目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-98959— btrfs 扩展属性替换处理远程代码执行漏洞

一分钟漏洞结论

影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

在 Linux 内核中，以下漏洞已得到修复： btrfs：修复当多个扩展属性（xattr）被打包在同一个条目中时，替换 xattr 值的问题 如果一个 条目打包了多个扩展属性（xattr），随后我们使用 系列系统调用将其中某个属性的值替换为长度不同的新值，最终会导致 结构体未完全初始化。这种未初始化状态会在 extent buffer（扩展缓冲区）写回时引发数据损坏，并被树检查器（tree checker）检测到。 出现此问题的原因是：在 函数中，当发现某个 包含多个 xattr（这是因为这些 xattr 名称的

CVSS 9.8 · Critical EPSS 0.21% · P10

可能的 ATT&CK 技术 1 AI

T1562.005

影响版本矩阵 20

厂商产品 版本范围状态
Linux Linux 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339< 7a53bb4668b319fc6c8a3ce2c21635125c7d2712 affected
5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339< 5877d7138cc4359d26fd7b010eedfd1b3162348f affected
5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339< a97114b9b00ed3d05156f3b2ddbf797296260389 affected
5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339< c1803697a60f22743aa28ad522f805e92d45e3f0 affected
5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339< 858bee1c77857aabcc2327cd32dd8266332de332 affected
43f2e3615d181a7028ab797114c5960977669b2a affected
a873146ce4fb025c0b5c1322af5a6bad042f5363 affected
02590fd855d1690568b2fa439c942e933221b57a affected
… +12 条更多
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-98959 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
btrfs: fix xattr replace when multiple xattrs are packed in the same item
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item that packs multiple xattrs and then we replace the value of one of them (with the setxattr(2) family of syscalls) with another value of a different size, we end up not having a fully initialized btrfs_dir_item, resulting in a corruption that the tree checker will detect at extent buffer writeback time. This is because in btrfs_setxattr() when we find a btrfs_dir_item with multiple xattrs (due to the crc32c hash of their name being the same) we delete one of the xattr items (btrfs_dir_item) and then insert a new one, but the deletion and insertion results in shifting existing data in the leaf and therefore when the new value of a xattr has a different size, the new btrfs_dir_item is placed in a leaf section that was not initialized and we only copy the value's data and set the value's length in the new btrfs_dir_item, without setting the name, the name's length, the key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and transaction ID. The following script reproduces the issue: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi mkfs.btrfs -f $DEV mount $DEV $MNT touch $MNT/testfile # Add two xattrs that, on btrfs, have the same hash (crc32c) for their # name and therefore are packed into the same btrfs_dir_item. setfattr -n user.foobar -v 123 $MNT/testfile setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile # Verify the xattrs are present. echo "xattrs before:" getfattr --absolute-names --dump $MNT/testfile # Now replace the value of the foobar xattr with a significantly larger # value. setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile # Check the xattrs have the expected values. echo "xattrs after:" getfattr --absolute-names --dump $MNT/testfile umount $MNT Running it: $ ./test.sh (...) xattrs before: # file: /mnt/sdi/testfile user.WvG1c1Td="qwerty" user.foobar="123" xattrs after: # file: /mnt/sdi/testfile user.WvG1c1Td="qwerty" So the "user.foobar" xattr is missing and there was a transaction abort when unmounting the fs with the following traces in dmesg: $ dmesg [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964 [869800.159293] ------------[ cut here ]------------ [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179 [869800.168961] Modules linked in: btrfs dm_thin_pool (...) [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G W 7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full) [869800.193726] Tainted: [W]=WARN [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs] [869800.198985] Code: 48 8b 7b 18 (...) [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246 [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000 [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0 [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069 [869800.229097] FS: 00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000 [869800.231137] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0 [869800.233783] Call Trace: [869800.234330] <TASK> [869800.234791] read_extent_buffer+0x4d/0x100 [btrfs] [869800.235898] btrfs_listxattr+0x199/0x240 [btrfs] [869800.236912] vfs_listxattr+0x51/0 ---truncated---
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
Linux Linux 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 ~ 7a53bb4668b319fc6c8a3ce2c21635125c7d2712 -
Linux Linux 3.19 -

二、漏洞 CVE-2026-98959 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-98959 的情报信息

请登录查看更多情报信息。

CVE-2026-98959 补丁与修复 (5)

同批安全公告 · Linux · 2026-10-23 · 共 218 条

CVE-2026-99078 9.8 CRITICAL Mellanox mlx5e MPWQE重试时XSK缓冲区释放漏洞
CVE-2026-99079 9.8 CRITICAL Mellanox mlx5e 驱动 XSK 缓冲区释放漏洞
CVE-2026-98870 8.8 HIGH ksmbd 会话清理时存在通道移除逻辑漏洞
CVE-2026-98980 8.8 HIGH namei 遍历中过度挂载条目信息泄露漏洞
CVE-2026-98981 8.8 HIGH Linux 内核命名空间 dentry 解挂载前未哈希漏洞
CVE-2026-99083 8.8 HIGH ksmbd 的 krb5_authenticate() 函数堆越界写漏洞
CVE-2026-98988 8.8 HIGH Linux 5.13 命名空间越界漏洞
CVE-2026-99082 8.8 HIGH KVM x86 内存管理漏洞
CVE-2026-99042 8.4 HIGH io_uring 24 字节 sockaddr_in6 过滤字段填充漏洞
CVE-2026-98978 8.4 HIGH Linux 命名空间 锁定挂载永不失效漏洞
CVE-2026-99064 8.1 HIGH CIPSO 缓存选项偏移调整漏洞
CVE-2026-98968 8.1 HIGH AMT 中继通用查询远程代码执行漏洞
CVE-2026-99051 7.8 HIGH fsverity 信息结构释放延迟漏洞
CVE-2026-98889 7.8 HIGH iwlwifi 驱动调度扫描 IE 大小计算漏洞
CVE-2026-98944 7.8 HIGH Steam HID 注册重构漏洞
CVE-2026-99056 7.8 HIGH strparser 解析器关闭时竞态条件漏洞
CVE-2026-98999 7.8 HIGH Intel Xe DRM 驱动程序链接表项失效漏洞
CVE-2026-99054 7.8 HIGH Linux TIPC 拓扑服务队列资源泄漏漏洞
CVE-2026-98993 7.8 HIGH Linux 内核命名空间 clone_mnt 挂载点继承漏洞
CVE-2026-98899 7.8 HIGH Linux netfilter ipset 竞态条件漏洞

显示前 20 条，共 218 条。 查看全部 &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98959

暂无评论

发表评论