In the Linux kernel, the following vulnerability has been resolved:
CDC-NCM: avoid overflow in sanity checking
A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade python-perfUpgrade python-perf-debuginfo | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Aug 23, 2024 | Aug 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 22, 2024 |
| Ubuntu | — | Upgrade linux-image-4.15.0-231-genericUpgrade linux-image-5.4.0-202-genericUpgrade linux-image-virtualUpgrade linux-image-bluefieldUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-ibmUpgrade linux-image-4.15.0-1158-kvmUpgrade linux-image-gcpUpgrade linux-image-raspi2Upgrade linux-image-azure-lts-18.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-azure-lts-20.04Upgrade linux-image-4.15.0-1183-azureUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-oem-osp1Upgrade linux-image-4.4.0-261-genericUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1124-kvmUpgrade linux-image-4.15.0-1137-oracleUpgrade linux-image-5.4.0-1140-gcpUpgrade linux-image-4.15.0-1175-awsUpgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-1135-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-gkeUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-5.4.0-202-generic-lpaeUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-awsUpgrade linux-image-oracleUpgrade linux-image-5.4.0-1083-ibmUpgrade linux-image-5.4.0-1096-bluefieldUpgrade linux-image-4.4.0-1138-awsUpgrade linux-image-4.15.0-231-lowlatencyUpgrade linux-image-5.4.0-1120-raspiUpgrade linux-image-aws-lts-20.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.4.0-1136-awsUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1045-iotUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-azureUpgrade linux-image-aws-hweUpgrade linux-image-4.4.0-1176-awsUpgrade linux-image-4.4.0-1139-kvmUpgrade linux-image-4.15.0-1168-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-raspiUpgrade linux-image-oemUpgrade linux-image-5.4.0-1055-xilinx-zynqmpUpgrade linux-image-5.4.0-202-lowlatencyUpgrade linux-image-4.4.0-261-lowlatencyUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1142-azureUpgrade linux-image-aws-lts-18.04Upgrade linux-image-generic | Nov 19, 2024 | Aug 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Aug 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub