« Volver al listado

CVE-2026-89780

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: restore skb->dev on deaggregated frames

rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd.

Leer descripción completaMostrar menos

Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device.

Detalles técnicos trazas, registros y código del informe original
  BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158)
  Write of size 4 at addr 00000000000004b4 by task exploit/144
  Call Trace:
   _raw_spin_lock (kernel/locking/spinlock.c:158)
   netif_tx_lock (net/sched/sch_generic.c:497)
   rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67)
   rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125)
   __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103)
   ...
   __netif_receive_skb_one_core (net/core/dev.c:6214)
   netif_receive_skb (net/core/dev.c:6474)
   tun_get_user (drivers/net/tun.c:1966)
   tun_chr_write_iter (drivers/net/tun.c:2012)
   vfs_write (fs/read_write.c:687)
   ksys_write (fs/read_write.c:739)
   do_syscall_64 (arch/x86/entry/syscall_64.c:94)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
  Kernel panic - not syncing: Fatal exception in interrupt

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89780",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "378e25357ac78ad02fbc98bec9b4e3baaa916c5c",
              "lessThan": "5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "378e25357ac78ad02fbc98bec9b4e3baaa916c5c",
              "lessThan": "9b78ab84ddf97c06a8567edb62b6c0fd582f9a62",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "378e25357ac78ad02fbc98bec9b4e3baaa916c5c",
              "lessThan": "9d18c6c6cd1666b2cb7915cad052e22abf520997",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "378e25357ac78ad02fbc98bec9b4e3baaa916c5c",
              "lessThan": "4bcef54e4a3355a62d9ad90729fe563435ec76c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "378e25357ac78ad02fbc98bec9b4e3baaa916c5c",
              "lessThan": "b14c22c31d9e30f38ea1693ac06d318f32258f5d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "378e25357ac78ad02fbc98bec9b4e3baaa916c5c",
              "lessThan": "7abe769e72c792e5f9eb273813eb3ecd8389854c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "378e25357ac78ad02fbc98bec9b4e3baaa916c5c",
              "lessThan": "200460a0793dc6af97d3b36d92ac245350ac26fc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "378e25357ac78ad02fbc98bec9b4e3baaa916c5c",
              "lessThan": "a66734a1c5e36525ea07e9f4547fddc51e916de3",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-16T09:17:08.520",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/200460a0793dc6af97d3b36d92ac245350ac26fc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4bcef54e4a3355a62d9ad90729fe563435ec76c3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7abe769e72c792e5f9eb273813eb3ecd8389854c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9b78ab84ddf97c06a8567edb62b6c0fd582f9a62",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9d18c6c6cd1666b2cb7915cad052e22abf520997",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a66734a1c5e36525ea07e9f4547fddc51e916de3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b14c22c31d9e30f38ea1693ac06d318f32258f5d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: restore skb->dev on deaggregated frames\n\nrmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and\nleaves skb->dev NULL. __rmnet_map_ingress_handler() assigns\nskb->dev = ep->egress_dev only on the data path, but a MAP command frame\nis dispatched to rmnet_map_command() before that, so rmnet_map_send_ack()\nruns netif_tx_lock(skb->dev) on a NULL device. An unprivileged user\nreaches this by unsharing a user+net namespace, creating an rmnet link\nover a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS,\nand writing an aggregated frame carrying a flow-control command to the\ntap fd.\n\nRestore the assignment dropped by 378e25357ac7, so every skb leaving\nrmnet_map_deaggregate() has a valid device.\n\n  BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158)\n  Write of size 4 at addr 00000000000004b4 by task exploit/144\n  Call Trace:\n   _raw_spin_lock (kernel/locking/spinlock.c:158)\n   netif_tx_lock (net/sched/sch_generic.c:497)\n   rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67)\n   rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125)\n   __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103)\n   ...\n   __netif_receive_skb_one_core (net/core/dev.c:6214)\n   netif_receive_skb (net/core/dev.c:6474)\n   tun_get_user (drivers/net/tun.c:1966)\n   tun_chr_write_iter (drivers/net/tun.c:2012)\n   vfs_write (fs/read_write.c:687)\n   ksys_write (fs/read_write.c:739)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  Kernel panic - not syncing: Fatal exception in interrupt"
    }
  ],
  "lastModified": "2026-09-16T09:17:08.520",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}