Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - nvme修复了 nvme_pr_read_keys() 中的内存分配 nvme_pr_read_keys() 从用户空间获取 num_keys 并使用它通过 struct_size() 计算 rse 的分配大小。上限为 PR_KEYS_MAX (64K)。
    恶意或有缺陷的用户空间可传递会导致最大 4MB 分配尝试的较大 num_keys 值当顺序超过 MAX_PAGE_ORDER 时造成页面分配器中发出警告。要修复此问题请使用 kvzalloc() 而非 kzalloc()。此缺陷具有相同的推理并使用下面的修补程序进行修复
    https://lore.kernel.org/linux-block/20251212013510.3576091-1-kartikey406@gmail.com/ 警告日志：WARNING
    mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216, CPU#1在以下位置中链接的 syz-executor117/272 模块CPU: 1 UID: 0 PID: 272 Comm: syz-executor117 Not tainted 6.19.0 #1 PREEMPT(自主) 硬件名称QEMU Standard PC(i440FX + PIIX,1996)BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP0010:__alloc_frozen_pages_noprof+0x5aa/0x2300 mm /page_alloc.c:5216 代码ff 83 bd a8 fe ff ff 0a 0f 86 69 fb ff ff 0f b6 1d f9 f9 c4 04 80 fb 01 0f 87 3b 76 30 ff 83 e3 01 75 09 c6 05 e4 f9 c4 04 01 <0f> 0b 48 c7 85 70 fe ff ff 00 00 00 00 e9 8f fd ff ff 31 c0 e9 0d RSP0018:ffffc90000fcf450 EFLAGS00010246 RAX: 0000000000000000 RBX: 00000000000000000
    1ffff920001f9ea0 RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0 RBP: ffffc90000fcf648 R08: ffff88800b6c3380 R09: 0000000000000001 R10: ffffc90000fcf840 R11: ffff88807ffad280 R12:
    0000000000000000 R130000000000040dc0 R140000000000000001 R15ffffc90000fcf620 FS
    0000555565db33c0(0000) GS:ffff8880be26c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 000000002000000c CR3: 0000000003b72000 CR4: 00000000000006f0 Call Trace: <TASK> alloc_pages_mpol+0x236/0x4d0 mm/mempolicy.c:2486 alloc_frozen_pages_noprof+0x149/0x180 mm/mempolicy.c:2557
    ___kmalloc_large_node+0x10c/0x140 mm/slub.c:5598 __kmalloc_large_node_noprof+0x25/0xc0 mm/slub.c:5629
    __do_kmalloc_node mm/slub.c:5645 [内联] __kmalloc_noprof+0x483/0x6f0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [内联] kzalloc_noprof include/linux/slab.h:1094 [内联] nvme_pr_read_keys +0x8f/0x4c0 drivers/nvme/host/pr.c:245 blkdev_pr_read_keys block/ioctl.c:456 [内联] blkdev_common_ioctl+0x1b71/0x29b0 block/ioctl.c:730 blkdev_ioctl+0x299/0x700 block/ioctl.c:786 vfs_ioctl fs/ioctl.c:51 [内联] __do_sys_ioctl fs/ioctl.c:597 [内联] __se_sys_ioctl fs/ioctl.c:583 [内联]
    __x64_sys_ioctl+0x1bf/0x220 fs/ioctl.c:583 x64_sys_call+0x1280/0x21b0 mnt/fuzznvme_1/fuzznvme/linux-build/v6.19/./arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch /x86/entry/syscall_64.c:63 [内联] do_syscall_64+0x71/0x330 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP0033:0x7fb893d3108d 代码28 c3 e8 46 1e 6600 0f0 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP002b:00007ffff61f2f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffff61f3138 RCX: 00007fb893d3:108d RDX
    0000000020000040 RSI: 00000000c01070ce RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffff61f3138 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13:
    00007ffff61f3128 R1400007fb893dae530 R150000000000000001 </TASK> (CVE-2026-23244)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2026-23244

medium Nessus 插件 ID 302911

版本 1.2