CVE-2026-46034— Linux kernel 安全漏洞
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client ExecutionAffected Version Matrix 10
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Linux | Linux | 848e447e000c41894ff931dc7c004fd42c8840f8< 51bf7638f33aece41cb3f4cbeb942cc52950e329 | affected |
848e447e000c41894ff931dc7c004fd42c8840f8< 5d6c349c9823eb819fed8b537b088cf38126018c | affected | ||
848e447e000c41894ff931dc7c004fd42c8840f8< 338a736aaf15e8ba3635ce20b29af5b8fc15e66a | affected | ||
848e447e000c41894ff931dc7c004fd42c8840f8< 5ea5880764cbb164afb17a62e76ca75dc371409d | affected | ||
6.10 | affected | ||
< 6.10 | unaffected | ||
6.12.86≤ 6.12.* | unaffected | ||
6.18.27≤ 6.18.* | unaffected | ||
| … +2 more rows | |||
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-46034の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
ソース: CVE Program / CVE List V5
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Add validation to ensure MSI is configured before accessing cdx_irqs array in vfio_cdx_set_msi_trigger(). Without this check, userspace can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD. The vfio_cdx_msi_enable() function allocates the cdx_irqs array and sets config_msi to 1 only when called through the EVENTFD path. The trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been done, but there was no enforcement of this call ordering. This matches the protection used in the PCI VFIO driver where vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于vfio/cdx驱动在中断触发路径中未验证MSI是否已配置，可能导致空指针取消引用。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-46034の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-46034のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-46034 补丁与修复 (4)
Same Patch Batch · Linux · 2026-05-27 · 275 CVEs total
| CVE-2026-45972 | 9.8 CRITICAL | smb: client: fix potential UAF and double free in smb2_open_file() |
| CVE-2026-46039 | 9.8 CRITICAL | rxgk: Fix potential integer overflow in length check |
| CVE-2026-45988 | 9.8 CRITICAL | rxrpc: Fix re-decryption of RESPONSE packets |
| CVE-2026-45898 | 9.8 CRITICAL | RDMA/iwcm: Fix workqueue list corruption by removing work_list |
| CVE-2026-46043 | 9.1 CRITICAL | RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv |
| CVE-2026-46056 | 8.8 HIGH | Bluetooth: hci_event: fix potential UAF in SSP passkey handlers |
| CVE-2026-45945 | 8.8 HIGH | iommu/vt-d: Fix race condition during PASID entry replacement |
| CVE-2026-46037 | 8.2 HIGH | ipv4: icmp: validate reply type before using icmp_pointers |
| CVE-2026-45843 | 8.2 HIGH | slip: bound decode() reads against the compressed packet length |
| CVE-2026-46099 | 8.1 HIGH | net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels |
| CVE-2026-46010 | 8.1 HIGH | rxrpc: Fix error handling in rxgk_extract_token() |
| CVE-2026-46076 | 7.9 HIGH | KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 |
| CVE-2026-45878 | 7.8 HIGH | drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 |
| CVE-2026-45909 | 7.8 HIGH | clk: mediatek: Drop __initconst from gates |
| CVE-2026-46036 | 7.8 HIGH | vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex |
| CVE-2026-45933 | 7.8 HIGH | bpf: Preserve id of register in sync_linked_regs() |
| CVE-2026-46065 | 7.8 HIGH | fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info |
| CVE-2026-46058 | 7.8 HIGH | media: amphion: Fix race between m2m job_abort and device_run |
| CVE-2026-45894 | 7.8 HIGH | iommu/vt-d: Clear Present bit before tearing down PASID entry |
| CVE-2026-46053 | 7.8 HIGH | net: rds: fix MR cleanup on copy error |
Showing 20 of 275 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-64529
crypto: qat - remove unused character device and IOCTLs - CVE-2026-64528
tty: serial: samsung: Remove redundant port lock acquisition - CVE-2026-64527
drm/hyperv: validate VMBus packet size in receive callback - CVE-2026-64526
ethtool: tsconfig: fix missing ethnl_ops_complete() - CVE-2026-64525
xfrm: move policy_bydst RCU sync from per-netns .exit to .pr
同じベンダー: Linux
- CVE-2026-64529
crypto: qat - remove unused character device and IOCTLs - CVE-2026-64528
tty: serial: samsung: Remove redundant port lock acquisition - CVE-2026-64527
drm/hyperv: validate VMBus packet size in receive callback - CVE-2026-64526
ethtool: tsconfig: fix missing ethnl_ops_complete() - CVE-2026-64525
xfrm: move policy_bydst RCU sync from per-netns .exit to .pr
V. CVE-2026-46034へのコメント
まだコメントはありません