CVE-2026-80975— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.14版本存在安全漏洞，该漏洞源于qnap_mcu_exec()将栈上接收缓冲区发布给未同步的serdev接收路径，在命令超时或写入失败后，迟到的回复或未经请求的消息会写入已失效的栈帧，可能导致栈内存损坏。
影响版本矩阵 8
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 998f70d1806bb718a7565f350283e4a79c8cbb4b< 0b6680e306397097a97767447368221fac753809 |
affected |
998f70d1806bb718a7565f350283e4a79c8cbb4b< 8391ee06d08845a0a165b5fe679ba326915166b2 |
affected | ||
998f70d1806bb718a7565f350283e4a79c8cbb4b< 47504742cea7878ebd1bf1491bbed923df6b90b1 |
affected | ||
6.14 |
affected | ||
< 6.14 |
unaffected | ||
6.18.51≤ 6.18.* |
unaffected | ||
7.2.4≤ 7.2.* |
unaffected | ||
7.3-rc1≤ * |
unaffected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-80975 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
mfd: qnap-mcu: keep the reply buffer alive past a command timeout
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mfd: qnap-mcu: keep the reply buffer alive past a command timeout
qnap_mcu_exec() publishes an on-stack buffer to the receive path:
unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE];
...
reply->data = rx;
reply->length = length;
and qnap_mcu_receive_buf() writes into it from the serdev receive path,
which runs out of flush_to_ldisc() and is not serialized against
qnap_mcu_exec() at all. bus_lock cannot cover it, because qnap_mcu_exec()
holds that mutex across wait_for_completion_timeout().
On a timeout qnap_mcu_exec() returns with reply->data still pointing at
its own frame. A reply that arrives late, or an unsolicited message from
the MCU, is then written into a stack frame that has been left, corrupting
whatever runs next on that stack. The same applies when qnap_mcu_write()
fails, since that path returns without touching the reply state either.
Move the receive buffer into struct qnap_mcu. It is 37 bytes and the
structure is devm_kzalloc()ed, so it lives as long as the driver, and a
late write lands in memory that is still valid and is reinitialized by the
next command. bus_lock keeps commands from sharing it.
This deliberately does not clear reply->data or reply->length on the
timeout path. Doing so races with qnap_mcu_receive_buf(), which reads both
after its
if (!reply->length)
return size;
check: clearing reply->data gives a NULL dereference, and clearing
reply->length alone removes the reply->received == reply->length exit
condition, so the copy loop runs until the uart chunk is consumed and
overruns the buffer. Leaving both set keeps the write bounded by
reply->length, which qnap_mcu_exec() has already checked against
sizeof(mcu->rx).
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.14版本存在安全漏洞，该漏洞源于qnap_mcu_exec()将栈上接收缓冲区发布给未同步的serdev接收路径，在命令超时或写入失败后，迟到的回复或未经请求的消息会写入已失效的栈帧，可能导致栈内存损坏。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-80975 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-80975 的情报信息
请登录查看更多情报信息。
CVE-2026-80975 补丁与修复 (3)
同批安全公告 · Linux · 2026-09-11 · 共 431 条
| CVE-2026-89688 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89656 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89655 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89658 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89660 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89659 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89662 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89669 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89674 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89675 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89676 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89677 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89681 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89686 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89478 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89479 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89702 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89703 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89482 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89708 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
显示前 20 条，共 431 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-80975
暂无评论