厂商发布
厂商对产品安全、配置或策略的更新说明。
-
CVE-2026-46331
In the Linux kernel, the following vulnerability has been resolved:net/sched: fix pedit partial COW leading to page cache corruptiontcf_pedit_act() computes the COW range for skb_ensure_writable()once before the key loop using tcfp_off_max_hint, but the hint doesnot account for the runtime header offset added by typed keys. Thiscan leave part of the write re…
In the Linux kernel, the following vulnerability has been resolved:net/sched: fix pedit partial COW leading to page cache corruptiontcf_pedit_act() computes the COW range for skb_ensure_writable()once before the key loop using tcfp_off_max_hint, but the hint doesnot account for the runtime header offset added by typed keys. Thiscan leave part of the write reIn the Linux kernel, the following vulnerability has been resolved:net/sched: fix pedit partial COW leading to page cache corruptiontcf_pedit_act() computes the COW range for skb_ensure_writable()once before the key loop using tcfp_off_max_hint, but the hint doesnot account for the runtime header offset added by typed keys. Thiscan leave part of the write region un-COW'd.Fix by moving skb_ensure_writable() inside the per-key loop wherethe actual write offset is known, and add overflow checking on theoffset arithmetic. For negative offsets (e.g. Ethernet header editsat ingress), use skb_cow() to COW the headroom instead. Guardoffset_valid() against INT_MIN, where negation is undefined.扩展字段
{ "cve_id": "CVE-2026-46331", "raw_pub_date": "Fri, 24 Jul 2026 17:46:41 +0800" } -
CVE-2026-46242
In the Linux kernel, the following vulnerability has been resolved:eventpoll: fix ep_remove struct eventpoll / struct file UAFep_remove() (via ep_remove_file()) cleared file->f_ep underfile->f_lock but then kept using @file inside the critical section(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).A concurrent __fput() taking the eventpoll_r…
In the Linux kernel, the following vulnerability has been resolved:eventpoll: fix ep_remove struct eventpoll / struct file UAFep_remove() (via ep_remove_file()) cleared file->f_ep underfile->f_lock but then kept using @file inside the critical section(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).A concurrent __fput() taking the eventpoll_rIn the Linux kernel, the following vulnerability has been resolved:eventpoll: fix ep_remove struct eventpoll / struct file UAFep_remove() (via ep_remove_file()) cleared file->f_ep underfile->f_lock but then kept using @file inside the critical section(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).A concurrent __fput() taking the eventpoll_release() fastpath inthat window observed the transient NULL, skippedeventpoll_release_file() and ran to f_op->release / file_free().For the epoll-watches-epoll case, f_op->release isep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), whichkfree()s the watched struct eventpoll. Its embedded ->refshlist_head is exactly where epi->fllink.pprev points, so thesubsequent hlist_del_rcu()'s "*pprev = next" scribbles into freedkmalloc-192 memory.In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slotbacking @file could be recycled by alloc_empty_file() --reinitializing f_lock and f_ep -- while ep_remove() is stillnominally inside that lock. The upshot is an attacker-controllablekmem_cache_free() against the wrong slab cache.Pin @file via epi_fget() at the top of ep_remove() and gate thecritical section on the pin succeeding. With the pin held @filecannot reach refcount zero, which holds __fput() off andtransitively keeps the watched struct eventpoll alive across thehlist_del_rcu() and the f_lock use, closing both UAFs.If the pin fails @file has already reached refcount zero and its__fput() is in flight. Because we bailed before clearing f_ep,that path takes the eventpoll_release() slow path intoeventpoll_release_file() and blocks on ep->mtx until the waiterside's ep_clear_and_put() drops it. The bailed epi's share ofep->refcount stays intact, so the trailing ep_refcount_dec_and_test()in ep_clear_and_put() cannot free the eventpoll out from undereventpoll_release_file(); the orphaned epi is then cleaned upthere.A successful pin also proves we are not racingeventpoll_release_file() on this epi, so drop the now-redundantre-check of epi->dying under f_lock. The cheap locklessREAD_ONCE(epi->dying) fast-path bailout stays.扩展字段
{ "cve_id": "CVE-2026-46242", "raw_pub_date": "Fri, 24 Jul 2026 17:46:40 +0800" } -
CVE-2026-53359
In the Linux kernel, the following vulnerability has been resolved:KVM: x86: Fix shadow paging use-after-free due to unexpected roleCommit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free dueto unexpected GFN") fixed a shadow paging mismatch between stored andcomputed GFNs; the bug could be triggered by changing a PDE mapping fromoutside the guest,…
In the Linux kernel, the following vulnerability has been resolved:KVM: x86: Fix shadow paging use-after-free due to unexpected roleCommit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free dueto unexpected GFN") fixed a shadow paging mismatch between stored andcomputed GFNs; the bug could be triggered by changing a PDE mapping fromoutside the guest,In the Linux kernel, the following vulnerability has been resolved:KVM: x86: Fix shadow paging use-after-free due to unexpected roleCommit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free dueto unexpected GFN") fixed a shadow paging mismatch between stored andcomputed GFNs; the bug could be triggered by changing a PDE mapping fromoutside the guest, and then deleting a memslot. The rmap_remove()call would miss entries created after the PDE change because the GFNof the leaf SPTE does not match the GFN of the struct kvm_mmu_page.A similar hole however remains if the modified PDE points to a non-leafpage. In this case the gfn can be made to match, but the role does notmatch: the original large 2MB page creates a kvm_mmu_page with direct=1,while the new 4KB needs a kvm_mmu_page with direct=0. However,kvm_mmu_get_child_sp() does not compare the role, and therefore reusesthe page.The next step is installing a leaf (4KB) SPTE on the new path whichrecords an rmap entry under the gfn resolved by the walk. But whenthat child is zapped its parent kvm_mmu_page has direct=1 andkvm_mmu_page_get_gfn() computes the gfn for the 4KB page assp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[]in older kernels). It therefore fails to remove the recorded entry.When the memslot is dropped the shadow page is freed but the rmapentry survives, as in the scenario that was already fixed. Code thatlater walks that gfn (dirty logging, MMU notifier invalidation, andso on) dereferences an sptep that lies in the freed page, causing theuse-after-free.扩展字段
{ "cve_id": "CVE-2026-53359", "raw_pub_date": "Fri, 24 Jul 2026 17:46:35 +0800" } -
CVE-2026-54369
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a …
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by aacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.扩展字段
{ "cve_id": "CVE-2026-54369", "raw_pub_date": "Thu, 23 Jul 2026 16:07:59 +0800" } -
CVE-2026-56211
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an att…
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attA remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.扩展字段
{ "cve_id": "CVE-2026-56211", "raw_pub_date": "Thu, 23 Jul 2026 16:07:47 +0800" } -
CVE-2026-56210
A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer cont…
A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer contA heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).扩展字段
{ "cve_id": "CVE-2026-56210", "raw_pub_date": "Thu, 23 Jul 2026 16:07:46 +0800" } -
CVE-2026-56209
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the a…
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the aAn arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.扩展字段
{ "cve_id": "CVE-2026-56209", "raw_pub_date": "Thu, 23 Jul 2026 16:07:45 +0800" } -
CVE-2026-56208
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the seco…
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the secoA heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.扩展字段
{ "cve_id": "CVE-2026-56208", "raw_pub_date": "Thu, 23 Jul 2026 16:07:44 +0800" }