PT-2026-116995 · Linux · Linux
CVE-2026-98776
·
تاريخ النشر
2026-10-18
·
تاريخ التحديث
2026-10-18
لا يوجد
لا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
In the Linux kernel, the following vulnerability has been resolved:
binderfs: fix UAF write in binder add device
binderfs binder device create() publishes the new dentry with
d make persistent() and then calls simple done creating(), which drops
the parent directory lock and the creator's dentry reference. It then
calls binder add device() to register the device in the global
binder devices list.
After simple done creating() releases the parent directory lock, a
concurrent unlinkat() can remove the new device entry. Dropping the
creator's dentry reference can then trigger binderfs evict inode(),
freeing the device. binder add device() later accesses the freed
object, causing UAF write.
Found by a modified Syzkaller:
BUG: KASAN: slab-use-after-free in hlist add head include/linux/list.h:1073 [inline]
BUG: KASAN: slab-use-after-free in binder add device+0xa9/0xc0 drivers/android/binder.c:7068
Write of size 8 at addr ffff88805b340c00 by task syz.1.532/11389
CPU: 0 UID: 0 PID: 11389 Comm: syz.1.532 Not tainted 7.2.0 #4 PREEMPT(full)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump stack lib/dump stack.c:94 [inline]
dump stack lvl+0x10e/0x1f0 lib/dump stack.c:120
print address description mm/kasan/report.c:378 [inline]
print report+0xf7/0x600 mm/kasan/report.c:482
kasan report+0xe4/0x120 mm/kasan/report.c:595
hlist add head include/linux/list.h:1073 [inline]
binder add device+0xa9/0xc0 drivers/android/binder.c:7068
binderfs binder device create.isra.0+0x724/0x990 drivers/android/binderfs.c:196
binder ctl ioctl+0x186/0x1b0 drivers/android/binderfs.c:241
vfs ioctl fs/ioctl.c:51 [inline]
do sys ioctl fs/ioctl.c:597 [inline]
se sys ioctl fs/ioctl.c:583 [inline]
x64 sys ioctl+0x18e/0x210 fs/ioctl.c:583
do syscall x64 arch/x86/entry/syscall 64.c:63 [inline]
do syscall 64+0x116/0x800 arch/x86/entry/syscall 64.c:94
entry SYSCALL 64 after hwframe+0x77/0x7f
RIP: 0033:0x7ff9027a833d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff903674018 EFLAGS: 00000246 ORIG RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff902a35fa0 RCX: 00007ff9027a833d
RDX: 0000200000000500 RSI: 00000000c1086201 RDI: 0000000000000004
RBP: 00007ff902850733 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff902a36038 R14: 00007ff902a35fa0 R15: 00007ffd7166bfa0
</TASK>
Allocated by task 11389:
kasan save stack+0x33/0x60 mm/kasan/common.c:57
kasan save track+0x14/0x30 mm/kasan/common.c:78
poison kmalloc redzone mm/kasan/common.c:398 [inline]
kasan kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan kmalloc include/linux/kasan.h:263 [inline]
kmalloc cache noprof+0x2e4/0x6f0 mm/slub.c:5489
kmalloc noprof include/linux/slab.h:988 [inline]
kzalloc noprof include/linux/slab.h:1309 [inline]
binderfs binder device create.isra.0+0x17a/0x990 drivers/android/binderfs.c:148
binder ctl ioctl+0x186/0x1b0 drivers/android/binderfs.c:241
vfs ioctl fs/ioctl.c:51 [inline]
do sys ioctl fs/ioctl.c:597 [inline]
se sys ioctl fs/ioctl.c:583 [inline]
x64 sys ioctl+0x18e/0x210 fs/ioctl.c:583
do syscall x64 arch/x86/entry/syscall 64.c:63 [inline]
do syscall 64+0x116/0x800 arch/x86/entry/syscall 64.c:94
entry SYSCALL 64 after hwframe+0x77/0x7f
Freed by task 11389:
kasan save stack+0x33/0x60 mm/kasan/common.c:57
kasan save track+0x14/0x30 mm/kasan/common.c:78
kasan save free info+0x3b/0x60 mm/kasan/generic.c:584
poison slab object mm/kasan/common.c:253 [inline]
kasan slab free+0x5f/0x80 mm/kasan/common.c:285
kasan slab free include/linux/kasan.h:235 [inline]
slab free hook mm/slub.c:2677 [inline]
slab free mm/slub.c:6377 [inline]
kfree+0x2fc/0x6e0 mm/slub.c:6692
binderf---truncated---
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Linux