Yüksek CVSS 7.8
CVE-2026-43499: Linux Kernel: serbest bırakılmış belleğin kullanımı
Açıklama (NVD)
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]
Özet bilgiler
- Ürün
- Linux Linux Kernel
- CVSS v3.1
- 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,89 (yüzdelik 60)
- CWE
- CWE-416
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| linux-linux-kernel | 2.6.39 | — | 6.1.175 |
| linux-linux-kernel | 6.2 | — | 6.6.140 |
| linux-linux-kernel | 6.7 | — | 6.12.86 |
| linux-linux-kernel | 6.13 | — | 6.18.27 |
| linux-linux-kernel | 6.19 | — | 7.0.4 |