EUVD-2026-64376
GHSA-gwfv-775p-2rj5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local setsockopt with PR:L; kernel heap out-of-bounds read yields C:H; potential kernel crash yields A:H; no write primitive confirmed so I:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
vcc_setsockopt() contained an ineffective optlen check: if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname)) return -EINVAL;
If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != __SO_SIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copy_from_sockptr() assuming optval contained sufficient space.
Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size.
Fix this by using copy_safe_from_sockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SO_SETCLP matches its sizeof(int) ABI encoding on 64-bit systems.
AnalysisAI
Slab-out-of-bounds read in the Linux kernel's ATM subsystem vcc_setsockopt() exposes kernel heap memory and can crash the kernel for local low-privileged users. The defect stems from a short-circuited optlen validation - when the caller passes a mismatched level parameter, the length check is bypassed entirely, and a secondary path through cgroup BPF setsockopt filters can shrink optlen after a passing check, both leading to copy_from_sockptr() reading beyond the supplied buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local shell access with at minimum low-privilege credentials (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 High score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H accurately reflects the local, low-privilege attack path with high potential for kernel heap disclosure and availability impact via crash. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with a low-privilege shell account opens an ATM virtual circuit socket and calls `setsockopt()` with a deliberately mismatched `level` value and an optval buffer smaller than the expected structure size, bypassing the short-circuited length check and triggering a KASAN slab-out-of-bounds read of kernel heap memory. On systems with cgroup BPF setsockopt filters attached, the attacker instead passes a nominally valid optlen that a BPF filter program reduces before `copy_from_sockptr()` executes, achieving the same out-of-bounds read without needing a mismatched level. … |
| Remediation | Upgrade to a fixed Linux kernel version appropriate for your stable branch: 6.1.183 or later for 6.1.x LTS, 6.6.152 or later for 6.6.x LTS, 6.12.104 or later for 6.12.x LTS, 6.18.45 or later for 6.18.x, 7.1.9 or later for 7.1.x, or 7.2 (mainline). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all systems running Linux with ATM subsystem enabled (check with cat /proc/modules | grep atm). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today