CVE-2026-99180— Unicode 延迟释放内存漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，以下漏洞已得到修复： unicode：在宽限期（grace period）过后释放映射表 和 函数会读取 并解引用 unicode 映射表，而此时处于 RCU 模式的路径遍历（pathwalk）仅持有 。使用这些函数的文件系统（ext4、f2fs 和 tmpfs）会在 中通过 释放映射表，而该函数仅在挂载点的最后一个引用消失时执行。若此时仍有查找操作正在该文件系统内部进行，则可能读取到已被释放的映射表，从而引发问题。 当路径遍历被阻塞在 中，而 casefold 模式的 tmpfs 的最后一
影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | b886ee3e778ec2ad43e276fd378ab492cf6819b7< 092e14e1479a39157ca01668d43e4649793f39ed |
affected |
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 6472455f2b015cad43adb790cb63fe1d3cff2f57 |
affected | ||
b886ee3e778ec2ad43e276fd378ab492cf6819b7< f96c2731a105d6663c606388f5dc21781e00ade5 |
affected | ||
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07 |
affected | ||
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 69a0d6b31d05e856c7335509222f25321e3c69ca |
affected | ||
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8 |
affected | ||
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 6560c3d9a6925e3747d9ad8463e16010c31ba715 |
affected | ||
b886ee3e778ec2ad43e276fd378ab492cf6819b7< a96c5299bd7305eb984377681eb3222a57376405 |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-99180 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
unicode: free the map after a grace period
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
unicode: free the map after a grace period
generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and
dereference the unicode map while a pathwalk in rcu mode holds nothing
but rcu_read_lock(). The filesystems that use them, ext4, f2fs and
tmpfs, drop the map with utf8_unload() from ->put_super(), which runs
when the last reference to the mount goes away. A lookup that is still
inside such a filesystem at that point reads a freed map.
With a pathwalk held up in utf8_casefold_hash() while the last reference
to a casefolded tmpfs goes away:
BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950
Read of size 8 at addr ff110001030fe658 by task walker/98
Call Trace:
<TASK>
utf8nlookup+0x74c/0x950
utf8byte+0x160/0x1560
utf8_casefold_hash+0x167/0x230
generic_ci_d_hash+0xdd/0x1c0
link_path_walk+0x11ad/0x1d30
path_lookupat+0x63/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
[...]
Allocated by task 94:
__kmalloc_cache_noprof+0x249/0x560
utf8_load+0x4e/0x570
shmem_parse_opt_casefold.isra.0+0x92/0x270
[...]
Freed by task 97:
kfree+0x1db/0x5b0
shmem_put_super+0x72/0x170
generic_shutdown_super+0x14c/0x530
kill_anon_super+0x3a/0x60
deactivate_locked_super+0x9c/0xf0
cleanup_mnt+0x9f/0x130
So far that has been hard to hit. umount(2) waits for a grace period
in namespace_unlock() before it drops the mount, so only a mount whose
last reference goes away elsewhere, like the close of a file or a chdir
out of a lazily unmounted directory, can race a walker. So it is
reachable.
Delay the free until a grace period has passed. The map and the data
table it holds a reference to then outlive any pathwalk that found the
superblock before the mount went away. The reference on the data table
module is dropped from the rcu callback as well. utf8-core is built in
whenever CONFIG_UNICODE is set, so there is no module exit that would
have to wait for the callbacks.
Overlayfs points the s_encoding of an overlay at the map of its first
layer without taking a reference of its own. That stays correct. The
layer is held by the overlay, so its map is dropped only after the
overlay is gone.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-99180 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-99180 的情报信息
请登录查看更多情报信息。
CVE-2026-99180 补丁与修复 (5)
同批安全公告 · Linux · 2026-10-28 · 共 117 条
| CVE-2026-99153 | 9.8 CRITICAL | libiscsi 拒绝 PDU 验证逻辑漏洞 |
| CVE-2026-99154 | 9.8 CRITICAL | libiscsi 负任务索引拒绝漏洞 |
| CVE-2026-99170 | 8.8 HIGH | Linux 内核 namespace 锁竞争漏洞 |
| CVE-2026-99185 | 8.8 HIGH | Firewire 核心拆分事务处理竞态条件漏洞 |
| CVE-2026-99216 | 8.4 HIGH | Windows 驱动 VMBus 拒绝服务漏洞 |
| CVE-2026-99131 | 8.2 HIGH | XFS 文件系统权限检查绕过漏洞 |
| CVE-2026-99117 | 7.8 HIGH | Linux 内核网桥多播端口组遍历截断漏洞 |
| CVE-2026-99116 | 7.8 HIGH | Linux 内核 psp 驱动克隆时继承 Rx 关联漏洞 |
| CVE-2026-99163 | 7.8 HIGH | tracing/histograms 合成堆栈字段拒绝漏洞 |
| CVE-2026-99143 | 7.8 HIGH | Linux 内核 tracing 组件越界访问漏洞 |
| CVE-2026-99164 | 7.8 HIGH | imx SPI 驱动因 DMA 缓冲区过小导致内存损坏漏洞 |
| CVE-2026-99109 | 7.8 HIGH | Samba SMB 客户端拒绝无效 SetEA 请求漏洞 |
| CVE-2026-99167 | 7.8 HIGH | Linux 内核 net/sched 释放后使用漏洞 |
| CVE-2026-99173 | 7.8 HIGH | eventfs 释放 inode 过早导致竞态条件漏洞 |
| CVE-2026-99177 | 7.8 HIGH | KVM SEV sev_gmem_post_populate 内存页污染漏洞 |
| CVE-2026-99203 | 7.8 HIGH | pipe 管道写入失败时保留 fasync 读者漏洞 |
| CVE-2026-99213 | 7.8 HIGH | Linux vsock 状态处理漏洞 |
| CVE-2026-99156 | 7.8 HIGH | Linux SCSI st 驱动 use-after-free 漏洞 |
| CVE-2026-99107 | 7.8 HIGH | NTFS 文件系统内存破坏漏洞 |
| CVE-2026-99152 | 7.5 HIGH | libiscsi 管理响应任务验证绕过漏洞 |
显示前 20 条，共 117 条。 查看全部 → →