Heimdall Security Logo

CVE-2026-64025

Vulnérabilité critique dans Linux (Linux)

CVSS 9.8 · Critique
EPSS 0.3%
Linux•Linux•Versions : <=7.0.*, <=6.12.*, <8a52139560f833c3975032e1f5762611e3a36d71, <ddf8029623a1af20e984c040e89ff918158397ab, <1861d369efd62d67796563bf3e01fc22e5626f8b, <7c8cf21bc4efb4af18d6096db3f8bd06d622251c, 0, 6.12.92, 6.6.142, <=6.6.*, ef5659280eb13e8ac31c296f58cfdfa1684ac06b, 6.18.34, <5.10, 7.1, <=6.18.*, 7.0.11, <c9ea01768903ae47f210cd457af1dead6de7a9c3, <=*, 5.10

Description

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types with ktls"). sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival: tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready -> saved_data_ready() = sk_psock_verdict_data_ready() -> tcp_read_skb() drains sk_receive_queue via __skb_unlink() without calling tcp_eat_skb(), so copied_seq is not advanced. tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned (potentially freed) skb. tls_decrypt_sg() subsequently walks that frag_list: use-after-free. Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched. TLS retains sole ownership of the queue and decrypts the record normally through tls_sw_recvmsg().

Gravité et risque d'exploitation

CVE-2026-64025 obtient un score CVSS de 9.8/10, soit une gravité critique. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.34 %, ce qui la place devant 26.3 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=7.0.*, <=6.12.*, <8a52139560f833c3975032e1f5762611e3a36d71, <ddf8029623a1af20e984c040e89ff918158397ab, <1861d369efd62d67796563bf3e01fc22e5626f8b, <7c8cf21bc4efb4af18d6096db3f8bd06d622251c, 0, 6.12.92, 6.6.142, <=6.6.*, ef5659280eb13e8ac31c296f58cfdfa1684ac06b, 6.18.34, <5.10, 7.1, <=6.18.*, 7.0.11, <c9ea01768903ae47f210cd457af1dead6de7a9c3, <=*, 5.10) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE