CVE-2026-43322

Linux 커널에서는 다음 취약점이 해결되었습니다.

블루투스: hci_sync: le_read_features_complete에서 UAF 수정

이는 hci_conn이 해제되어 발생하는 다음 역추적을 수정합니다. le_read_features_complete 이전, 이후 hci_le_read_remote_features_sync 그래서 hci_conn_del -> hci_cmd_sync_dequeue 이를 방지할 수 없습니다.

================================================================ 버그: KASAN: Instrument_atomic_read_write의 slab-use-after-free include/linux/instrumented.h:96 [인라인] 버그: KASAN:omic_dec_and_test의 slab-use-after-free include/linux/atomic/atomic-instrumented.h:1383 [인라인] 버그: KASAN: hci_conn_drop include/net/bluetooth/hci_core.h:1688 [인라인]의 slab-use-after-free 버그: KASAN: le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344에서 slab-use-after-free kworker/u9:0/52 작업으로 addr ffff8880796b0010에 크기 4 쓰기

CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 오염되지 않음 syzkaller #0 PREEMPT(전체) 하드웨어 이름: Google Google Compute Engine/Google Compute Engine, BIOS Google 2025년 10월 25일 작업 대기열: hci0 hci_cmd_sync_work 통화 추적: <과제> __dump_stack lib/dump_stack.c:94 [인라인] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [인라인] print_report+0xcd/0x630mm/kasan/report.c:482 kasan_report+0xe0/0x110mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:194 [인라인] kasan_check_range+0x100/0x1b0mm/kasan/generic.c:200 Instrument_atomic_read_write include/linux/instrumented.h:96 [인라인] omic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [인라인] hci_conn_drop include/net/bluetooth/hci_core.h:1688 [인라인] le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344 hci_cmd_sync_work+0x1ff/0x430 net/bluetooth/hci_sync.c:334 process_one_work+0x9ba/0x1b20 커널/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [인라인] 작업자_스레드+0x6c8/0xf10 커널/workqueue.c:3421 kthread+0x3c5/0x780 커널/kthread.c:463 ret_from_fork+0x983/0xb10 아치/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 아치/x86/entry/entry_64.S:246

작업 5932에 의해 할당됨: kasan_save_stack+0x33/0x60mm/kasan/common.c:56 kasan_save_track+0x14/0x30mm/kasan/common.c:77 Poison_kmalloc_redzone mm/kasan/common.c:400 [인라인] __kasan_kmalloc+0xaa/0xb0mm/kasan/common.c:417 kmalloc_noprof include/linux/slab.h:957 [인라인] kzalloc_noprof include/linux/slab.h:1094 [인라인] __hci_conn_add+0xf8/0x1c70 net/bluetooth/hci_conn.c:963 hci_conn_add_unset+0x76/0x100 net/bluetooth/hci_conn.c:1084 le_conn_complete_evt+0x639/0x1f20 net/bluetooth/hci_event.c:5714 hci_le_enh_conn_complete_evt+0x23d/0x380 net/bluetooth/hci_event.c:5861 hci_le_meta_evt+0x357/0x5e0 net/bluetooth/hci_event.c:7408 hci_event_func net/bluetooth/hci_event.c:7716 [인라인] hci_event_packet+0x685/0x11c0 net/bluetooth/hci_event.c:7773 hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076 process_one_work+0x9ba/0x1b20 커널/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [인라인] 작업자_스레드+0x6c8/0xf10 커널/workqueue.c:3421 kthread+0x3c5/0x780 커널/kthread.c:463 ret_from_fork+0x983/0xb10 아치/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 아치/x86/entry/entry_64.S:246

작업 5932에 의해 해제됨: kasan_save_stack+0x33/0x60mm/kasan/common.c:56 kasan_save_track+0x14/0x30mm/kasan/common.c:77 __kasan_save_free_info+0x3b/0x60mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [인라인] Poison_slab_object mm/kasan/common.c:252 [인라인] __kasan_slab_free+0x5f/0x80mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [인라인] slab_free_hook mm/slub.c:2540 [인라인] slab_free mm/slub.c:6663 [인라인] kfree+0x2f8/0x6e0mm/slub.c:6871 device_release+0xa4/0x240 drivers/base/core.c:2565 kobject_cleanup lib/kobject.c:689 [인라인] kobject_release lib/kobject.c:720 [인라인] kref_put include/linux/kref.h:65 [인라인] kobject_put+0x1e7/0x590 lib/kobject. ---잘림---