جزئیات آسیب‌پذیری
CVE-2026-46323
Linux LinuxRed Hat Enterprise Linux for NVIDIA 26Red Hat OpenShift Container Platform 4Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFPSiemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPSiemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
net: gro: don't merge zcopy skbs
CVSS 3.1
7.8بالا
شرح رسمی (انگلیسی)
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.8بالا | 3.1 | CVEProject cvelistV5 (CNA) (Linux) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 7.8بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Linux | Linux | 6.0 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 753f1ca4e1e50248a1b760c9774d6d6b354562cc ≤ v < 1f9c828556416fbe3f49386708ce999fc4d4da06 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 753f1ca4e1e50248a1b760c9774d6d6b354562cc ≤ v < 479084ae0e1d9cb7929cb4298d35623de189f80a | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 753f1ca4e1e50248a1b760c9774d6d6b354562cc ≤ v < e334cbf3388fd9334503a778a82d9e9f14dd2f71 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 753f1ca4e1e50248a1b760c9774d6d6b354562cc ≤ v < 44bea2032af0425e4ce6d26a8af0ede79db49ec1 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 753f1ca4e1e50248a1b760c9774d6d6b354562cc ≤ v < 4db79a322db8c97f7b73b8a347395ef4d685eb40 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 753f1ca4e1e50248a1b760c9774d6d6b354562cc ≤ v < 3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux for NVIDIA 26 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.6 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.6 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.7 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.7 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.6 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.6 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.7 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.7 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | V3.1.6 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | V3.1.7 ≤ v | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۲۶- https://git.kernel.org/stable/c/3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d
- https://git.kernel.org/stable/c/1f9c828556416fbe3f49386708ce999fc4d4da06
- https://git.kernel.org/stable/c/479084ae0e1d9cb7929cb4298d35623de189f80a
- https://git.kernel.org/stable/c/e334cbf3388fd9334503a778a82d9e9f14dd2f71
- https://git.kernel.org/stable/c/44bea2032af0425e4ce6d26a8af0ede79db49ec1
- https://git.kernel.org/stable/c/4db79a322db8c97f7b73b8a347395ef4d685eb40
- https://access.redhat.com/security/cve/CVE-2026-46323 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2479832 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46323.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:47727 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44230 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44231 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44259 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44262 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27731 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44270 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27735 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27708 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36018 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62642 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62639 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62641 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62640 vendor-advisoryx_refsource_REDHAT
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۳/۱۹
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۷/۲۷
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- Linux
پیش‌بینی بهره‌برداری (EPSS)
۰٫۱۳٪
احتمال بهره‌برداری در ۳۰ روز
۳٫۱٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-123Write-what-where Condition
- CWE-416Use After Free