CVE-2026-72018

CVE-2026-72018 — Linux 内核越界写入 Linux 内核 • DIBS 回环 • 越界写入 CVE-2026-72018 的安全研究与技术分析。 01 — 概述 CVE-2026-72018 是一个影响 DIBS/ISM 回环功能的 Linux 内核越界写入 漏洞。 该漏洞与传入已注册 DMB（数据内存缓冲区） 的数据处理有关。 受影响的实现未在执行内存操作之前充分验证所提供的偏移量、传输大小与实际 DMB 边界之间的关系。 漏洞分类 属性| 值 ---|--- CVE| CVE-2026-72018 CWE| CWE-787 — 越界写入 CVSS v3.1| 7....

SUSE CVE-2026-74617

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

SUSE CVE-2026-72018

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

CVE-2026-74617

A flaw was found in the Linux kernel's dibs device driver. The dibs-lock was not properly initialized when a dibs device was allocated, allowing a Global ID GID event interrupt to occur before the lock was ready. This could lead to the system attempting to acquire an uninitialized lock, potential...

CVE-2026-74629

A flaw was found in the Linux kernel's dibs device handling. A use-after-free UAF vulnerability exists where a dibs device interrupt handler can access dmbclientidarr after it has been freed. Additionally, a double-free vulnerability can occur if dibsdevadd fails during dibslodevprobe, leading to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: dibs: fixed the use-of-free condition in the loopback attach/detach/unregister process. dibsloattachdmb, dibslodetachdmb, and dibslounregisterdmb now look up the dmbnode under dmbhtlock, release the lock, and then operate on t...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback version of movedata performs a memcpy operation into the registered DMB. This operation does not check whether the combined offset and size exceed the length of th...

SUSE CVE-2026-74629

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74629

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74617

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

CVE-2026-74629

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74617

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

UBUNTU-CVE-2026-74617

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

UBUNTU-CVE-2026-74629

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74629 net/dibs: Correct freeing of dmb_clientid_arr

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

EUVD-2026-64566

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74629

CVE-2026-74629 affects the Linux kernel's dibs (Device In-Band Signaling) subsystem and involves two memory-management defects in the lifecycle of dmb_clientid_arr. First, a use-after-free occurs when a dibs device interrupt handler remains active after dibs_dev_del() and continues to access the ...

CVE-2026-74629 net/dibs: Correct freeing of dmb_clientid_arr

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74617 dibs: initialise dibs->lock in dibs_dev_alloc()

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

CVE-2026-74617

CVE-2026-74617 affects the Linux kernel 's dibs device driver. The root cause is that dibs->lock was initialised in dibs_dev_add(), but a dibs device can already receive interrupts before that call: ism_probe() invokes ism_dev_init() (which calls request_irq()) prior to dibs_dev_add(). A GID e...