Yüksek CVSS 7.1

CVE-2026-46243: Linux Kernel: hatalı girdi doğrulama

Yayın: 1 Haziran 2026 20:17 · Güncelleme: 6 Kasım 2026 10:19

Açıklama (NVD)

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

Özet bilgiler

Ürün: Linux Linux Kernel
CVSS v3.1: 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: %0,41 (yüzdelik 36)
CWE: CWE-20
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
linux-linux-kernel	2.6.24.1	—	5.10.258
linux-linux-kernel	5.11	—	5.15.209
linux-linux-kernel	5.16	—	6.1.175
linux-linux-kernel	6.2	—	6.6.142
linux-linux-kernel	6.7	—	6.12.92
linux-linux-kernel	6.13	—	6.18.34
linux-linux-kernel	6.19	—	7.0.11
linux-linux-kernel	2.6.24	2.6.24	—
linux-linux-kernel	2.6.24	2.6.24	—
linux-linux-kernel	2.6.24	2.6.24	—
linux-linux-kernel	2.6.24	2.6.24	—
linux-linux-kernel	2.6.24	2.6.24	—
linux-linux-kernel	2.6.24	2.6.24	—
linux-linux-kernel	2.6.24	2.6.24	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları