CVE-2026-28529

Katalog CVE

CVSS 7.8 · High EPSS 0,18%

Kerentanan Use After Free pada cryptodev-linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

cryptodev-linux version 1.14 and prior contain a page reference handling flaw in the get_userbuf function of the /dev/crypto device driver that allows local users to trigger use-after-free conditions. Attackers with access to the /dev/crypto interface can repeatedly decrement reference counts of controlled pages to achieve local privilege escalation.

Rincian

Terbit di NVD

25 Maret 2026

Terakhir diubah

17 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cryptodev-linux/cryptodev-linux/pull/104 patch · advisory pihak ketiga
• https://nasm.re/posts/cryptodev-linux-vuln/ advisory pihak ketiga
• https://www.vulncheck.com/advisories/cryptodev-linux-get-userbuf-use-after-free-lpe advisory pihak ketiga
• https://gist.github.com/n4sm/0fd2479e0c23e0fa2f192cd8fda45750 exploit