Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - rpl修复 rpl_do_srh_inline() 中的释放后使用。通过 KASAN 运行 selftest 中的 lwt_dst_cache_ref_loop.sh 会触发以下的 splat [0]。 rpl_do_srh_inline() 在 skb_cow_head() 之后提取 ipv6_hdr(skb) 并进行访问这是非法的因为随后可以释放标头。让我们通过使 oldhdr 成为本地结构而不是指针来修复它。 [0][root@fedora net]# ./lwt_dst_cache_ref_loop.sh ... TESTrpl(输入) [ 57.631529] ======================================== ========================== BUGKASANrpl_do_srh_inline.isra.0 中的 slab 释放后使用 (net/ipv6/rpl_iptunnel) c:174) 通过任务 ping6/1543 CPU: 50 UID: 0 PID: 1543 Comm: ping6 未受感染 6.16.0-rc5-01302-gfadd1e6231b1 #23 PREEMPT(设) 硬件名称: QEMU 标准在 addr ffff888122bf96d8 大小 40 的读取PCi440FX + PIIX、1996BIOS 1.16.3-debian-1.16.3-2 04/01/2014 调用跟踪 <IRQ> dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c :409 mm/kasan/report.c:521) kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) kasan_check_range (mm/kasan/generic.c:175标识符 1) mm/ kasan/generic.c:189 (dispensator 1)) __asan_memmove (mm/kasan/shadow.c:94 (dispensator 2)) rpl_do_srh_inline.isra.0 (net/ipv6/rpl_iptunnel.c:174) rpl_input (net/ipv6/ rpl_iptunnel.c:201 net/ipv6/rpl_iptunnel.c:282) lwtunnel_input (net/core/lwtunnel.c:459) ipv6_rcv (./include/net/dst.h:471标识符 1) ./include/net/ dst .h:469标识符 1net/ipv6/ip6_input.c:79标识符 1./include/linux/netfilter.h:317标识符 1./include/linux/netfilter.h:311标识符 1 ) net/ipv6/ip6_input.c:311标识符 1) __netif_receive_skb_one_core (net/core/dev.c:5967) process_backlog (./include/linux/rcupdate.h:869 net/core/dev.c:6440) __napi_poll.constprop.0 (net/core/dev.c:7452) net_rx_action (net/core/dev.c:7518 net/core/dev.c:7643) handle_softirqs (kernel/softirq.c:579) do_softirq内核/softirq.c:480鉴别器 20) </IRQ> <TASK>
    __local_bh_enable_ip (kernel/softirq.c:407) __dev_queue_xmit (net/core/dev.c:4740) ip6_finish_output2 (./include/linux/netdevice.h:3358 ./include/net/neighbour.h:526 ./include/ net/neighbour.h:540 net/ipv6/ip6_output.c:141) ip6_finish_output (net/ipv6/ip6_output.c:215 net/ipv6/ip6_output.c:226) ip6_output (./include/linux/netfilter.h 306 net/ipv6/ip6_output.c:248) ip6_send_skb (net/ipv6/ip6_output.c:1983) rawv6_sendmsg (net/ipv6/raw.c:588 net/ipv6/raw.c:918) __sys_sendto (net/socket。 c:714标识符 1net/socket.c:729标识符 1net/socket.c:2228标识符 1) __x64_sys_sendto (net/socket.c:2231) do_syscall_64 (arch/x86/entry/syscall_64. c:63标识符 1arch/x86/entry/syscall_64.c:94标识符 1entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP0033:0x7f68cffb2a06 代码5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 000 1 fe3 fa 55 4 8 89 e5 48 83 ec 08 RSP: 002b:00007ffefb7c53d0 EFLAGS: 00000202 ORIG_RAX
    000000000000002c RAX: ffffffffffffffda RBX: 0000564cd69f10a0 RCX: 00007f68cffb2a06 RDX: 0000000000000040 RSI: 0000564cd69f10a4 RDI: 0000000000000003 RBP: 00007ffefb7c53f0 R08: 0000564cd6a032ac R09:
     R10000000000000001c  : 0000000000000000 R11: 0000000000000202 R12: 0000564cd69f10a4 R13: 0000000000000040 R14: 00007ffefb7c66e0 R15: 0000564cd69f10a0 </TASK> Allocated by task 1543: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/ common.c:60标识符 1mm/kasan/common.c:69标识符 1) __kasan_slab_alloc (mm/kasan/common.c:319 mm/kasan/common.c:345) kmem_cache_alloc_node_noprof (./include/ linux/kasan.h:250 mm/slub.c:4148 mm/slub.c:4197 mm/slub.c:4249) kmalloc_reserve (net/core/skbuff.c:581标识符 88) __alloc_skb (net/core) /skbuff.c:669)
    __ip6_append_data (net/ipv6/ip6_output.c:1672 (disabilities 1)) ip6_ ---truncated--- (CVE-2025-38476)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2025-38476

high Nessus 插件 ID 252200

版本 1.11