CVE-2026-53046— Linux kernel 安全漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 16
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Linux | Linux | e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< 57b47231055b431ed0a1a55f33cac32981564405 | affected |
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< cc2da381875d4a67026e4c8feb3dba51a2a2d1bc | affected | ||
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< 8fcefe840fa8c14ce667768e5b043286ac3bbcbe | affected | ||
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< 8ef183216feaa24b66b940510d8b68f680eb56e9 | affected | ||
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< 7164b3953cefd540e7ebca828c793bc6869cfbc4 | affected | ||
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< b46aa129fa2807bfe1545fe74d9295d53c51520b | affected | ||
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< 3e298897f41c61450c2e7a4f457e8b2485eb35b3 | affected | ||
5.15 | affected | ||
| … +8 more rows | |||
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-53046の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
ソース: NVD (National Vulnerability Database)
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and immediately frees the request while the hardware DMA operation is still in flight. The DMA completion callback then dereferences freed memory, causing a NULL pointer crash: pc : qce_skcipher_done+0x24/0x174 lr : vchan_complete+0x230/0x27c ... el1h_64_irq+0x68/0x6c ksmbd_free_work_struct+0x20/0x118 [ksmbd] ksmbd_exit_file_cache+0x694/0xa4c [ksmbd] Use the standard crypto_wait_req() pattern with crypto_req_done() as the completion callback, matching the approach used by the SMB client in fs/smb/client/smb2ops.c. This properly handles both synchronous engines (immediate return) and async engines (-EINPROGRESS followed by callback notification).
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel 5.15版本存在安全漏洞，该漏洞源于ksmbd在Qualcomm Crypto Engine上处理异步加密操作时存在释放后重用，可能导致空指针崩溃。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-53046の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-53046のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-53046 补丁与修复 (7)
Same Patch Batch · Linux · 2026-06-24 · 219 CVEs total
| CVE-2026-53010 | 9.8 CRITICAL | ksmbd: fix use-after-free in smb2_open during durable reconnect |
| CVE-2026-52986 | 9.8 CRITICAL | netfilter: nf_conntrack_sip: don't use simple_strtoul |
| CVE-2026-52982 | 9.8 CRITICAL | net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() |
| CVE-2026-52989 | 9.8 CRITICAL | nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers |
| CVE-2026-53086 | 9.8 CRITICAL | net: bcmgenet: fix racing timeout handler |
| CVE-2026-52993 | 9.8 CRITICAL | tipc: fix double-free in tipc_buf_append() |
| CVE-2026-53045 | 9.8 CRITICAL | memory: tegra124-emc: Fix dll_change check |
| CVE-2026-52955 | 9.8 CRITICAL | libceph: Fix potential out-of-bounds access in crush_decode() |
| CVE-2026-53049 | 9.8 CRITICAL | gfs2: add some missing log locking |
| CVE-2026-53002 | 9.8 CRITICAL | netfilter: conntrack: remove sprintf usage |
| CVE-2026-53088 | 9.8 CRITICAL | net: bcmgenet: fix off-by-one in bcmgenet_put_txcb |
| CVE-2026-53055 | 9.8 CRITICAL | crypto: hisilicon/sec2 - prevent req used-after-free for sec |
| CVE-2026-52914 | 9.8 CRITICAL | batman-adv: fix fragment reassembly length accounting |
| CVE-2026-52931 | 9.8 CRITICAL | batman-adv: tp_meter: avoid use of uninit sender vars |
| CVE-2026-53006 | 9.8 CRITICAL | ipv6: fix possible UAF in icmpv6_rcv() |
| CVE-2026-52924 | 9.8 CRITICAL | sctp: purge outqueue on stale COOKIE-ECHO handling |
| CVE-2026-52999 | 9.1 CRITICAL | netfilter: nfnetlink_osf: fix out-of-bounds read on option matching |
| CVE-2026-53043 | 9.1 CRITICAL | ocfs2/dlm: validate qr_numregions in dlm_match_regions() |
| CVE-2026-52958 | 9.1 CRITICAL | libceph: Fix potential out-of-bounds access in osdmap_decode() |
| CVE-2026-52918 | 8.8 HIGH | Bluetooth: serialize accept_q access |
Showing 20 of 219 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-53362
ipv6: account for fraggap on the paged allocation path - CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc(). - CVE-2026-53360
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected - CVE-2026-53358
Bluetooth: L2CAP: use chan timer to close channels in cleanu
同じベンダー: Linux
- CVE-2026-53362
ipv6: account for fraggap on the paged allocation path - CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc(). - CVE-2026-53360
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected - CVE-2026-53358
Bluetooth: L2CAP: use chan timer to close channels in cleanu
V. CVE-2026-53046へのコメント
まだコメントはありません