In the Linux kernel, the following vulnerability has been resolved:
block/ioctl: prefer different overflow check
Running syzkaller with the newly reintroduced signed integer overflow sanitizer shows this report:
[ 62.982337] ------------[ cut here ]------------ [ 62.985692] cgroup: Invalid name [ 62.986211] UBSAN: signed-integer-overflow in ../block/ioctl.c:36:46 [ 62.989370] 9pnet_fd: p9_fd_create_tcp (7343): problem connecting socket to 127.0.0.1 [ 62.992992] 9223372036854775807 + 4095 cannot be represented in type 'long long' [ 62.997827] 9pnet_fd: p9_fd_create_tcp (7345): problem connecting socket to 127.0.0.1 [ 62.999369] random: crng reseeded on system resumption [ 63.000634] GUP no longer grows the stack in syz-executor.2 (7353): 20002000-20003000 (20001000) [ 63.000668] CPU: 0 PID: 7353 Comm: syz-executor.2 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1 [ 63.000677] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.000682] Call Trace: [ 63.000686] <TASK> [ 63.000731] dump_stack_lvl+0x93/0xd0 [ 63.000919] __get_user_pages+0x903/0xd30 [ 63.001030] __gup_longterm_locked+0x153e/0x1ba0 [ 63.001041] ? _raw_read_unlock_irqrestore+0x17/0x50 [ 63.001072] ? try_get_folio+0x29c/0x2d0 [ 63.001083] internal_get_user_pages_fast+0x1119/0x1530 [ 63.001109] iov_iter_extract_pages+0x23b/0x580 [ 63.001206] bio_iov_iter_get_pages+0x4de/0x1220 [ 63.001235] iomap_dio_bio_iter+0x9b6/0x1410 [ 63.001297] __iomap_dio_rw+0xab4/0x1810 [ 63.001316] iomap_dio_rw+0x45/0xa0 [ 63.001328] ext4_file_write_iter+0xdde/0x1390 [ 63.001372] vfs_write+0x599/0xbd0 [ 63.001394] ksys_write+0xc8/0x190 [ 63.001403] do_syscall_64+0xd4/0x1b0 [ 63.001421] ? arch_exit_to_user_mode_prepare+0x3a/0x60 [ 63.001479] entry_SYSCALL_64_after_hwframe+0x6f/0x77 [ 63.001535] RIP: 0033:0x7f7fd3ebf539 [ 63.001551] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 63.001562] RSP: 002b:00007f7fd32570c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 63.001584] RAX: ffffffffffffffda RBX: 00007f7fd3ff3f80 RCX: 00007f7fd3ebf539 [ 63.001590] RDX: 4db6d1e4f7e43360 RSI: 0000000020000000 RDI: 0000000000000004 [ 63.001595] RBP: 00007f7fd3f1e496 R08: 0000000000000000 R09: 0000000000000000 [ 63.001599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.001604] R13: 0000000000000006 R14: 00007f7fd3ff3f80 R15: 00007ffd415ad2b8 ... [ 63.018142] ---[ end trace ]---
Historically, the signed integer overflow sanitizer did not work in the kernel due to its interaction with `-fwrapv` but this has since been changed [1] in the newest version of Clang; It was re-enabled in the kernel with Commit 557f8c582a9ba8ab ("ubsan: Reintroduce signed overflow sanitizer").
Let's rework this overflow checking logic to not actually perform an overflow during the check itself, thus avoiding the UBSAN splat.
