CVE-2026-64593— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于btrfs在设备重新出现时未正确更新bdev指针，导致对不可写设备执行trim操作时触发空指针取消引用，可能导致内核崩溃。
可能的 ATT&CK 技术 1 AI
T1499.002 · Service Exhaustion Flood影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 499f377f49f085ee4aa214c738e948e88626f39b< f41ae7e6664f3c4361129728f2c4d5f3ed995251 |
affected |
499f377f49f085ee4aa214c738e948e88626f39b< 210af872eafa0cf572a84cb303c0f9d2914c1226 |
affected | ||
499f377f49f085ee4aa214c738e948e88626f39b< 3d8fa4b828a86b33c60858e58aaab6df273ede05 |
affected | ||
499f377f49f085ee4aa214c738e948e88626f39b< 9c894159c5b8adc84072e3af0e55b0473a69564e |
affected | ||
499f377f49f085ee4aa214c738e948e88626f39b< 02c903fc6fc7e16c5d1f22d18784f1208acf43e3 |
affected | ||
499f377f49f085ee4aa214c738e948e88626f39b< 7a64521802997257b144e6edfb4e278dbeb972dd |
affected | ||
499f377f49f085ee4aa214c738e948e88626f39b< b4af31b898a948e29861cb0bae734058f9a49d9b |
affected | ||
499f377f49f085ee4aa214c738e948e88626f39b< 1b1937eb08f51319bf71575484cde2b8c517aedc |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-64593 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
btrfs: do not trim a device which is not writeable
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: do not trim a device which is not writeable
[BUG]
There is a bug report that btrfs/242 can randomly fail with the
following NULL pointer dereference:
run fstests btrfs/242 at 2026-06-01 10:25:08
BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)
BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874
BTRFS info (device sdc): using crc32c checksum algorithm
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS info (device sdc): allowing degraded mounts
BTRFS info (device sdc): turning on async discard
BTRFS info (device sdc): enabling free space tree
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000
CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd
Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025
pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]
lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]
Call trace:
btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)
btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
__arm64_sys_ioctl+0xac/0x108
invoke_syscall.constprop.0+0x5c/0xd0
el0_svc_common.constprop.0+0x40/0xf0
do_el0_svc+0x24/0x40
el0_svc+0x40/0x1d0
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)
---[ end trace 0000000000000000 ]---
Also the reporter is very kind to test the following ASSERT() added to
btrfs_trim_free_extents_throttle():
ASSERT(device->bdev,
"devid=%llu path=%s dev_state=0x%lx\n",
device->devid, btrfs_dev_name(device), device->dev_state);
And it shows the following output:
assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)
Which means the device->bdev is NULL, and the dev_state is
BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without
BTRFS_DEV_STATE_WRITEABLE flag set.
[CAUSE]
The pc points to the following call chain:
btrfs_trim_fs()
|- btrfs_trim_free_extents()
|- btrfs_trim_free_extents_throttle()
|- bdev_max_discard_sectors(device->bdev)
So the NULL pointer dereference is caused by device->bdev being NULL.
This looks impossible by a quick glance, as just before calling
btrfs_trim_free_extents_throttle(), we have skipped any device that has
BTRFS_DEV_STATE_MISSING flag set.
However in this particular case, there is a window where the missing
device is later re-scanned, causing btrfs to remove the
BTRFS_DEV_STATE_MISSING flag:
btrfs_control_ioctl()
|- btrfs_scan_one_device()
|- device_list_add()
|- rcu_assign_pointer(device->name, name);
| This updates the missing device's path to the new good path.
|
|- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)
This removes the BTRFS_DEV_STATE_MISSING flag.
This allows the missing device to re-appear and clear the
BTRFS_DEV_STATE_MISSING flag. However the device still does not have
the BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated.
The bdev pointer remains NULL, triggering the crash later.
[FIX]
This is a big de-synchronization between BTRFS_DEV_STATE_MISSING and
device->bdev pointer, and shows a gap in btrfs's re-appearing-device
handling.
The proper handling of re-appearing device will need quite some extra
work, which is out of the context of this small
---truncated---
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于btrfs在设备重新出现时未正确更新bdev指针，导致对不可写设备执行trim操作时触发空指针取消引用，可能导致内核崩溃。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-64593 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-64593 的情报信息
请登录查看更多情报信息。
CVE-2026-64593 补丁与修复 (8)
同批安全公告 · Linux · 2026-08-06 · 共 22 条
| CVE-2026-64597 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64586 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64598 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64584 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64585 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64588 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64583 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64601 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64599 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64587 | 7.0 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-68480 | Linux kernel 安全漏洞 | |
| CVE-2026-64604 | Linux kernel 安全漏洞 | |
| CVE-2026-64603 | Linux kernel 安全漏洞 | |
| CVE-2026-64602 | Linux kernel 安全漏洞 | |
| CVE-2026-64596 | Linux kernel 安全漏洞 | |
| CVE-2026-64595 | Linux kernel 安全漏洞 | |
| CVE-2026-64594 | Linux kernel 安全漏洞 | |
| CVE-2026-64592 | Linux kernel 安全漏洞 | |
| CVE-2026-64591 | Linux kernel 安全漏洞 | |
| CVE-2026-64590 | Linux kernel 安全漏洞 |
显示前 20 条，共 22 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-64593
暂无评论