CVE-2026-98025— cx82310_eth URB处理缺陷导致堆溢出漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，已修复以下漏洞： net: usb: cx82310_eth：在 0xffff 重启哨兵后丢弃 URB，以防止 partial_data 堆溢出 长度值为 的哨兵用于检测路由器重启事件，并调度重新启用以太网模式。然而，代码随后会穿透（fall through）进入循环体的剩余部分。接下来的检查是： 这是之前匹配到的 语句的 分支——当 时，该条件永远不会触发。因此，通常用于限制不完整数据包保存路径的 MTU 边界检查被悄然绕过。 由于 为 4096， 恒成立。在不完整数据包分支中，会将 个字
影响版本矩阵 22
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808< d0c1ce6ef4cefe568e19afa83f543caa3c3c0873 |
affected |
ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808< 0dbc89e664b4609ad672b5bdeef60df251294b8f |
affected | ||
ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808< 00520cdd21ea6a9b5dc8d53bbd241620d2059554 |
affected | ||
ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808< 59bf9e94bdc49557f07d87164269daff7340f4d6 |
affected | ||
ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808< 3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287 |
affected | ||
ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808< 659654654eb140851467af41d610473c100c7975 |
affected | ||
ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808< 237c9ae7145772af147e4665f158938350fa5658 |
affected | ||
ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808< 5d50e90add8b4a978395e893e81954d19d58a7c5 |
affected | ||
| … +14 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-98025 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
The 0xffff length sentinel detects a router reboot and schedules
re-enabling of ethernet mode, but then falls through to the rest
of the loop body. The next check is
} else if (len > CX82310_MTU) {
which is the else of the just-matched if -- it never fires for
len == 0xffff. The MTU bound that normally caps the
incomplete-packet save path is silently bypassed.
With 0xffff > skb->len always true (rx_urb_size is 4096), the
incomplete-packet branch saves dev->partial_len = skb->len bytes
into dev->partial_data. partial_data is kmalloc(hard_mtu) =
kmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the
2-byte header pull can be up to 4094. A device that sends a
4096-byte URB starting with [0xff 0xff] therefore copies 4094
device-provided bytes into a buffer allocated for 1516 bytes,
exceeding its requested size by 2578 bytes.
The next URB then reads dev->partial_len (4094) back from the same
1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from
the new URB's ~4KB skb, both well past their allocations, and
delivers the spliced result as a 64KB "frame" to the network
stack.
Bail out of rx_fixup after scheduling the re-enable work; the
remainder of a reboot-marker URB is not meaningful packet data.
This restores the invariant that partial_len < CX82310_MTU + 2 on
the save path, since every other route there has already passed
the MTU check.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-98025 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-98025 的情报信息
请登录查看更多情报信息。
CVE-2026-98025 补丁与修复 (8)
同批安全公告 · Linux · 2026-09-25 · 共 372 条
| CVE-2026-100075 | 9.8 CRITICAL | RDMA/srpt：srpt_alloc_rw_ctxs() 未释放计数器修复 |
| CVE-2026-97555 | 8.8 HIGH | smb客户端：修复DACL所有者/组重写中的堆溢出漏洞 |
| CVE-2026-97957 | 8.8 HIGH | hinic 邮箱段缓冲区溢出漏洞 |
| CVE-2026-97527 | 8.8 HIGH | qla2xxx SCSI驱动程序 NVMe未解决上下文列表竞争条件漏洞 |
| CVE-2026-97528 | 8.8 HIGH | QLogic qla2xxx驱动LS拒绝错误NVMe内存泄漏漏洞 |
| CVE-2026-98115 | 8.8 HIGH | ksmbd 注销期间会话安全排空漏洞 |
| CVE-2026-97525 | 8.2 HIGH | x86/mm/pat：内核页表分裂页表分配漏洞 |
| CVE-2026-98069 | 8.1 HIGH | Net/RDS rds_conn_shutdown() 快速路径锁获取漏洞 |
| CVE-2026-97573 | 8.1 HIGH | bnxt_en 驱动 bnxt_rx_ring_reset 缓冲区分配失败漏洞 |
| CVE-2026-97570 | 8.1 HIGH | bnxt_en: 修复因SW TPA ID绑定问题导致的崩溃漏洞 |
| CVE-2026-98130 | 8.1 HIGH | SCTP定时器启动竞争条件漏洞 |
| CVE-2026-98070 | 8.1 HIGH | Linux RDS 模块远程代码执行漏洞 |
| CVE-2026-98002 | 7.8 HIGH | AMD IOMMU 嵌套域分配中错误检查失效漏洞 |
| CVE-2026-97575 | 7.8 HIGH | v4l2-ctrls AV1瓦片计数验证漏洞 |
| CVE-2026-97576 | 7.8 HIGH | V4L2-ctrls HEVC 瓦片计数验证漏洞 |
| CVE-2026-97941 | 7.8 HIGH | Linux 内核 slab 内存分配器竞态条件漏洞 |
| CVE-2026-98112 | 7.8 HIGH | ksmbd 网络接口事件中监听器任务生命周期修复漏洞 |
| CVE-2026-97937 | 7.8 HIGH | Linux内核ftrace远程代码执行漏洞 |
| CVE-2026-97580 | 7.8 HIGH | rkvdec HEVC解析数组越界漏洞 |
| CVE-2026-97940 | 7.8 HIGH | IPv6 修复 fib6 遍历器在 seq 停止时存在 UAF 漏洞 |
显示前 20 条，共 372 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-98025
暂无评论