[1]: https://github.com/llvm/llvm-project/pull/82432
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade perfUpgrade kernel-livepatch-5.15.162-107.160Upgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernelUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.223-211.872Upgrade kernel-devel | Mar 4, 2025 | Jul 12, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-modules-extraUpgrade bpftool-debuginfoUpgrade kernelUpgrade python3-perfUpgrade perfUpgrade kernel-livepatch-6.1.96-102.177Upgrade kernel-libbpf-develUpgrade python3-perf-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-develUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade bpftool | Mar 10, 2025 | Jul 12, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 17, 2024 | Jul 12, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 16, 2024 | Jul 12, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 12, 2024 |
| Suse | — | Upgrade kernel-rt_debug-vdsoUpgrade dtb-freescaleUpgrade dtb-mediatekUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade kernel-obs-buildUpgrade dtb-alteraUpgrade kernel-rtUpgrade kernel-kvmsmall-develUpgrade kernel-azure-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-optionalUpgrade dtb-lgUpgrade kernel-64kb-livepatch-develUpgrade kernel-source-azureUpgrade reiserfs-kmp-azureUpgrade kernel-rt-develUpgrade kernel-rt-extraUpgrade dtb-exynosUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-azure-optionalUpgrade dtb-amlogicUpgrade kernel-default-livepatchUpgrade kernel-default-vdsoUpgrade kernel-rt-vdsoUpgrade dtb-rockchipUpgrade kernel-source-rtUpgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade kselftests-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-64kbUpgrade dtb-amazonUpgrade gfs2-kmp-rtUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade kernel-azure-develUpgrade kernel-default-develUpgrade kernel-kvmsmallUpgrade dtb-qcomUpgrade kernel-default-extraUpgrade dtb-armUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade kernel-sourceUpgrade cluster-md-kmp-azureUpgrade dtb-apmUpgrade dtb-broadcomUpgrade dtb-sprdUpgrade dtb-appleUpgrade dlm-kmp-rtUpgrade dlm-kmp-azureUpgrade dtb-marvellUpgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade gfs2-kmp-defaultUpgrade dtb-hisiliconUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-symsUpgrade kernel-debugUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-debug-vdsoUpgrade dtb-caviumUpgrade cluster-md-kmp-64kbUpgrade kernel-azureUpgrade kernel-devel-rtUpgrade kernel-64kb-extraUpgrade kernel-azure-extraUpgrade gfs2-kmp-azureUpgrade dtb-socionextUpgrade dtb-renesasUpgrade dlm-kmp-defaultUpgrade dtb-amdUpgrade dtb-nvidiaUpgrade ocfs2-kmp-defaultUpgrade kernel-docsUpgrade kernel-develUpgrade kernel-defaultUpgrade dtb-xilinxUpgrade kselftests-kmp-azureUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-defaultUpgrade kernel-default-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-allwinnerUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatch-develUpgrade kernel-debug-develUpgrade kernel-64kb-optionalUpgrade kernel-64kb-devel | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-121-genericUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.15.0-121-generic-lpaeUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-gkeUpgrade linux-image-awsUpgrade linux-image-oem-22.04bUpgrade linux-image-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-aws-lts-22.04Upgrade linux-image-intelUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-5.15.0-121-lowlatencyUpgrade linux-image-azure-cvmUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-1068-gcpUpgrade linux-image-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-virtualUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-gke-5.15Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-1067-oracleUpgrade linux-image-5.15.0-1072-azureUpgrade linux-image-5.15.0-1052-gkeopUpgrade linux-image-5.15.0-1062-ibmUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibmUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1064-nvidiaUpgrade linux-image-intel-iotgUpgrade linux-image-oracleUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-5.15.0-1066-gkeUpgrade linux-image-azure-fdeUpgrade linux-image-oem-20.04cUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-121-lowlatency-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-5.15.0-1064-nvidia-lowlatencyUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-5.15.0-1066-kvmUpgrade linux-image-5.15.0-121-generic-64kUpgrade linux-image-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-5.15.0-1072-azure-fdeUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-5.15.0-1062-raspiUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1064-intel-iotgUpgrade linux-image-azureUpgrade linux-image-5.15.0-1069-awsUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-kvmUpgrade linux-image-nvidia-6.8Upgrade linux-image-raspiUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-45-generic-64k | Sep 12, 2024 | Jul 12, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub