目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

CVE-2026-52942— Linux kernel 安全漏洞

CVSS 7.1 · High EPSS 0.12% · P3

Possible ATT&CK Techniques 1AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 18

ベンダープロダクトVersion Rangeステータス
LinuxLinux7eb9282cd0efac08b8377cbd5037ba297c77e3f7< 2e96e1bc9b4d5450e6c33f078e19a9bc1dda6c0baffected
7eb9282cd0efac08b8377cbd5037ba297c77e3f7< d704ee9c7bc68a161684c51a7ac05b446dcf38d4affected
7eb9282cd0efac08b8377cbd5037ba297c77e3f7< befb8968a2abdfa948d5600ea7f7a509a292a590affected
7eb9282cd0efac08b8377cbd5037ba297c77e3f7< 8a81e336da685423f5b64aac4d571e63d674c52aaffected
7eb9282cd0efac08b8377cbd5037ba297c77e3f7< c38d41134085193efd5b237cf513ad5b3421a60daffected
7eb9282cd0efac08b8377cbd5037ba297c77e3f7< af1b7699466f6556b351fa25d3dc870abfb5d310affected
7eb9282cd0efac08b8377cbd5037ba297c77e3f7< 65ef7397eb9a296e91839f5fd10be96f23d332e7affected
7eb9282cd0efac08b8377cbd5037ba297c77e3f7< a84b6fedbc97078788be78dbdd7517d143ad1a77affected
… +10 more rows
新しい脆弱性情報の通知を購読するログインして購読

I. CVE-2026-52942の基本情報

脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗

高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。

脆弱性タイトル
netfilter: nf_log: validate MAC header was set before dumping it
ソース: CVE Program / CVE List V5
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log. This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed). Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before. BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265)
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel 2.6.36版本存在安全漏洞，该漏洞源于dump_mac_header函数在未验证MAC标头是否设置的情况下读取MAC标头，导致越界读取，可能泄露内核日志信息。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)

影響を受ける製品

ベンダープロダクト影響を受けるバージョンCPE購読
LinuxLinux 7eb9282cd0efac08b8377cbd5037ba297c77e3f7 ~ 2e96e1bc9b4d5450e6c33f078e19a9bc1dda6c0b -
LinuxLinux 2.6.36 -

II. CVE-2026-52942の公開POC

#POC説明ソースリンクShenlongリンク
AI生成POCプレミアム

公開POCは見つかりませんでした。

ログインしてAI POCを生成

III. CVE-2026-52942のインテリジェンス情報

请登录查看更多情报信息。

CVE-2026-52942 补丁与修复 (8)

Same Patch Batch · Linux · 2026-06-24 · 219 CVEs total

CVE-2026-530499.8 CRITICALgfs2: add some missing log locking
CVE-2026-529939.8 CRITICALtipc: fix double-free in tipc_buf_append()
CVE-2026-529899.8 CRITICALnvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
CVE-2026-529869.8 CRITICALnetfilter: nf_conntrack_sip: don't use simple_strtoul
CVE-2026-529829.8 CRITICALnet: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
CVE-2026-530029.8 CRITICALnetfilter: conntrack: remove sprintf usage
CVE-2026-530069.8 CRITICALipv6: fix possible UAF in icmpv6_rcv()
CVE-2026-530459.8 CRITICALmemory: tegra124-emc: Fix dll_change check
CVE-2026-530869.8 CRITICALnet: bcmgenet: fix racing timeout handler
CVE-2026-530469.8 CRITICALksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
CVE-2026-529559.8 CRITICALlibceph: Fix potential out-of-bounds access in crush_decode()
CVE-2026-530109.8 CRITICALksmbd: fix use-after-free in smb2_open during durable reconnect
CVE-2026-530889.8 CRITICALnet: bcmgenet: fix off-by-one in bcmgenet_put_txcb
CVE-2026-529149.8 CRITICALbatman-adv: fix fragment reassembly length accounting
CVE-2026-530559.8 CRITICALcrypto: hisilicon/sec2 - prevent req used-after-free for sec
CVE-2026-529249.8 CRITICALsctp: purge outqueue on stale COOKIE-ECHO handling
CVE-2026-529319.8 CRITICALbatman-adv: tp_meter: avoid use of uninit sender vars
CVE-2026-529999.1 CRITICALnetfilter: nfnetlink_osf: fix out-of-bounds read on option matching
CVE-2026-530439.1 CRITICALocfs2/dlm: validate qr_numregions in dlm_match_regions()
CVE-2026-529589.1 CRITICALlibceph: Fix potential out-of-bounds access in osdmap_decode()

Showing 20 of 219 CVEs. View all on vendor page →

IV. 関連脆弱性

同じ製品: Linux
同じベンダー: Linux

V. CVE-2026-52942へのコメント

まだコメントはありません

コメントを残す