Описание
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro fooling u32_classify(): BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221
Отчет
An out of bounds memory access vulnerability exists in the Linux traffic control u32 classifier implementation. In u32_classify the kernel calculates offsets such as toff using key off values masks and variable offsets and then dereferences packet data using skb_header_pointer. The helper skb_header_pointer does not fully validate negative offset values. With a crafted configuration and packet layout the computed offset can become negative or otherwise invalid in a way that bypasses the existing checks and results in an out of bounds access. The most direct impact is a kernel crash causing a denial of service. Because the access pattern involves reading packet data at attacker influenced offsets it may also allow information disclosure of adjacent kernel memory and in worst cases could contribute to privilege escalation chains. Exploitation prerequisites depend on whether the system has tc u32 filters configured on a traffic path. For the CVSS the base score uses PR:L because configuring tc filters typically requires elevated privileges but can be available in containers or network namespaces with CAP_NET_ADMIN.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:6632 | 06.04.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | kernel | Fixed | RHSA-2026:8342 | 15.04.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | kernel-rt | Fixed | RHSA-2026:10756 | 27.04.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | kernel | Fixed | RHSA-2026:9870 | 22.04.2026 |
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2026:6036 | 30.03.2026 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2026:6037 | 30.03.2026 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | kernel | Fixed | RHSA-2026:9513 | 22.04.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | kernel | Fixed | RHSA-2026:9643 | 22.04.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro fooling u32_classify(): BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro fooling u32_classify(): BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro fooling u32_classify(): BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221
EPSS
7.3 High
CVSS3