CVE-2026-31769

{"id": "CVE-2026-31769", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9dde4559e93955ccc47d588f7fd051684d55c4e7", "lessThan": "cae26eff1b56d78bed7873cf3e60a2b1bdd4da6c", "versionType": "git"}, {"status": "affected", "version": "9dde4559e93955ccc47d588f7fd051684d55c4e7", "lessThan": "28c75dd143ead62e0dfac564c79d251e21d5d74b", "versionType": "git"}, {"status": "affected", "version": "9dde4559e93955ccc47d588f7fd051684d55c4e7", "lessThan": "d1857f8296dceb75d00ab857fc3c61bc00c7f5c6", "versionType": "git"}], "programFiles": ["drivers/gpib/common/gpib_os.c", "drivers/gpib/include/gpib_types.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpib/common/gpib_os.c", "drivers/gpib/include/gpib_types.h"], "defaultStatus": "affected"}]}], "published": "2026-05-01T15:16:40.090", "references": [{"url": "https://git.kernel.org/stable/c/28c75dd143ead62e0dfac564c79d251e21d5d74b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cae26eff1b56d78bed7873cf3e60a2b1bdd4da6c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d1857f8296dceb75d00ab857fc3c61bc00c7f5c6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpib: fix use-after-free in IO ioctl handlers\n\nThe IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers use a gpib_descriptor\npointer after board->big_gpib_mutex has been released. A concurrent\nIBCLOSEDEV ioctl can free the descriptor via close_dev_ioctl() during\nthis window, causing a use-after-free.\n\nThe IO handlers (read_ioctl, write_ioctl, command_ioctl) explicitly\nrelease big_gpib_mutex before calling their handler. wait_ioctl() is\ncalled with big_gpib_mutex held, but ibwait() releases it internally\nwhen wait_mask is non-zero. In all four cases, the descriptor pointer\nobtained from handle_to_descriptor() becomes unprotected.\n\nFix this by introducing a kernel-only descriptor_busy reference count\nin struct gpib_descriptor. Each handler atomically increments\ndescriptor_busy under file_priv->descriptors_mutex before releasing the\nlock, and decrements it when done. close_dev_ioctl() checks\ndescriptor_busy under the same lock and rejects the close with -EBUSY\nif the count is non-zero.\n\nA reference count rather than a simple flag is necessary because\nmultiple handlers can operate on the same descriptor concurrently\n(e.g. IBRD and IBWAIT on the same handle from different threads).\n\nA separate counter is needed because io_in_progress can be cleared from\nunprivileged userspace via the IBWAIT ioctl (through general_ibstatus()\nwith set_mask containing CMPL), which would allow an attacker to bypass\na check based solely on io_in_progress. The new descriptor_busy\ncounter is only modified by the kernel IO paths.\n\nThe lock ordering is consistent (big_gpib_mutex -> descriptors_mutex)\nand the handlers only hold descriptors_mutex briefly during the lookup,\nso there is no deadlock risk and no impact on IO throughput."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpib: correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en los gestores ioctl de E/S\n\nLos gestores ioctl IBRD, IBWRT, IBCMD e IBWAIT usan un puntero gpib_descriptor despu\u00e9s de que board -> big_gpib_mutex ha sido liberado. Un ioctl IBCLOSEDEV concurrente puede liberar el descriptor a trav\u00e9s de close_dev_ioctl() durante esta ventana, causando un uso despu\u00e9s de liberaci\u00f3n.\n\nLos gestores de E/S (read_ioctl, write_ioctl, command_ioctl) liberan expl\u00edcitamente big_gpib_mutex antes de llamar a su gestor. wait_ioctl() se llama con big_gpib_mutex retenido, pero ibwait() lo libera internamente cuando wait_mask es distinto de cero. En los cuatro casos, el puntero del descriptor obtenido de handle_to_descriptor() queda desprotegido.\n\nEsto se soluciona introduciendo un contador de referencias descriptor_busy solo para el kernel en la estructura gpib_descriptor. Cada gestor incrementa at\u00f3micamente descriptor_busy bajo file_priv -> descriptors_mutex antes de liberar el bloqueo, y lo decrementa al finalizar. close_dev_ioctl() comprueba descriptor_busy bajo el mismo bloqueo y rechaza el cierre con -EBUSY si el contador es distinto de cero.\n\nEs necesario un contador de referencias en lugar de un simple indicador porque m\u00faltiples gestores pueden operar sobre el mismo descriptor concurrentemente (por ejemplo, IBRD e IBWAIT en el mismo identificador desde hilos diferentes).\n\nSe necesita un contador separado porque io_in_progress puede borrarse desde el espacio de usuario sin privilegios a trav\u00e9s del ioctl IBWAIT (mediante general_ibstatus() con set_mask conteniendo CMPL), lo que permitir\u00eda a un atacante eludir una comprobaci\u00f3n basada \u00fanicamente en io_in_progress. El nuevo contador descriptor_busy solo es modificado por las rutas de E/S del kernel.\n\nEl orden de bloqueo es consistente (big_gpib_mutex -> descriptors_mutex) y los gestores solo retienen descriptors_mutex brevemente durante la b\u00fasqueda, por lo que no hay riesgo de interbloqueo ni impacto en el rendimiento de E/S."}], "lastModified": "2026-11-11T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}