7.8

CVE-2026-74590

fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions

In the Linux kernel, the following vulnerability has been resolved:

fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions

The BPF verifier and the dynptr abstraction ensure that the memory space
referenced by a dynptr remains valid.  They do not, however, provide any
guarantee that the contents of the memory are stable.  kfuncs are
expected to remain memory-safe even if concurrent modifications occur.

bpf_get_fsverity_digest() didn't follow that: it could crash if
arg->digest_size was concurrently modified.

Fix that by using the known-good value hash_alg->digest_size instead.

Also widen 'dynptr_sz' and 'out_digest_sz' to u64 to match the return
type of __bpf_dynptr_size().  It doesn't appear that it can actually be
more than INT_MAX currently (since __bpf_dynptr_data_rw() excludes
file-based pointers), but the correct type might as well be used.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 67814c00de3161181cddd06c77aeaf86ac4cc584
Version < 1344b632cb5043e32939a84568125719111c5af3
Status affected
Version 67814c00de3161181cddd06c77aeaf86ac4cc584
Version < 2a5cfcad1d56e26d645b7887b0ed24c371851525
Status affected
Version 67814c00de3161181cddd06c77aeaf86ac4cc584
Version < 5bd63cad9df4328a184c409fbdad4f17944bcdb8
Status affected
Version 67814c00de3161181cddd06c77aeaf86ac4cc584
Version < 3e8ec7c0387273329374f5c7bd61f5f38af71fe1
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.8
Status affected
Version 0
Version < 6.8
Status unaffected
Version <= 6.12.*
Version 6.12.104
Status unaffected
Version <= 6.18.*
Version 6.18.45
Status unaffected
Version <= 7.1.*
Version 7.1.9
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.062
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/1344b632cb5043e32939a84568125719111c5af3
https://git.kernel.org/stable/c/2a5cfcad1d56e26d645b7887b0ed24c371851525
https://git.kernel.org/stable/c/3e8ec7c0387273329374f5c7bd61f5f38af71fe1
https://git.kernel.org/stable/c/5bd63cad9df4328a184c409fbdad4f17944bcdb8