目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

CVE-2026-64048— Linux kernel 安全漏洞

CVSS 7.5 · High EPSS 0.48% · P39

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 14

ベンダープロダクトVersion Rangeステータス
LinuxLinuxa7c9c5f4af7f6098da68705fc5d86565d0728ef7< 6927cacf2b10d4fa80c1a2d407512ef9397c59c6affected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7< d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0affected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7< 53eb7bd09aace72fa17510d80e0caf5ca058c231affected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7< afa9036b8c9963947b487c36e332df6a42c96fcbaffected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7< 65edb3b0822cfe5041be8fbabebd57e2e5ad9f4eaffected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7< 277740023def559a4a2ddc3e8e784ee37a0f16a9affected
5.10affected
< 5.10unaffected
… +6 more rows
新しい脆弱性情報の通知を購読するログインして購読

I. CVE-2026-64048の基本情報

脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗

高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。

脆弱性タイトル
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
ソース: CVE Program / CVE List V5
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0. smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68: BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64 Require ism_dev[i] to be non-NULL before accepting a CHID match.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于net/smc组件在处理CHID-0 ACCEPT时未检查ism_dev[i]是否为空，可能导致空指针取消引用。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)

影響を受ける製品

ベンダープロダクト影響を受けるバージョンCPE購読
LinuxLinux a7c9c5f4af7f6098da68705fc5d86565d0728ef7 ~ 6927cacf2b10d4fa80c1a2d407512ef9397c59c6 -
LinuxLinux 5.10 -

II. CVE-2026-64048の公開POC

#POC説明ソースリンクShenlongリンク
AI生成POCプレミアム

公開POCは見つかりませんでした。

ログインしてAI POCを生成

III. CVE-2026-64048のインテリジェンス情報

请登录查看更多情报信息。

CVE-2026-64048 补丁与修复 (6)

Same Patch Batch · Linux · 2026-07-19 · 431 CVEs total

CVE-2026-6379510.0 CRITICAL9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-638009.8 CRITICALpNFS: Fix use-after-free in pnfs_update_layout()
CVE-2026-640559.8 CRITICALnet: ethernet: cortina: Carry over frag counter
CVE-2026-640569.8 CRITICALnet: ethernet: cortina: Make RX SKB per-port
CVE-2026-640619.8 CRITICALnetfs: Fix early put of sink folio in netfs_read_gaps()
CVE-2026-640669.8 CRITICALnetfs: Fix netfs_read_to_pagecache() to pause on subreq failure
CVE-2026-640679.8 CRITICALnetfs: Fix missing barriers when accessing stream->subrequests locklessly
CVE-2026-640689.8 CRITICALnetfs: Fix missing locking around retry adding new subreqs
CVE-2026-640699.8 CRITICALnetfs: Fix cancellation of a DIO and single read subrequests
CVE-2026-638089.8 CRITICALexfat: fix potential use-after-free in exfat_find_dir_entry()
CVE-2026-640899.8 CRITICALbatman-adv: tt: fix negative last_changeset_len
CVE-2026-640919.8 CRITICALbatman-adv: tt: fix TOCTOU race for reported vlans
CVE-2026-533999.8 CRITICALnfsd: release layout stid on setlease failure
CVE-2026-641429.8 CRITICALksmbd: close durable scavenger races against m_fp_list lookups
CVE-2026-533989.8 CRITICALNFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-641369.8 CRITICALsmb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
CVE-2026-641329.8 CRITICALipv6: ioam: refresh hdr pointer before ioam6_event()
CVE-2026-641229.8 CRITICALnet/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover
CVE-2026-641029.8 CRITICALRDMA/siw: Reject MPA FPDU length underflow before signed receive math
CVE-2026-641139.8 CRITICALixgbevf: fix use-after-free in VEPA multicast source pruning

Showing 20 of 431 CVEs. View all on vendor page →

IV. 関連脆弱性

同じ製品: Linux
同じベンダー: Linux

V. CVE-2026-64048へのコメント

まだコメントはありません

コメントを残す