CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
In the Linux kernel, the following vulnerability has been resolved:
net/atm: fix slab-out-of-bounds read in vccsetsockopt()
vccsetsockopt() contained an ineffective optlen check: if (SOLEVELMATCH(optname, level) && optlen != SOSIZE(optname)) return -EINVAL;
If SOLEVELMATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != SOSIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copyfromsockptr() assuming optval contained sufficient space.
Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copyfromsockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size.
Fix this by using copysafefromsockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SOSETCLP matches its sizeof(int) ABI encoding on 64-bit systems.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What input conditions can trigger the out-of-bounds read?
The unsafe copy can occur when a caller supplies a mismatched socket-option level, allowing the original option-length check to be bypassed, and provides an optlen smaller than the structure expected for the option. A cgroup BPF setsockopt filter can also shrink optlen after the initial check.
What changes address the issue?
The fix replaces the copy operation with copy_safe_from_sockptr(), which verifies that optlen is at least the required size before copying. It also changes the SO_SETCLP local value type to int so its size matches the sizeof(int) ABI encoding on 64-bit systems.