{"id":3382,"date":"2026-09-04T04:59:40","date_gmt":"2026-09-03T20:59:40","guid":{"rendered":"https:\/\/www.54iter.cn\/?p=3382"},"modified":"2026-09-04T04:59:40","modified_gmt":"2026-09-03T20:59:40","slug":"cve-2026-80730","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80730","title":{"rendered":"CVE-2026-80730 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix cras"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ring-buffer: Fix crash passing ERR_PTR to kthread_stop()<\/p>\n<p>In test_ringbuffer()&#8217;s out_free cleanup loop, the check<br \/>\n`!rb_threads[cpu]` only catches NULL entries and misses entries that<br \/>\nhold an ERR_PTR.<\/p>\n<p>rb_threads[] is static, so unassigned slots are NULL. But when<br \/>\nkthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or<br \/>\n-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.<br \/>\nThat entry is non-NULL, so the old `!ptr` check does not break, and the<br \/>\ncleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()<br \/>\nthen dereferences the bogus pointer, crashing the kernel during the<br \/>\nlate_initcall self-test.<\/p>\n<p>crash logs:<br \/>\n  BUG: kernel NULL pointer dereference, address: 000000000000001c<br \/>\n  Oops: 0002 [#1] SMP NOPTI<br \/>\n  CPU: 1 PID: 1 Comm: swapper\/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy)<br \/>\n  RIP: 0010:kthread_stop+0x2e\/0x220<br \/>\n  RBX: fffffffffffffff4<br \/>\n  CR2: 000000000000001c<br \/>\n  Call Trace:<\/p>\n<p>   test_ringbuffer+0x1ec\/0x650<br \/>\n   do_one_initcall+0x6c\/0x2c0<br \/>\n   kernel_init_freeable+0x21d\/0x420<br \/>\n   kernel_init+0x15\/0x1c0<br \/>\n   ret_from_fork+0x21b\/0x320<\/p>\n<p>  Kernel panic &#8211; not syncing: Fatal exception<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ring-buffer: Fix crash passing ERR_PTR to kthread_stop()<\/p>\n<p>In test_ringbuffer()&#8217;s out_free cleanup loop, the check<br \/>\n`!rb_threads[cpu]<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-3382","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/3382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}