9.8

CVE-2026-68144

phonet: pep: fix use-after-free in pep_get_sb()

In the Linux kernel, the following vulnerability has been resolved:

phonet: pep: fix use-after-free in pep_get_sb()

pep_get_sb() doesn't consider that pskb_may_pull() might have relocated
the skb data, and continue to access the older pointer, causing UAF.

Reproduced under KASAN:

  BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0
  Read of size 1 at addr ff11000105510f50 by task repro/157
   pep_get_sb+0x234/0x3b0
   pipe_handler_do_rcv+0x5f7/0xa10
   pep_do_rcv+0x203/0x410
   __sk_receive_skb+0x471/0x4a0
   phonet_rcv+0x5b3/0x6c0
   __netif_receive_skb+0xcc/0x1d0

Refetch the header with skb_header_pointer() after pskb_may_pull(), so
the possibly stale pointer is no longer dereferenced. There are better
ways to solve this, but, this is the less instrusive one.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 9641458d3ec42def729fde64669abf07f3220cd5
Version < c4a52cb4da8d57d060b1d52085d25147a238dac2
Status affected
Version 9641458d3ec42def729fde64669abf07f3220cd5
Version < df198743859fefba2f824115f8151dd62d7ad6d8
Status affected
Version 9641458d3ec42def729fde64669abf07f3220cd5
Version < 1d81e19fc57a5ee55b4497d01bc0510d76fb9578
Status affected
Version 9641458d3ec42def729fde64669abf07f3220cd5
Version < 8d931a75a38b9bb584a4071f5ebbd52755fc35ee
Status affected
Version 9641458d3ec42def729fde64669abf07f3220cd5
Version < 17f78c0c0d41d738ee236eb6e841e39395188054
Status affected
Version 9641458d3ec42def729fde64669abf07f3220cd5
Version < a48a889b60f73edb0399a8b08284a2ab0bd0295f
Status affected
Version 9641458d3ec42def729fde64669abf07f3220cd5
Version < 25e3641beb51333bfbb155af2fd2573a61113af2
Status affected
Version 9641458d3ec42def729fde64669abf07f3220cd5
Version < 0f71f852a96af9685858ce59fda34ecbf85c283d
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 2.6.28
Status affected
Version 0
Version < 2.6.28
Status unaffected
Version <= 5.10.*
Version 5.10.265
Status unaffected
Version <= 5.15.*
Version 5.15.216
Status unaffected
Version <= 6.1.*
Version 6.1.183
Status unaffected
Version <= 6.6.*
Version 6.6.148
Status unaffected
Version <= 6.12.*
Version 6.12.101
Status unaffected
Version <= 6.18.*
Version 6.18.42
Status unaffected
Version <= 7.1.*
Version 7.1.6
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.433
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee
https://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054
https://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f
https://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2
https://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d
https://git.kernel.org/stable/c/1d81e19fc57a5ee55b4497d01bc0510d76fb9578
https://git.kernel.org/stable/c/c4a52cb4da8d57d060b1d52085d25147a238dac2
https://git.kernel.org/stable/c/df198743859fefba2f824115f8151dd62d7ad6d8