Abacwaningi bezokuphepha abavela ku-Google bathole ubuthakathaka ku-kernel Linux Kukhona ubuthakathaka bokwenyusa amalungelo (CVE-2025-38236). Phakathi kwezinye izinto, ubuthakathaka buvumela ukudlula indlela yokuhlukanisa i-sandbox esetshenziswa ku-Google Chrome nokufeza ukwenziwa kwekhodi yezinga le-kernel lapho kwenziwa ikhodi kumongo wenqubo yokunikeza i-sandboxed ye-Chrome (isibonelo, ngokusebenzisa obunye ubuthakathaka ku-Chrome). Inkinga ibonakala iqala ku-kernel. Linux 6.9 futhi ilungisiwe kuzibuyekezo ze-kernel Linux 6.1.143, 6.6.96, 6.12.36 kanye no-6.15.5. I-prototype yokuxhaphaza iyatholakala ukuze ilandwe.
Ubuthakathaka bubangelwa iphutha lokusetshenziswa kuflegi le-MSG_OOB, elingasethwa kuma-socket e-AF_UNIX. Iflegi le-MSG_OOB ("ngaphandle kwebhendi") livumela i-byte eyengeziwe ukuthi ifakwe kudatha ethunyelwayo, umamukeli angayifunda ngaphambi kokuthola yonke idatha. Leli flegi lengezwe ku-kernel. Linux Umthethosivivinywa i-5.15 wacelwa yi-Oracle futhi waphakanyiswa ukuthi ungasetshenziswa ngonyaka odlule njengoba ungazange wamukelwe kabanzi.
Ukusebenzisa i-sandbox ye-Chrome kuvumele ukusebenza kwesokhethi ye-UNIX kanye namakholi wesistimu yokuthumela()/recv() lapho ifulegi le-MSG_OOB lalivunyelwe kanye nezinye izinketho futhi lingazange lihlungwe ngokuhlukana. Isiphazamisi ekusetshenzisweni kwe-MSG_OOB sivumele isimo sokusebenzisa ngemva kokukhululeka ukuthi senzeke ngemva kokwenza izingcingo zesistimu ezilandelanayo: char dummy; amasokisi [2]; i-socketpair(AF_UNIX, SOCK_STREAM, 0, amasokisi); send(amasokisi[1], "A", 1, MSG_OOB); recv(amasokisi[0], &dummy, 1, MSG_OOB); send(amasokisi[1], "A", 1, MSG_OOB); recv(amasokisi[0], &dummy, 1, MSG_OOB); send(amasokisi[1], "A", 1, MSG_OOB); recv(amasokisi[0], &dummy, 1, 0); recv(amasokisi[0], &dummy, 1, MSG_OOB);
Source: opennet.ru
