AlmaLinux 9.2 [TuxCare] 安全更新：bpftool / kernel / kernel-abi-stablelists / kernel-core / 等多个漏洞 （ALMALINUX9.2：CLSA-2026：1789898700）
high Nessus 插件 ID 360912
语言：
简介
AlmaLinux 主机缺少一个或多个安全更新。描述
AlmaLinux 9.2 主机上存在安装的程序包，该程序包受到 TuxCare ALMALINUX9.2：CLSA-2026：1789898700公告中提及的多个漏洞的影响。- 已修复 Linux 内核中的下列漏洞：ceph: fix possible deadlock when holding Fwb to get inline_data 1, mount with wsync. 2, create a file with O_RDWR, and the request was sent to mds.0: ceph_atomic_open()--> ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)--> ceph_open()--> ceph_init_file()--> ceph_init_file_info()--> ceph_uninline_data()--> { ... if (inline_version == 1 || /* initial version, no data */ inline_version == CEPH_INLINE_NONE) goto out_unlock; ... } The inline_version will be 1, which is the initial version for the new create file. And here the ci->i_inline_version will keep with 1, it's buggy. 3, buffer write to the file immediately:
ceph_write_iter()--> ceph_get_caps(file, need=Fw, want=Fb, ...); generic_perform_write()--> a_ops->write_begin()--> ceph_write_begin()--> netfs_write_begin()--> netfs_begin_read()--> netfs_rreq_submit_slice()--> netfs_read_from_server()--> rreq->netfs_ops->issue_read()--> ceph_netfs_issue_read()--> { ... if (ci->i_inline_version != CEPH_INLINE_NONE && ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); The ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1. 4, then the mds.1 will request the rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation from excl --> sync, but it need to revoke the Fxwb caps back from the clients. While the kernel client has aleady held the Fwb caps and waiting for the getattr(Fsr). It's deadlock! URL:
https://tracker.ceph.com/issues/55377 (CVE-2022-49296)
- 已修复 Linux 内核中的下列漏洞：tracing: Fix reading strings from synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]' > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is that the synthetic event field char file[] will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)
- 已修复 Linux 内核中的下列漏洞：hwrng: core - Fix page fault dead lock on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. (CVE-2023-52615)
- 已修复 Linux 内核中的下列漏洞：fscache: Use wait_on_bit() to wait for the freeing of relinquished volume The freeing of relinquished volume will wake up the pending volume acquisition by using wake_up_bit(), however it is mismatched with wait_var_event() used in fscache_wait_on_volume_collision() and it will never wake up the waiter in the wait-queue because these two functions operate on different wait-queues. According to the implementation in fscache_wait_on_volume_collision(), if the wake-up of pending acquisition is delayed longer than 20 seconds (e.g., due to the delay of on-demand fd closing), the first wait_var_event_timeout() will timeout and the following wait_var_event() will hang forever as shown below: FS-Cache: Potential volume collision new=00000024 old=00000022 ...... INFO: task mount:1148 blocked for more than 122 seconds. Not tainted 6.1.0-rc6+ #1 task:mount state:D stack:0 pid:1148 ppid:1 Call Trace: <TASK> __schedule+0x2f6/0xb80 schedule+0x67/0xe0 fscache_wait_on_volume_collision.cold+0x80/0x82 __fscache_acquire_volume+0x40d/0x4e0 erofs_fscache_register_volume+0x51/0xe0 [erofs] erofs_fscache_register_fs+0x19c/0x240 [erofs] erofs_fc_fill_super+0x746/0xaf0 [erofs] vfs_get_super+0x7d/0x100 get_tree_nodev+0x16/0x20 erofs_fc_get_tree+0x20/0x30 [erofs] vfs_get_tree+0x24/0xb0 path_mount+0x2fa/0xa90 do_mount+0x7c/0xa0
__x64_sys_mount+0x8b/0xe0 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Considering that wake_up_bit() is more selective, so fix it by using wait_on_bit() instead of wait_var_event() to wait for the freeing of relinquished volume. In addition because waitqueue_active() is used in wake_up_bit() and clear_bit() doesn't imply any memory barrier, use clear_and_wake_up_bit() to add the missing memory barrier between cursor->flags and waitqueue_active(). (CVE-2023-52982)
- 已修复 Linux 内核中的下列漏洞：Bluetooth: ISO: fix iso_conn related locking and validity issues sk->sk_state indicates whether iso_pi(sk)->conn is valid. Operations that check/update sk_state and access conn should hold lock_sock, otherwise they can race. The order of taking locks is hci_dev_lock > lock_sock > iso_conn_lock, which is how it is in connect/disconnect_cfm -> iso_conn_del -> iso_chan_del. Fix locking in iso_connect_cis/bis and sendmsg/recvmsg to take lock_sock around updating sk_state and conn. iso_conn_del must not occur during iso_connect_cis/bis, as it frees the iso_conn. Hold hdev->lock longer to prevent that. This should not reintroduce the issue fixed in commit 241f51931c35 (Bluetooth: ISO: Avoid circular locking dependency), since the we acquire locks in order.
