Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - ipv6修复 inet6_addr_del() 中的释放后使用。 syzbot 报告了 inet6_addr_del() 中 inet6_ifaddr 的释放后使用。 [0] 引用的提交在读取 inet6_addr_del() 中临时地址的 ifp->flags 之前意外移动了 mngtmpaddr 的 ipv6_del_addr()。我们下移 ipv6_del_addr() 以修复 UAF。 [0]BUGKASAN inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 中的 slab 释放后使用对任务 syz.3.1618/9593 在 addr ffff88807b89c86c 处的大小 4 的读取 CPU 0 UID0 PID9593 通讯syz.3.1618 未受感染 syzkaller #0 PREEMPT(full) 硬件名称Google Google 计算引擎/Google 计算引擎、BIOS Google 10/25/2025 调用跟踪 <TASK> __dump_stack lib/dump_stack。 c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181 inet6_ioctl+0x1e5/0x2b0 net/ipv6/ af_inet6.c:582 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [内联] __do_sys_ioctl fs/ioctl.c:597 [内联] __se_sys_ioctl fs/ioctl.c:583 [内联] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [内联] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP0033:0x7f164cf8f749 代码ff ff c3 66 1fe 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 ff7 ff ff f7 d8 64 89 01 48 RSP
    002b00007f164de64038 EFLAGS00000246 ORIG_RAX0000000000000010 RAXffffffffffffffda RBX
    00007f164d1e5fa0 RCX: 00007f164cf8f749 RDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003 RBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
     R120000000000000246  : 0000000000000000 R13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288 </TASK> Allocated by task 9593: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c :77 oxide_kmalloc_redzone mm/kasan/common.c:397 [内联] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414 kmalloc_noprof include/linux/slab.h:957 [内联] kzalloc_noprof include/linux/slab.h 1094 [inline] ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120 inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050 addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:31ctl+0x103 /0x2b0 net/ipv6/af_inet6.c:580 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl .c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCAL L_64_after_hwframe+0x77/0x7f 已被任务释放 6099
    kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584poison_slab_object mm/kasan/common.c 252 [内联]
    __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [内联] slab_free_hook mm/slub.c:2540 [内联] slab_free_freelist_hook mm/slub.c:2569 [inline] slab_free_bulk mm/slub.c:6696 [内联] kmem_cache_free_bulk mm/slub.c:7383 [内联] kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362 kfree_bulk include/linux/slab.h:830 [内联] kvfree_rcu_bulk+0x1b7/ 0x1e0 mm/slab_common.c:1523 kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline] kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works [] kernel/workqu ---truncated--- (CVE-2026-23010)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2026-23010

high Nessus 插件 ID 296539

版本 1.10