Описание
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Prevent subbuf order change when resizing is disabled
Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()).
Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour.
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Prevent subbuf order change when resizing is disabled
Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()).
Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2026-74634
- https://git.kernel.org/stable/c/62978cf6347972c04130e4e841ba404504d92b32
- https://git.kernel.org/stable/c/7568e9e717e7540bd05bcc007f5d76fcaff3cdff
- https://git.kernel.org/stable/c/b45b91db41379ee5fb36c187d6d7c37b725cbe8e
- https://git.kernel.org/stable/c/bf98d7b0d5a99991e47e66cee4eb1d3fa514be97
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()). Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour.
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()). Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour.
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()). Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour.
In the Linux kernel, the following vulnerability has been resolved: r ...