We retain the fix in iso_sock_connect to release lock_sock before iso_connect_* acquires hdev->lock.
Similarly for commit 6a5ad251b7cd (Bluetooth: ISO: Fix possible circular locking dependency). We retain the fix in iso_conn_ready to not acquire iso_conn_lock before lock_sock. iso_conn_add shall return iso_conn with valid hcon. Make it so also when reusing an old CIS connection waiting for disconnect timeout (see __iso_sock_close where conn->hcon is set to NULL). Trace with iso_conn_del after iso_chan_add in iso_connect_cis: =============================================================== iso_sock_create:771:
sock 00000000be9b69b7 iso_sock_init:693: sk 000000004dff667e iso_sock_bind:827: sk 000000004dff667e 70:1a:b8:98:ff:a2 type 1 iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_connect:875: sk 000000004dff667e iso_connect_cis:353: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da hci_get_route:1199: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da hci_conn_add:1005: hci0 dst 28:3d:c2:4a:7e:da iso_conn_add:140: hcon 000000007b65d182 conn 00000000daf8625e __iso_chan_add:214: conn 00000000daf8625e iso_connect_cfm:1700: hcon 000000007b65d182 bdaddr 28:3d:c2:4a:7e:da status 12 iso_conn_del:187: hcon 000000007b65d182 conn 00000000daf8625e, err 16 iso_sock_clear_timer:117: sock 000000004dff667e state 3 <Note: sk_state is BT_BOUND (3), so iso_connect_cis is still running at this point> iso_chan_del:153: sk 000000004dff667e, conn 00000000daf8625e, err 16 hci_conn_del:1151: hci0 hcon 000000007b65d182 handle 65535 hci_conn_unlink:1102: hci0: hcon 000000007b65d182 hci_chan_list_flush:2780: hcon 000000007b65d182 iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_shutdown:1434:
sock 00000000be9b69b7, sk 000000004dff667e, how 1 __iso_sock_close:632: sk 000000004dff667e state 5 socket 00000000be9b69b7 <Note: sk_state is BT_CONNECT (5), even though iso_chan_del sets BT_CLOSED (6). Only iso_connect_cis sets it to BT_CONNECT, so it must be that iso_chan_del occurred between iso_chan_add and end of iso_connect_cis.> BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8000000006467067 P4D 8000000006467067 PUD 3f5f067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name:
QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:__iso_sock_close (net/bluetooth/iso.c:664) bluetooth =============================================================== Trace with iso_conn_del before iso_chan_add in iso_connect_cis:
=============================================================== iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 0000000093bc551f conn 00000000768ae504 hci_dev_put:1487: hci0 orig refcnt 21 hci_event_packet:7607: hci0: e ---truncated--- (CVE-2023-54164)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
根据 TuxCare 公告 ALMALINUX9.2：CLSA-2026：1789898700 中的指南更新受影响的程序包。另见
插件详情
严重性: High
ID: 360912
文件名: tuxcare_alma_linux_9.2_CLSA-2026-1789898700.nasl
版本: 1.1
类型: Local
发布时间: 2026/10/1
最近更新时间: 2026/10/1
支持的传感器: Continuous Assessment, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
风险信息
VPR
风险因素: High
分数: 7.6
百分位: 98.46
Vendor
Vendor Severity: Critical
CVSS v2
风险因素: Medium
基本分数: 6.8
时间分数: 5.3
矢量: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 分数来源: CVE-2026-64381
CVSS v3
风险因素: High
基本分数: 7.8
时间分数: 7
矢量: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:P/RL:O/RC:C
漏洞信息
必需的 KB 项: Host/OS/extended-third-party, Host/local_checks_enabled, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/cpu
可利用: true
易利用性: Exploits are available
补丁发布日期: 2026/9/20
漏洞发布日期: 2021/7/21
参考资料信息
CVE: CVE-2022-49296, CVE-2022-50255, CVE-2023-52615, CVE-2023-52982, CVE-2023-54164, CVE-2023-54258, CVE-2024-36909, CVE-2024-36949, CVE-2024-47728, CVE-2024-53230, CVE-2024-56703, CVE-2024-57898, CVE-2025-21918, CVE-2025-37795, CVE-2025-37844, CVE-2025-38120, CVE-2025-38304, CVE-2025-38510, CVE-2025-38587, CVE-2025-39865, CVE-2025-39944, CVE-2025-39977, CVE-2025-40018, CVE-2025-40085, CVE-2025-40111, CVE-2025-40237, CVE-2025-40281, CVE-2025-68229, CVE-2025-68261, CVE-2025-68337, CVE-2025-68782, CVE-2025-68788, CVE-2026-23151, CVE-2026-23272, CVE-2026-23391, CVE-2026-23457, CVE-2026-31454, CVE-2026-31533, CVE-2026-31566, CVE-2026-31665, CVE-2026-31673, CVE-2026-43024, CVE-2026-43041, CVE-2026-43065, CVE-2026-43091, CVE-2026-43201, CVE-2026-43406, CVE-2026-43407, CVE-2026-45843, CVE-2026-45870, CVE-2026-45873, CVE-2026-45919, CVE-2026-46050, CVE-2026-46051, CVE-2026-46071, CVE-2026-46102, CVE-2026-46146, CVE-2026-46173, CVE-2026-46196, CVE-2026-46253, CVE-2026-46303, CVE-2026-52921, CVE-2026-52929, CVE-2026-53035, CVE-2026-53048, CVE-2026-53184, CVE-2026-53225, CVE-2026-53229, CVE-2026-53270, CVE-2026-53349, CVE-2026-53352, CVE-2026-53357, CVE-2026-63884, CVE-2026-63968, CVE-2026-64299, CVE-2026-64303, CVE-2026-64304, CVE-2026-64305, CVE-2026-64306, CVE-2026-64313, CVE-2026-64317, CVE-2026-64320, CVE-2026-64322, CVE-2026-64323, CVE-2026-64329, CVE-2026-64330, CVE-2026-64334, CVE-2026-64335, CVE-2026-64336, CVE-2026-64340, CVE-2026-64341, CVE-2026-64343, CVE-2026-64344, CVE-2026-64348, CVE-2026-64352, CVE-2026-64355, CVE-2026-64370, CVE-2026-64374, CVE-2026-64375, CVE-2026-64380, CVE-2026-64381, CVE-2026-64403, CVE-2026-64408, CVE-2026-64411, CVE-2026-64412, CVE-2026-64422, CVE-2026-64423, CVE-2026-64435, CVE-2026-64436, CVE-2026-64448, CVE-2026-64450, CVE-2026-64563, CVE-2026-68202, CVE-2026-68251, CVE-2026-68294, CVE-2026-68336, CVE-2026-68365, CVE-2026-68376, CVE-2026-68391, CVE-2026-72125, CVE-2026-72126, CVE-2026-72389, CVE-2026-72438, CVE-2026-72472, CVE-2026-74470, CVE-2026-74556, CVE-2026-74565, CVE-2026-74580, CVE-2026-74582, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74597, CVE-2026-74599, CVE-2026-74604, CVE-2026-74609, CVE-2026-74621, CVE-2026-74630, CVE-2026-74641, CVE-2026-74656, CVE-2026-74660, CVE-2026-74667, CVE-2026-74669, CVE-2026-74672, CVE-2026-74682, CVE-2026-74688, CVE-2026-74689, CVE-2026-74700, CVE-2026-74704, CVE-2026-74705, CVE-2026-74714, CVE-2026-74720, CVE-2026-74725, CVE-2026-74730, CVE-2026-74744, CVE-2026-74746, CVE-2026-74752, CVE-2026-80529, CVE-2026-80536, CVE-2026-80558, CVE-2026-80576, CVE-2026-80725, CVE-2026-89555
CLSA: 2026:1789898700