the dma buf stays alive across the trace. Same
approach as commit 2d76319c4cbb ("dma-buf: fix UAF in dma buf put()
tracepoint").
This undoes the FD ADD() conversion done in commit 34dfce523c90
("dma: convert dma buf fd() to FD ADD()"); FD ADD() has no place to
hook the tracepoint safely.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux