¡¾Î£º¦ÌáÐÑ¡¿4118ÔÆ¶¥¼¯ÍŹØÓÚLinux KernelÍâµØÈ¨ÏÞÌáÉýÎó²îCVE-2026-46242(Bad Epoll)µÄΣº¦ÌáÐÑ

0x00 Åä¾°ÏÈÈÝ
¿ËÈÕ£¬4118ÔÆ¶¥¼¯ÍŰ¢¶û·¨ÊµÑéÊÒ¼à²âµ½Linux KernelÖ÷ÏßÐÞ¸´ÁËÒ»¸öÍâµØÈ¨ÏÞÌáÉýÎó²îCVE-2026-46242£¨Bad Epoll£©¡£ÀÖ³ÉʹÓøÃÎó²î²»µ«¿ÉÒÔÔÚLinux×ÀÃæ°æºÍ·þÎñÆ÷°æÉÏ»ñÈ¡rootȨÏÞ£¬»¹¿ÉÒÔÔÚ°²×¿×°±¸ÉÏ»ñÈ¡rootȨÏÞ£¬ÇÒ¿ÉÒÔÔÚChromeäÖȾÆ÷µÄɳÏäÄÚ´¥·¢£¬ÒÔÊǸÃÎó²îµÄÓ°Ïì½Ï´ó£¬ÕâÊÇÓÉÓÚ´ó´ó¶¼LinuxÍâµØÌáȨÎó²îÎÞ·¨ÔÚ°²×¿ÄÚºËÖоÙÐÐʹÓã¬Ò²ÎÞ·¨ÔÚChromeäÖȾÆ÷µÄɳÏäÄÚ´¥·¢¡£Ä¿½ñ£¬´ËÎó²îµÄϸ½Ú¼°ExpÒѾ¹ûÕæ£¬²¿·ÖÖ÷Á÷Linux¿¯ÐаæÒÑÐû²¼Õë¶Ô¸ÃÎÊÌâµÄ²¹¶¡»ò¸üУ¬Òò´Ë£¬ÇëÊÜÓ°ÏìÓû§Á¬Ã¦Æ¾Ö¤ÐÞ¸´½¨Òé¶Ô¸ÃÎó²î¾ÙÐзÀÓù¡£
0x01 Îó²îÐÎò
LinuxÄÚºËÊÇÒ»¸ö¿ªÔ´¡¢ºêÄں˵«Ö§³Ö¶¯Ì¬Ä£¿é¼ÓÔØµÄ²Ù×÷ϵͳ½¹µã£¬ÈÏÕæ¹ÜÀíÓ²¼þ×ÊÔ´²¢ÎªÉϲãÈí¼þÌṩÔËÐÐÇéÐΡ£Ëüͨ¹ýÀú³Ìµ÷Àí¡¢ÄÚ´æ¹ÜÀí¡¢ÐéÄâÎļþϵͳ¡¢ÍøÂçÐÒéÕ»ºÍ×°±¸Çý¶¯µÈÒªº¦×Óϵͳ£¬ÊµÏÖ¶ÔCPU¡¢ÄÚ´æ¡¢´ÅÅ̼°ÍâÉèµÄÁýͳÓëµ÷Àí£¬²¢ÌṩÎȹ̡¢Çå¾²ºÍ¸ßЧµÄ½Ó¿Ú¹©Ó¦ÓóÌÐòʹÓá£ÒÀ¸½¸ß¿ÉÒÆÖ²ÐÔ¡¢¸»ºñµÄÇý¶¯Ö§³ÖºÍǿʢµÄÉçÇøÐ×÷£¬ÆäÒѳÉΪ´ÓǶÈëʽװ±¸µ½³¬µÈÅÌËã»ú¡¢´Ó°²×¿ÏµÍ³µ½ÔÆ·þÎñÆ÷ÆÕ±é½ÓÄɵĻù´¡½¹µã¡£
CVE-2026-46242£¨Bad Epoll£©ÊÇLinux Kernel eventpoll×ÓϵͳµÄÒ»¸öÌõ¼þ¾ºÕùµ¼ÖµÄÊͷźóÖØÓÃUAFÎó²î¡£ÀÖ³ÉʹÓøÃÎó²îµÄÍâµØ¹¥»÷Õß¿ÉÒÔ»ñȡĿµÄϵͳµÄrootȨÏÞ¡£µ±Ò»¸öeventpollÎļþÐÎò·û¼àÊÓÁíÒ»¸öeventpollÎļþÐÎò·ûʱ£¬Í¬Ê±¹Ø±ÕÕâÁ½¸öÎļþÐÎò·û»á´¥·¢fs/eventpoll.cÖеÄÌõ¼þ¾ºÕùÎó²î¡£µ±__ep_remove()º¯ÊýÖ´ÐÐWRITE_ONCE(file->f_ep, NULL)ʱ£¬¶ÔͳһĿµÄÎļþ²¢·¢µÄ__fput()²Ù×÷»áÔÚeventpoll_release()º¯ÊýµÄÎÞËø¿ìËÙ·¾¶Éϼì²âµ½f_ep==NULL£¬´Ó¶øÌø¹ýÖ´ÐÐeventpoll_release_file()º¯Êý£¬Ö±½ÓÊÍ·ÅÄ¿µÄµÄeventpollºÍfile¹¤¾ß¡£__ep_remove()»á¼ÌÐøÍ¨¹ýÖ¸ÕëдÈëÕâЩÒÑÊͷŵŤ¾ß£¬µ¼ÖÂÊͷźóÖØÓÃUAFÎó²î¡£
ËäÈ»¸ÃÎó²îµÄ¾ºÕù´°¿Ú½öÓÐ6ÌõÖ¸Áî×óÓÒ£¬Í¨³£µÄʵÑéÏÕЩ²»¿ÉÄÜÓ®µÃ¾ºÕùÌõ¼þ£¬µ«Îó²îʹÓÿÉÒÔÀ©´ó¾ºÕù´°¿Ú£¬²¢ÔËÐÐÒ»¸öÓÀÔ¶²»»áµ¼ÖÂÄÚºËÍß½âµÄÖØÊÔÑ»·£¬Ê¹Îó²îʹÓÃÀÖ³ÉÂʵִï99%¡£Ê¹ÓÃÌõ¼þ£º1¡¢Capabilities£º²»ÐèÒª2¡¢ÄÚºËÉèÖãºCONFIG_EPOLL3¡¢ÊÇ·ñÐèÒªÓû§ÃüÃû¿Õ¼ä£º·ñ
0x02 Îó²î»ù´¡Ôµ¹ÊÔÓÉÆÊÎö
epollÊÇLinuxµÄI/OÊÂÎñ¶à·¸´ÓûúÖÆ£¬ÔÊÐíµ¥¸ö³ÌÐòͬʱ¼àÊÓ´ó×ÚÎļþÐÎò·ûÓëÍøÂçÅþÁ¬¡£Nginx¡¢Node.js¡¢ChromeµÈÏÕЩËùÓÐÏÖ´ú·þÎñÓëä¯ÀÀÆ÷¶¼ÒÀÀµËü£¬ÇÒÎÞ·¨¹Ø±Õ¡£Bad EpollµÄʵÖÊÊÇÄÚºËÖÐÁ½Ìõ¹¤¾ßÕûÀí·¾¶²¢·¢Ö´ÐÐʱÒý·¢µÄÌõ¼þ¾ºÕù£ºÒ»Ìõ·¾¶Òѽ«Ä³Äں˹¤¾ßÊÍ·Å£¬ÁíÒ»Ìõ·¾¶ÈÔÔÚÏòÆäдÈ룬´Ó¶øµ¼ÖÂÊͷźóÖØÓÃ(UAF)¡£¸ÃÎó²îµÄ´¥·¢Àú³ÌÈçÏÂËùʾ¡£

ÉÏͼ½¨ÉèÁËÁ½¸öepollÎļþÐÎò·ûep_waiterºÍep_target£¬ÆäÖÐep_waiter¼àÊÓep_target¡£¹ØÓÚÿ¸öÎļþÐÎò·ûep_X£¬epoll_X ÊÇÆä½á¹¹Ìåeventpoll£¬file_XÊÇÆä½á¹¹Ìåfile¡£Ïß³ÌBÊÍ·ÅÁËÁ½¸ö¹¤¾ßepoll_targetºÍfile_target£¬¶øÏß³ÌAµÄ__ep_remove()º¯ÊýÈÔÈ»ÒýÓÃËüÃÇ£¬Òò´Ë£¬Ìõ¼þ¾ºÕùµ¼ÖÂÁËÁ½´Î²î±ðµÄÊͷźóÖØÓÃUAF¡£[1]´¦ÊǶԽṹÌåfileµÄ¾ÁϬUAF£¬epi->ffd.file³ÖÓÐÄ¿µÄfile£¬µ«Æäf_countʼÖÕδÔöÌí£¬Òò´Ë£¬__ep_remove()»áÒ»Á¬²Ù×÷ÒÑÊÍ·Å£¨¿ÉÄÜÒѱ»½ÓÄÉ£©µÄfile_target£¬Í¬Ê±³ÖÓÐÆäf_lock¡£is_file_epoll(file)¶ÁÈ¡µÄЧ¹û¼´ÎªUAF¶ÁÈ¡¡£ÈôÊÇÊͷŵÄfileÁ¬Ã¦±»½ÓÄÉΪ·ÇÊÂÎñÂÖѯÎļþ[0]£¬Ôòfree_ephead()»á½« &epoll_target->refsÊͷŵ½¹ýʧµÄ»º´æ£¨kmalloc-192£©ÖУ¬µ¼ÖÂÎÞЧÊÍ·Å[3]¡£[2]´¦ÊǶԽṹÌåeventpollµÄUAF£¨ÔÚÆ«ÒÆÁ¿160×Ö½Ú´¦Ð´Èë 0£¬ÔÚkmalloc-192ÖзÖÅÉ£©¡£hlist_del_rcu(&epi->fllink)ͨ¹ýÐü¿ÕµÄepi->fllink.pprevдÈë*pprev=0£¬¸ÃÖ¸ÕëÖ¸ÏòÒÑÊͷŵÄ&epoll_target->refs£¨ÒÑÊͷŵÄeventpoll¹¤¾ßÄÚ²¿160×Ö½Ú´¦£©¡£Linux Kernel¶Ô´ËÎó²îµÄ²¹¶¡ÈçÏÂËùʾ¡£ÔÚep_remove()µÄ¿ªÍ·£¬Í¨¹ýepi_fget()Ëø¶¨@file£¬²¢ÔÚËø¶¨ÀÖ³Éʱ´¥·¢ÁÙ½çÇø¡£ÓÉÓÚËø¶¨Àֳɣ¬@fileÎÞ·¨µÖ´ïÒýÓüÆÊýΪÁ㣬´Ó¶ø×èÖ¹__fput()µÄÖ´ÐУ¬²¢¼ä½ÓµØ¼á³Ö±»¼àÊÓµÄstruct eventpollÔÚhlist_del_rcu()ºÍf_lockʹÓÃʱ´ú´¦ÓÚÔ˶¯×´Ì¬£¬×îÖչرÕÁ½¸öUAF¡£
0x03 Îó²î±àºÅ
CVE-2026-46242
0x04 Îó²îÆ·¼¶
¸ßΣ
0x05 ÊÜÓ°Ïì°æ±¾
ÊÜÓ°ÏìµÄLinuxÄں˰汾£º58c9b016e128 <= Linux Kernel Commit < a6dc643c693
ÒÑÖªÊÜÓ°ÏìµÄ¿¯Ðа棺Red Hat Enterprise Linux 10Red Hat Enterprise Linux 9Ubuntu 24.04 LTSUbuntu 25.10Ubuntu 26.04 LTSDebian 13 (Trixie)Debian 14 (Forky)ÒÑÖªµÄ°²×¿×°±¸Ó°Ïì¹æÄ££ºGoogle Pixel 10£¨LinuxÄں˰汾6.6¼°ÒÔÉÏ£©£ºÊÜÓ°Ïì¡£Google Pixel 8ºÍÆäËû»ùÓÚLinuxÄÚºË6.1µÄ×°±¸£º²»ÊÜÓ°Ï죬ÓÉÓÚ¸ÃÎó²îÔÚLinuxÄÚºË6.4ÖÐÒýÈë¡£
0x06 ÐÞ¸´½¨Òé
Linux KernelÒÑÐû²¼Õýʽ²¹¶¡£¬½¨ÒéÊÜÓ°ÏìÓû§¾¡¿ì½«Linux KernelÉý¼¶µ½°üÀ¨²¹¶¡µÄÇå¾²°æ±¾¡£
¹Ù·½²¹¶¡Á´½Ó£ºhttps://git.kernel.org/stable/c/a6dc643c69311677c574a0f17a3f4d66a5f3744b¸÷¸öLinux¿¯ÐаæÎó²îͨ¸æÁ´½Ó£ºDebian£ºhttps://security-tracker.debian.org/tracker/CVE-2026-46242Ubuntu£ºhttps://ubuntu.com/security/CVE-2026-46242Red Hat£ºhttps://access.redhat.com/security/cve/cve-2026-46242
ÓÉÓÚLinux KernelµÄepoll×Óϵͳ²Ù×÷ϵͳ¡¢ÍøÂç·þÎñºÍä¯ÀÀÆ÷¶¼ÒÀÀµµÄ½¹µãÄں˹¦Ð§£¬ÎÞ·¨ÏñCopy Fail¼°Æä±äÖÖÎó²îÄÇÑùͨ¹ýÐ¶ÔØÊܹ¥»÷µÄÄ£¿éÀ´¾ÙÐÐÔÝʱ»º½â£¬ÐÞ¸´´ËÎó²îµÄΨһҪÁì¾ÍÊÇÓ¦Óò¹¶¡£¬½«Linux KernelÉý¼¶ÖÁÇå¾²°æ±¾¡£
0x07 ÉùÃ÷
4118ÔÆ¶¥¼¯ÍŰ¢¶û·¨ÊµÑéÊÒÓµÓжԴËͨ¸æµÄÐÞ¸ÄÏ¢ÕùÊÍȨ£¬ÈçÓû×ªÔØ£¬±ØÐè°ü¹Ü´Ëͨ¸æµÄÍêÕûÐÔ¡£ÓÉÓÚÈö²¥¡¢Ê¹ÓôËͨ¸æ¶øÔì³ÉµÄÈκÎЧ¹û£¬¾ùÓÉʹÓÃÕß×Ô¼ºÈÏÕæ£¬4118ÔÆ¶¥¼¯ÍŰ¢¶û·¨ÊµÑéÊÒ²»Îª´Ë¼ç¸ºÈκÎÔðÈΡ£

¾©¹«Íø°²±¸ 11010802026257ºÅ