In the Linux kernel, the following vulnerability has been resolved:
arm64: csum: Fix OoB access in IP checksum code for negative lengths
Although commit c2c24edb1d9c ("arm64: csum: Fix pathological zero-length calls") added an early return for zero-length input, syzkaller has popped up with an example of a _negative_ length which causes an undefined shift and an out-of-bounds read:
| BUG: KASAN: slab-out-of-bounds in do_csum+0x44/0x254 arch/arm64/lib/csum.c:39 | Read of size 4294966928 at addr ffff0000d7ac0170 by task syz-executor412/5975 | | CPU: 0 PID: 5975 Comm: syz-executor412 Not tainted 6.4.0-rc4-syzkaller-g908f31f2a05b #0 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 | Call trace: | dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233 | show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240 | __dump_stack lib/dump_stack.c:88 [inline] | dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 | print_address_description mm/kasan/report.c:351 [inline] | print_report+0x174/0x514 mm/kasan/report.c:462 | kasan_report+0xd4/0x130 mm/kasan/report.c:572 | kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187 | __kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31 | do_csum+0x44/0x254 arch/arm64/lib/csum.c:39 | csum_partial+0x30/0x58 lib/checksum.c:128 | gso_make_checksum include/linux/skbuff.h:4928 [inline] | __udp_gso_segment+0xaf4/0x1bc4 net/ipv4/udp_offload.c:332 | udp6_ufo_fragment+0x540/0xca0 net/ipv6/udp_offload.c:47 | ipv6_gso_segment+0x5cc/0x1760 net/ipv6/ip6_offload.c:119 | skb_mac_gso_segment+0x2b4/0x5b0 net/core/gro.c:141 | __skb_gso_segment+0x250/0x3d0 net/core/dev.c:3401 | skb_gso_segment include/linux/netdevice.h:4859 [inline] | validate_xmit_skb+0x364/0xdbc net/core/dev.c:3659 | validate_xmit_skb_list+0x94/0x130 net/core/dev.c:3709 | sch_direct_xmit+0xe8/0x548 net/sched/sch_generic.c:327 | __dev_xmit_skb net/core/dev.c:3805 [inline] | __dev_queue_xmit+0x147c/0x3318 net/core/dev.c:4210 | dev_queue_xmit include/linux/netdevice.h:3085 [inline] | packet_xmit+0x6c/0x318 net/packet/af_packet.c:276 | packet_snd net/packet/af_packet.c:3081 [inline] | packet_sendmsg+0x376c/0x4c98 net/packet/af_packet.c:3113 | sock_sendmsg_nosec net/socket.c:724 [inline] | sock_sendmsg net/socket.c:747 [inline] | __sys_sendto+0x3b4/0x538 net/socket.c:2144
Extend the early return to reject negative lengths as well, aligning our implementation with the generic code in lib/checksum.c
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.196-185.743Upgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernelUpgrade kernel-livepatch-5.15.133-86.144Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-headers | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.55-75.123Upgrade python3-perfUpgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade kernel-develUpgrade perf | Nov 6, 2025 | Oct 22, 2025 |
| Debian | — | Upgrade linux | Oct 24, 2025 | Oct 24, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Nov 14, 2025 | Oct 22, 2025 |
| Ubuntu | — | Upgrade linux-gkeUpgrade linux-intel-iotgUpgrade linux-xilinx-zynqmpUpgrade linux-gcp-fipsUpgrade linux-lowlatencyUpgrade linux-ibm-5.15Upgrade linux-riscv-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-fipsUpgrade linuxUpgrade linux-oracle-5.15Upgrade linux-gkeopUpgrade linux-nvidiaUpgrade linux-oracleUpgrade linux-ibmUpgrade linux-gcp-5.15Upgrade linux-azure-5.15Upgrade linux-aws-fipsUpgrade linux-kvmUpgrade linux-intel-iotg-5.15Upgrade linux-bluefieldUpgrade linux-nvidia-tegraUpgrade linux-raspiUpgrade linux-intel-iot-realtimeUpgrade linux-awsUpgrade linux-aws-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-gcpUpgrade linux-realtimeUpgrade linux-nvidia-tegra-5.15Upgrade linux-azureUpgrade linux-hwe-5.15 | Oct 28, 2025 | Oct 24, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Oct 22, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub