CVE-2026-46307— Linux kernel 安全漏洞
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 18
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Linux | Linux | 6d7b97b23e114c8fbb825e6721164d228c1af3fc< ecb1c163166759dec004c1fdb9709b8a5992fc8e | affected |
6d7b97b23e114c8fbb825e6721164d228c1af3fc< 9dd6aae4bc7bfa11088d928670a3315eae542769 | affected | ||
6d7b97b23e114c8fbb825e6721164d228c1af3fc< 744c19e266b0d2628c5951439195dcef27eadacf | affected | ||
6d7b97b23e114c8fbb825e6721164d228c1af3fc< 83226c71af53fb9b3cad40cb9a9a79f36d68c020 | affected | ||
6d7b97b23e114c8fbb825e6721164d228c1af3fc< d6869537013b1f21b292342752d97868b79b5934 | affected | ||
6d7b97b23e114c8fbb825e6721164d228c1af3fc< e9f1081bc775146156def0dbc821b92f35d56afb | affected | ||
6d7b97b23e114c8fbb825e6721164d228c1af3fc< 568173ad9bd0b46cc6cd937dea8791e9b5eefa57 | affected | ||
6d7b97b23e114c8fbb825e6721164d228c1af3fc< d748603f12baff112caa3ab7d39f50100f010dbd | affected | ||
| … +10 more rows | |||
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-46307の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
wifi: ath5k: do not access array OOB
ソース: NVD (National Vulnerability Database)
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: > <TASK> > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0 It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1; with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; while the size is: #define IEEE80211_TX_MAX_RATES 4 is indeed bogus. Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES). Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ath5k驱动数组越界访问，可能导致数组越界访问。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-46307の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-46307のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-46307 补丁与修复 (8)
Same Patch Batch · Linux · 2026-06-08 · 41 CVEs total
| CVE-2026-46289 | 9.8 CRITICAL | lib/scatterlist: fix length calculations in extract_kvec_to_sg |
| CVE-2026-46288 | 8.4 HIGH | of: unittest: fix use-after-free in of_unittest_changeset() |
| CVE-2026-46303 | 8.2 HIGH | isofs: validate Rock Ridge CE continuation extent against volume size |
| CVE-2026-46274 | 7.8 HIGH | io-wq: check that the predecessor is hashed in io_wq_remove_pending() |
| CVE-2026-46275 | 7.8 HIGH | Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths |
| CVE-2026-46277 | 7.8 HIGH | mm/zone_device: do not touch device folio after calling ->folio_free() |
| CVE-2026-46280 | 7.8 HIGH | lib: test_hmm: evict device pages on file close to avoid use-after-free |
| CVE-2026-46311 | 7.8 HIGH | drm/amdgpu/userq: fix access to stale wptr mapping |
| CVE-2026-46306 | 7.5 HIGH | flow_dissector: do not dissect PPPoE PFC frames |
| CVE-2026-46304 | 7.5 HIGH | nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free |
| CVE-2026-46299 | 7.0 HIGH | hfsplus: fix held lock freed on hfsplus_fill_super() |
| CVE-2026-46296 | spi: s3c64xx: fix NULL-deref on driver unbind | |
| CVE-2026-46314 | drm/v3d: Reject empty multisync extension to prevent infinite loop | |
| CVE-2026-46298 | pseries/papr-hvpipe: Fix race with interrupt handler | |
| CVE-2026-46301 | spi: topcliff-pch: fix use-after-free on unbind | |
| CVE-2026-46302 | selinux: allow multiple opens of /sys/fs/selinux/policy | |
| CVE-2026-46305 | staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc | |
| CVE-2026-46308 | pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() | |
| CVE-2026-46309 | drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise | |
| CVE-2026-46310 | media: renesas: vsp1: Fix NULL pointer deref on module unload |
Showing 20 of 41 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-53362
ipv6: account for fraggap on the paged allocation path - CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc(). - CVE-2026-53360
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected - CVE-2026-53358
Bluetooth: L2CAP: use chan timer to close channels in cleanu
同じベンダー: Linux
- CVE-2026-53362
ipv6: account for fraggap on the paged allocation path - CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc(). - CVE-2026-53360
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected - CVE-2026-53358
Bluetooth: L2CAP: use chan timer to close channels in cleanu
V. CVE-2026-46307へのコメント
まだコメントはありません