Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Geneve修复 Geneve_find_dev() 中的释放后使用。 syzkaller 报告geneve_find_dev() [0] 中存在一个无法重现的释放后使用。 geneve_configure() 将 struct Geneve_dev.next 链接到 net_generic(net, Geneve_net_id)->geneve_list。如果设置了 IFLA_NET_NS_PID、IFLA_NET_NS_FD 或 IFLA_TARGET_NETNSID则此处的 net 可能与 dev_net(dev) 不同。拆分 dev_net(dev) 时geneve_exit_batch_rtnl() 最终会为 netns 中的每个设备调用 unregister_netdevice_queue()并于稍后释放该设备。但是，其 Geneve_dev.next 仍链接到后端 UDP 套接字 netns。然后当在 netns 中创建另一个 Geneve dev 时将发生释放后使用。改为在geneve_destroy_tunnels() 中调用geneve_dellink()。 [0]BUGKASANgeneve_find_dev drivers/net/geneve.c:1295 中存在 slab-use-after-free [内联] BUGKASANgeneve_configure+0x234/0x858 drivers/net/ 中存在 slab-use-after-free geneve.c:1343 Read of size 2 at addr ffff000054d6ee24 by task syz.1.4029/13441 CPU: 1 UID: 0 PID: 13441 Comm: syz.1.4029 Not tainted 6.13.0-g0ad9617c78ac #24 dc35ca22c79fb82e8e7bc5c9c9adafea898b1e3d Hardware name: linux,dummy- virt (DT) 调用跟踪show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [内联] print_report+0x16c/0x6f0 mm/kasan/report.c:489 kasan_report+0xc0/0x120 mm/kasan/report.c:602 __asan_report_load2_noabort+0x20/0x30 mm/kasan/report_generic .c:379geneve_find_dev drivers/net/geneve.c:1295 [内联]geneve_configure+0x234/0x858drivers/net/geneve.c:1343geneve_newlink+0xb8/0x128drivers/net/geneve.c:1634 rtnl_newlink_create+0x23c/0x868 net/core/rtnetlink.c:3795 __r tnl_newlink net/core/rtnetlink.c:3906 [内联] rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021 rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1dc/0x398 net/netlink/ af_netlink.c:2543 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [内联] netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x5fc/ 0x8b0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:713 [内联] __sock_sendmsg net/socket.c:728 [内联]____sys_sendmsg+0x410/0x6f8 net/socket.c:2568 ___sys_sendmsg+0x178/0x1d8 net /socket.c:2622
    __sys_sendmsg net/socket.c:2654 [内联] __do_sys_sendmsg net/socket.c:2659 [内联] __se_sys_sendmsg net/socket.c:2657 [内联] __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2657 __invoke_syscall arch/arm64/ kernel/syscall.c:35 [内联] invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x54/0x70 arch/arm64 /kernel/syscall.c:151 el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x1a0 arch /arm64/kernel/entry.S:600 按任务分配 13247kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x68 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x58 mm/kasan /generic.c:568毒害_kmalloc_redzone mm/kasan/common.c:377 [内联] __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [内联] __do_kmalloc_node mm/slub .c:4298 [内联]
    __kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4304 __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:645 alloc_netdev_mqs+0xb8/0x11a0 net/core/dev.c:11470 rtnl_create_link+0x2b8/0xb50 net/core/rtnetlink.c :3604 rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3780 __rtnl_newlink net/core/rtnetlink.c:3906 [inline] rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021 rtnetlink_rcv_msg+0x61c/0x918 net/ core/rtnetlink.c:6911 netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938 netlink_unicast_kernel net/netlink/af_n ---truncated--- (CVE-2025-21858)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2025-21858

high Nessus 插件 ID 248402

版本 1.26