CVE-2026-98503— DPDK 数据包 TX 环缓冲区信息处理漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，以下漏洞已得到修复： packet 子系统：为 TX_RING 数据包使用 ubuf_info 完成机制 函数发送的套接字缓冲区（skb）中，其分片（frags）指向环形缓冲区（ring）中的槽位（slots）。这些槽位仅在调用 时才会被释放。 然而， 会在 skb 被真正释放之前调用 。这可能导致槽位在仍与 skb 关联的情况下被提前重用，从而引发数据竞争或内存安全问题。 修复方案如下： 改用标准的零拷贝完成机制（ubuf_info），确保槽位仅在所有对负载（payload）的引用被释放或
可能的 ATT&CK 技术 3 AI
T1069.004 T1548.001 · Setuid and Setgid T1190 · Exploit Public-Facing Application影响版本矩阵 14
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 5cd8d46ea1562be80063f53c7c6a5f40224de623< e67c455d79fbf709a94965f09a2be6bf4f4ba5fd |
affected |
5cd8d46ea1562be80063f53c7c6a5f40224de623< eda9bcb721f15a93746a99eabda33d80b86404fd |
affected | ||
5cd8d46ea1562be80063f53c7c6a5f40224de623< 2a0c9afefc0ecea2cc30ccfbbbc98182a0986191 |
affected | ||
5cd8d46ea1562be80063f53c7c6a5f40224de623< 9518405613863d0bf0700927a21367f5942cf058 |
affected | ||
67f6fba765ef8cb19089d476e3c367212a2fbdfd |
affected | ||
f2a67e68dbaeae7c88e5522873d7b908911f9f77 |
affected | ||
4.14.86< 4.15 |
affected | ||
4.19.7< 4.20 |
affected | ||
| … +6 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-98503 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
packet: use ubuf_info completion for TX_RING packets
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
packet: use ubuf_info completion for TX_RING packets
tpacket_snd sends skbs with frags pointing into its ring slots. Slots
are released when skb->destructor is called.
A call to skb_orphan calls skb->destructor before the skb is freed.
This can cause the slot to be reused while still linked into the skb.
Switch to standard zerocopy completion (ubuf_info) so the slot is only
released once all references to the payload are freed or copied.
Restore skb->destructor to standard sock_wfree.
The ubuf_info completion callback can be called with a NULL skb, but
only from net_zcopy_put and related API, used by zerocopy implementations
that hold their own reference on the uarg, such as MSG_ZEROCOPY. This
uarg is only ever completed from skb_zcopy_clear, so skb is always set.
To prevent userspace from aliasing in-flight state on shared ring
slots, allocate tpacket_uarg per packet, rather than per slot. This
adds a small allocation to the transmit path. Use standard kmalloc to
allow backporting to stable kernels.
The uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt
reference. packet_free_tx_ring waits on sk_wmem_alloc before freeing
the ring pages. Always allocate vec->deferred for tx_ring so page-backed
rings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs
before calling tpacket_ubuf_complete.
Drop the tx_ring.pg_vec test that tpacket_destruct_skb performed before
accessing the slot. The sk_wmem_alloc reference now guarantees that the
slot is valid. The test is also not sufficient by itself, as it reads
pg_vec without pg_vec_lock, so it can race with packet_set_ring.
As a result a slot is released when its payload is copied, which can
be before transmission (e.g., in skb_orphan_frags_rx). If copied
before skb_tx_timestamp() is called, no slot timestamp is recorded,
similar to when skb_orphan() was called early in the datapath before
this patch.
Revert the now unused previous skb_zcopy_.._nouarg infra.
Depends on commit 992cc9f94ca9 ("net/packet: defer vmalloc TX_RING
free until skbs finish").
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-98503 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-98503 的情报信息
请登录查看更多情报信息。
CVE-2026-98503 补丁与修复 (4)
同批安全公告 · Linux · 2026-10-18 · 共 435 条
| CVE-2026-98490 | 9.8 CRITICAL | Open vSwitch conntrack 模块 辅助函数释放后使用漏洞 |
| CVE-2026-98548 | 9.8 CRITICAL | Linux SCTP 协议 旧 Cookie 错误 数据包丢弃漏洞 |
| CVE-2026-98464 | 9.3 CRITICAL | Linux RISC-V KVM 定时器回调竞态条件漏洞 |
| CVE-2026-98549 | 9.1 CRITICAL | Linux TCP 重传队列边界合并漏洞 |
| CVE-2026-98451 | 8.8 HIGH | Samba SMB 客户端非普通文件句柄处理漏洞 |
| CVE-2026-98466 | 8.2 HIGH | KVM arm64 版本 hyp 栈页面越界访问漏洞 |
| CVE-2026-98499 | 8.1 HIGH | HID wacom 驱动越界读取漏洞 |
| CVE-2026-98454 | 8.1 HIGH | SMB 客户端创建上下文越界读取漏洞 |
| CVE-2026-98532 | 8.1 HIGH | Linux IPv6 协议栈越界读取漏洞 |
| CVE-2026-98491 | 7.8 HIGH | Open vSwitch 连接跟踪数据项修改漏洞 |
| CVE-2026-98524 | 7.8 HIGH | RDS IB 映射 MR 失败时 SG 列表未清零漏洞 |
| CVE-2026-98487 | 7.8 HIGH | Linux 网桥 MDB 远程拒绝服务漏洞 |
| CVE-2026-98520 | 7.8 HIGH | Linux 内核 drm/amdkfd 释放后使用漏洞 |
| CVE-2026-98517 | 7.8 HIGH | Linux 内核 nouveau 驱动 UAF 漏洞 |
| CVE-2026-98436 | 7.8 HIGH | AMD XDNA 设备缓冲区导出禁用漏洞 |
| CVE-2026-98515 | 7.8 HIGH | Nouveau 驱动双重释放漏洞 |
| CVE-2026-98510 | 7.8 HIGH | Intel Xe DRM 竞态条件漏洞 |
| CVE-2026-98441 | 7.8 HIGH | Linux Kernel 网络调度器竞态条件漏洞 |
| CVE-2026-98442 | 7.8 HIGH | Linux 内核 act_ct 扩展重分配导致 UAF 漏洞 |
| CVE-2026-98507 | 7.8 HIGH | Linux 内核匿名 VMA 初始化竞态条件漏洞 |
显示前 20 条，共 435 条。 查看全部 → →