UBUNTU-CVE-2026-74689: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt() vccsetsockopt() contained an ineffective optlen check: if (SOLEVELMATCH(optname, level) && optlen != SOSIZE(optname)) return -EINVAL; If SOLEVELMATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != SOSIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copyfromsockptr() assuming optval contained sufficient space. Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copyfromsockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size. Fix this by using copysafefromsockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SOSETCLP matches its sizeof(int) ABI encoding on 64-bit systems.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Change the local `value` variable type from `unsigned long` to `int` so that `SO_SETCLP` matches its `sizeof(int)` ABI encoding on 64-bit systems.
- Compensating control
Use `copy_safe_from_sockptr()` for the copy so that `optlen` is unconditionally validated as at least the expected structure size before copying, including when a cgroup BPF setsockopt filter shrinks `optlen`.