Używamy niezbędnych plików cookie do działania DataHouse.pl oraz opcjonalnych cookies do analityki i marketingu. Możesz zaakceptować wszystkie, odrzucić opcjonalne albo skonfigurować zgody.

OK, ZGADZAM SIĘ NIE ZGADZAM SIĘ ZMIENIAM ZGODY

Dzięki plikom cookies i podobnym technologiom (zwanym dalej „plikami cookies”) możemy poprawiać funkcjonalność naszej strony oraz wyświetlać treści dopasowane do Twoich potrzeb i oczekiwań.

Więcej informacji na temat wykorzystywania plików cookies znajdziesz w naszej [Polityce plików cookies].

Wyrażam zgodę na:

Analityczne wykorzystywanie plików cookies

Marketingowe wykorzystywanie plików cookies

Wykorzystywanie niezbędnych plików cookies (zawsze aktywne)

Twoje preferencje dotyczące plików cookies, wyrażone po zalogowaniu do serwisu, zostaną przypisane do Twojego konta Datahouse.pl. Dzięki temu zostaną zachowane także wtedy, gdy zalogujesz się na swoje konto z innego urządzenia lub przeglądarki.

POTWIERDŹ WYBÓR ANULUJ

CVE-2026-31395: linux kernel vulnerability

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in bnxt_async_event_process() uses a firmware-supplied 'type' field directly as an index into bp->bs_trace[] without bounds validation. The 'type' field is a 16-bit value extracted from DMA-mapped completion ring memory that the NIC writes directly to host RAM. A malicious or compromised NIC can supply any value from 0 to 65535, causing an out-of-bounds access into kernel heap memory. The bnxt_bs_trace_check_wrap() call then dereferences bs_trace->magic_byte and writes to bs_trace->last_offset and bs_trace->wrapped, leading to kernel memory corruption or a crash. Fix by adding a bounds check and defining BNXT_TRACE_MAX as DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 to cover all currently defined firmware trace types (0x0 through 0xc).

CVE-2026-31395CVSS 7.1Linux

CVE-2026-31395: linux kernel vulnerability

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in bnxt_async_event_process() uses a firmware-supplied 'type' field directly as an index into bp->bs_trace[] without bounds validation. The 'type' field is a 16-bit value extracted from DMA-mapped completion ring memory that the NIC writes directly to host RAM. A malicious or compromised NIC can supply any value from 0 to 65535, causing an out-of-bounds access into kernel heap memory. The bnxt_bs_trace_check_wrap() call then dereferences bs_trace->magic_byte and writes to bs_trace->last_offset and bs_trace->wrapped, leading to kernel memory corruption or a crash. Fix by adding a bounds check and defining BNXT_TRACE_MAX as DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 to cover all currently defined firmware trace types (0x0 through 0xc).

CVSS: 7.1 HIGH
EPSS: 1.85%
Aktywnie wykorzystywana: brak w KEV
Produkt: linux kernel

Co wiadomo

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in bnxt_async_event_process() uses a firmware-supplied 'type' field directly as an index into bp->bs_trace[] without bounds validation. The 'type' field is a 16-bit value extracted from DMA-mapped completion ring memory that the NIC writes directly to host RAM. A malicious or compromised NIC can supply any value from 0 to 65535, causing an out-of-bounds access into kernel heap memory. The bnxt_bs_trace_check_wrap() call then dereferences bs_trace->magic_byte and writes to bs_trace->last_offset and bs_trace->wrapped, leading to kernel memory corruption or a crash. Fix by adding a bounds check and defining BNXT_TRACE_MAX as DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 to cover all currently defined firmware trace types (0x0 through 0xc).

Źródła

Wróć do centrum bezpieczeństwa Skontaktuj się z DataHouse