CVE-2026-90327: phonet: pep: do not write beyond optlen in getsockopt
In the Linux kernel, the following vulnerability has been resolved:
phonet: pep: do not write beyond optlen in getsockopt
pepgetsockopt() clamps the reported length to the caller's buffer with mint(), but then stores the value with putuser(val, (int user ) optval), which always writes sizeof(int) bytes. A getsockopt() call with an optlen smaller than sizeof(int) thus reports the clamped length yet writes a full int, one to three bytes past the user buffer.
Write the value with copytouser() bounded by len, so at most optlen bytes are copied, matching the length reported back to userspace.
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds write?
A local caller must invoke getsockopt() through the Phonet PEP socket path with an optval buffer length smaller than sizeof(int). The vulnerable code can then write a full integer despite reporting the shorter, clamped length.
How large is the overwrite?
The write can extend one to three bytes beyond the caller-provided userspace buffer, depending on the supplied optlen. The write is bounded to the size of an int, but not to the supplied buffer length.
How can this be mitigated before the fix is applied?
Avoid calling the affected PEP getsockopt() operation with an optlen smaller than sizeof(int). Callers should provide an optval buffer and optlen of at least sizeof(int) until the corrected bounded copy behavior is available.