CVE-2026-46110— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于stmmac驱动在RX内存耗尽时可能导致空指针取消引用。
影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 7414a28de1b3b028714859078c00a874f9feff52< fdeb95b1fc7de25c9362990efb9996a8d761055c |
affected |
779334e59850f863bf34665e0ff0b6faf126873b< e1c50b273298c7cd9b08b113e7a7598b531a02f5 |
affected | ||
b6cb4541853c7ee512111b0e7ddf3cb66c99c137< 5c910f7708e3c507b037ca91ca5b09f8cfe71e65 |
affected | ||
b6cb4541853c7ee512111b0e7ddf3cb66c99c137< 4af2e62cbcda575a174acd230c3f3a208135e16d |
affected | ||
b6cb4541853c7ee512111b0e7ddf3cb66c99c137< 950cb436165aad0f8f2cd49da3cd07677465bcde |
affected | ||
b6cb4541853c7ee512111b0e7ddf3cb66c99c137< 0bb05e6adfa99a2ea1fee1125cc0953409f83ed8 |
affected | ||
b435b4573240b5530830a1a60e005c6fcfd928a0 |
affected | ||
6.1.64< 6.1.176 |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-46110 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
net: stmmac: Prevent NULL deref when RX memory exhausted
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: Prevent NULL deref when RX memory exhausted
The CPU receives frames from the MAC through conventional DMA: the CPU
allocates buffers for the MAC, then the MAC fills them and returns
ownership to the CPU. For each hardware RX queue, the CPU and MAC
coordinate through a shared ring array of DMA descriptors: one
descriptor per DMA buffer. Each descriptor includes the buffer's
physical address and a status flag ("OWN") indicating which side owns
the buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set
the flag and the MAC is only allowed to clear it, and both must move
through the ring in sequence: thus the ring is used for both
"submissions" and "completions."
In the stmmac driver, stmmac_rx() bookmarks its position in the ring
with the `cur_rx` index. The main receive loop in that function checks
for rx_descs[cur_rx].own=0, gives the corresponding buffer to the
network stack (NULLing the pointer), and increments `cur_rx` modulo the
ring size. After the loop exits, stmmac_rx_refill(), which bookmarks its
position with `dirty_rx`, allocates fresh buffers and rearms the
descriptors (setting OWN=1). If it fails any allocation, it simply stops
early (leaving OWN=0) and will retry where it left off when next called.
This means descriptors have a three-stage lifecycle (terms my own):
- `empty` (OWN=1, buffer valid)
- `full` (OWN=0, buffer valid and populated)
- `dirty` (OWN=0, buffer NULL)
But because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In
the past (see 'Fixes:'), there was a bug where the loop could cycle
`cur_rx` all the way back to the first descriptor it dirtied, resulting
in a NULL dereference when mistaken for `full`. The aforementioned
commit resolved that *specific* failure by capping the loop's iteration
limit at `dma_rx_size - 1`, but this is only a partial fix: if the
previous stmmac_rx_refill() didn't complete, then there are leftover
`dirty` descriptors that the loop might encounter without needing to
cycle fully around. The current code therefore panics (see 'Closes:')
when stmmac_rx_refill() is memory-starved long enough for `cur_rx` to
catch up to `dirty_rx`.
Fix this by explicitly checking, before advancing `cur_rx`, if the next
entry is dirty; exit the loop if so. This prevents processing of the
final, used descriptor until stmmac_rx_refill() succeeds, but
fully prevents the `cur_rx == dirty_rx` ambiguity as the previous bugfix
intended: so remove the clamp as well. Since stmmac_rx_zc() is a
copy-paste-and-tweak of stmmac_rx() and the code structure is identical,
any fix to stmmac_rx() will also need a corresponding fix for
stmmac_rx_zc(). Therefore, apply the same check there.
In stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the
MAC sets OWN=0 on the final descriptor, it will be unable to send any
further DMA-complete IRQs until it's given more `empty` descriptors.
Currently, the driver simply *hopes* that the next stmmac_rx_refill()
succeeds, risking an indefinite stall of the receive process if not. But
this is not a regression, so it can be addressed in a future change.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于stmmac驱动在RX内存耗尽时可能导致空指针取消引用。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-46110 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-46110 的情报信息
请登录查看更多情报信息。
CVE-2026-46110 补丁与修复 (5)
同批安全公告 · Linux · 2026-05-28 · 共 135 条
| CVE-2026-46135 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-46195 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-46137 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-46115 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-46155 | 9.1 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-46119 | 9.1 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-46185 | 9.1 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-46212 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46174 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46125 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46166 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46198 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46152 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46238 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46113 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46138 | 8.1 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46232 | 8.1 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46215 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46227 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-46178 | 7.8 HIGH | Linux kernel 安全漏洞 |
显示前 20 条，共 135 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-46110
暂无评论