CVE-2026-31425— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在IB连接建立前接受FRMR注册，可能导致空指针取消引用。
影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 1659185fb4d0025835eb2058a141f0746c5cab00< c506456ebf84c50ed9327473d4e9bd905def212b |
affected |
1659185fb4d0025835eb2058a141f0746c5cab00< 82e4a3b56b23b844802056c9e75a39d24169b0a4 |
affected | ||
1659185fb4d0025835eb2058a141f0746c5cab00< 450ec93c0f172374acbf236f1f5f02d53650aa2d |
affected | ||
1659185fb4d0025835eb2058a141f0746c5cab00< 6b0a8de67ac0c74e1a7df92b73c862cb36780dfc |
affected | ||
1659185fb4d0025835eb2058a141f0746c5cab00< a5bfd14c9a299e6db4add4440430ee5e010b03ad |
affected | ||
1659185fb4d0025835eb2058a141f0746c5cab00< 23e07c340c445f0ebff7757ba15434cb447eb662 |
affected | ||
1659185fb4d0025835eb2058a141f0746c5cab00< 47de5b73db3b88f45c107393f26aeba26e9e8fae |
affected | ||
1659185fb4d0025835eb2058a141f0746c5cab00< a54ecccfae62c5c85259ae5ea5d9c20009519049 |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-31425 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
rds: ib: reject FRMR registration before IB connection is established
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
rds: ib: reject FRMR registration before IB connection is established
rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data
and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a
fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with
i_cm_id = NULL because the connection worker has not yet called
rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with
RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses
the control message before any connection establishment, allowing
rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the
kernel.
The existing guard in rds_ib_reg_frmr() only checks for !ic (added in
commit 9e630bcb7701), which does not catch this case since ic is allocated
early and is always non-NULL once the connection object exists.
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920
Call Trace:
rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167)
rds_ib_map_frmr (net/rds/ib_frmr.c:252)
rds_ib_reg_frmr (net/rds/ib_frmr.c:430)
rds_ib_get_mr (net/rds/ib_rdma.c:615)
__rds_rdma_map (net/rds/rdma.c:295)
rds_cmsg_rdma_map (net/rds/rdma.c:860)
rds_sendmsg (net/rds/send.c:1363)
____sys_sendmsg
do_syscall_64
Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all
non-NULL before proceeding with FRMR registration, mirroring the guard
already present in rds_ib_post_inv(). Return -ENODEV when the connection
is not ready, which the existing error handling in rds_cmsg_send() converts
to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to
start the connection worker.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在IB连接建立前接受FRMR注册，可能导致空指针取消引用。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-31425 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-31425 的情报信息
请登录查看更多情报信息。
同批安全公告 · Linux · 2026-04-13 · 共 15 条
| CVE-2026-31414 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-31419 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-31417 | 7.5 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-31426 | 7.0 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-31428 | Linux kernel 安全漏洞 | |
| CVE-2026-31427 | Linux kernel 安全漏洞 | |
| CVE-2026-31424 | Linux kernel 安全漏洞 | |
| CVE-2026-31423 | Linux kernel 安全漏洞 | |
| CVE-2026-31422 | Linux kernel 安全漏洞 | |
| CVE-2026-31420 | Linux kernel 安全漏洞 | |
| CVE-2026-31421 | Linux kernel 安全漏洞 | |
| CVE-2026-31418 | Linux kernel 安全漏洞 | |
| CVE-2026-31416 | Linux kernel 安全漏洞 | |
| CVE-2026-31415 | Linux kernel 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-31425
暂无评论