目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

CVE-2026-68188— 蓝牙RFCOMM在set_termios中存在会话UAF漏洞

AI Predicted 7.8 Difficulty: Moderate

Possible ATT&CK Techniques 1AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 12

ベンダープロダクトVersion Rangeステータス
LinuxLinux3a5e903c09aed19ca4a1bb26d87b8d6461a93818< 2894bd8c68e97accd758ca6e5fc375d7e9e8882caffected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818< a82a9d3891f5607030b0672c255087a12bb9837baffected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818< 780b04d09c941262ee2a2b4a09906451b69df8a6affected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818< 98bc68194e37bfa5e8ddc80b5c1eb0be4dc607eaaffected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818< c783399efc22d035443f1dfbf2a09bf9562aaa5eaffected
2.6.14affected
< 2.6.14unaffected
6.6.148≤ 6.6.*unaffected
… +4 more rows
新しい脆弱性情報の通知を購読するログインして購読

I. CVE-2026-68188の基本情報

脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗

高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。

脆弱性タイトル
Bluetooth: RFCOMM: Fix session UAF in set_termios
ソース: CVE Program / CVE List V5
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in set_termios rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences both session->initiator and session->sock. Meanwhile, krfcommd can unlink the DLC and free the session while holding rfcomm_mutex. The race can proceed as follows: TTY ioctl task krfcommd -------------- -------- load dlc->session enter rfcomm_send_rpn() lock rfcomm_mutex clear dlc->session free session unlock rfcomm_mutex read session->initiator KASAN reported: BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0 Read of size 4 at addr ffff88810012a850 by task poc/92 Call Trace: rfcomm_send_rpn+0x297/0x2a0 rfcomm_tty_set_termios+0x50d/0x850 tty_set_termios+0x596/0x950 set_termios+0x46a/0x6e0 tty_mode_ioctl+0x152/0xbd0 tty_ioctl+0x915/0x1240 __x64_sys_ioctl+0x134/0x1c0 Allocated by task 92: rfcomm_session_add+0x9e/0x2e0 rfcomm_dlc_open+0x8b1/0xe00 rfcomm_dev_activate+0x85/0x1a0 rfcomm_tty_open+0x90/0x280 Freed by task 68: kfree+0x131/0x3c0 rfcomm_session_del+0x119/0x180 rfcomm_run+0x737/0x4710 Add rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies that the DLC is still attached and sends the RPN frame. Have the TTY path use the helper and drop its unlocked session check. This keeps the session valid through both the frame construction and socket send.
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5

影響を受ける製品

ベンダープロダクト影響を受けるバージョンCPE購読
LinuxLinux 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 ~ 2894bd8c68e97accd758ca6e5fc375d7e9e8882c -
LinuxLinux 2.6.14 -

II. CVE-2026-68188の公開POC

#POC説明ソースリンクShenlongリンク
AI生成POCプレミアム

公開POCは見つかりませんでした。

ログインしてAI POCを生成

III. CVE-2026-68188のインテリジェンス情報

请登录查看更多情报信息。

CVE-2026-68188 补丁与修复 (5)

Same Patch Batch · Linux · 2026-08-10 · 345 CVEs total

CVE-2026-68311wifi: mt76: mt7925: guard link STA in decap offload
CVE-2026-68321net: txgbe: fix FDIR filter leak on remove
CVE-2026-68320sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
CVE-2026-68319pds_core: fix deadlock between reset thread and remove
CVE-2026-68318pds_core: fix use-after-free on workqueue during remove
CVE-2026-68317pds_core: fix auxiliary device add/del races
CVE-2026-68316accel: ethosu: Fix element size accounting for cmd stream validation
CVE-2026-68315sctp: validate stream count in sctp_process_strreset_inreq()
CVE-2026-68314net: mctp i3c: clean up notifier and buses if driver register fails
CVE-2026-68313tipc: fix infinite loop in __tipc_nl_compat_dumpit
CVE-2026-68312cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
CVE-2026-68306wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
CVE-2026-68301net: hsr: fix memory leak on slave unregistration by removing synced VLANs
CVE-2026-68302amt: re-read skb header pointers after every pull
CVE-2026-68303drm/vc4: hvs/v3d: Fix null dereference in unbind
CVE-2026-68304wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
CVE-2026-68305drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
CVE-2026-68308wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
CVE-2026-68310wifi: mt76: mt7915: guard HE capability lookups
CVE-2026-68309wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()

Showing 20 of 345 CVEs. View all on vendor page →

IV. 関連脆弱性

同じ製品: Linux
同じベンダー: Linux

V. CVE-2026-68188へのコメント

まだコメントはありません

コメントを残す