CVE-2026-99016

Что произошло

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through the "+m" (*uaddr) operand. When the tagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM, prctl PR_SET_TAGGED_ADDR_CTRL with PMLEN != 0), those two addresses differ: a user pointer whose top PMLEN bits hold a tag passes access_ok() after untagging, but the atomic is then performed on the still-tagged raw address. Supervisor-mode data accesses are not subject to the U-mode pointer masking (that is governed by menvcfg.PMM, which the kernel does not set), so hardware does not strip the tag for the kernel's own access. With Sv57 and PMLEN=16 the tag bits overlap the canonical-address bits, so a tagged pointer can name a canonical kernel virtual address (e.g. in the linear map) whose untagged form is a valid user address. An unprivileged process can thus make FUTEX_WAKE_OP perform an atomic read-modify-write on an arbitrary kernel address, with the matching FUTEX_OP_CMP_* result serving as a read oracle. get_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer after the access_ok() check; do the same in the futex helpers so the atomic operates on the address that was actually validated.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "2e1743085887ba3f553c2bb472a75a3ff744b242",
  "lessThan": "2e5c80bbc062a8dda33e687ebf7be8f074ee4f7d",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "2e1743085887ba3f553c2bb472a75a3ff744b242",
  "lessThan": "8e48d8d51ab37b7decfbff3e2844e027a52ad6ea",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "2e1743085887ba3f553c2bb472a75a3ff744b242",
  "lessThan": "405290be962b32eec842776fbe3bdf81f15b1676",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "6.13"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "6.13",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "6.18.57",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.11",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:49.086009+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-28T20:51:05.193593+00:00"
  },
  "scores": [
    "cve"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T20:51:05.193593+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T20:51:05.193593+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:49.086009+00:00"
  },
  "references": [
    "cve"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T20:51:05.193593+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены03.11.2026, 00:15
2. Данные обновлены02.11.2026, 00:13
3. Данные обновлены31.10.2026, 12:00
4. Данные обновлены29.10.2026, 12:47
5. Опубликована28.10.2026, 23:51

Личная заметка и статус

Другие CVE того же продукта