In the Linux kernel, the following vulnerability has been resolved:
CDC-NCM: avoid overflow in sanity checking
A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernelUpgrade python-perfUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade python-perf-debuginfoUpgrade kernel-tools-devel | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Aug 23, 2024 | Aug 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 22, 2024 |
| Ubuntu | — | Upgrade linux-image-4.4.0-1138-awsUpgrade linux-image-5.4.0-1120-raspiUpgrade linux-image-4.4.0-261-lowlatencyUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-4.4.0-1139-kvmUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-genericUpgrade linux-image-5.4.0-1055-xilinx-zynqmpUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1096-bluefieldUpgrade linux-image-aws-hweUpgrade linux-image-oemUpgrade linux-image-5.4.0-1142-azureUpgrade linux-image-5.4.0-1083-ibmUpgrade linux-image-aws-lts-18.04Upgrade linux-image-4.15.0-1168-gcpUpgrade linux-image-4.4.0-1176-awsUpgrade linux-image-azureUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1045-iotUpgrade linux-image-5.4.0-1136-awsUpgrade linux-image-raspiUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.15.0-231-lowlatencyUpgrade linux-image-5.4.0-202-lowlatencyUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-4.15.0-1183-azureUpgrade linux-image-oem-osp1Upgrade linux-image-virtualUpgrade linux-image-5.4.0-1135-oracleUpgrade linux-image-ibmUpgrade linux-image-5.4.0-1140-gcpUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-raspi2Upgrade linux-image-gcpUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-kvmUpgrade linux-image-bluefieldUpgrade linux-image-generic-lpaeUpgrade linux-image-4.15.0-1158-kvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.15.0-1137-oracleUpgrade linux-image-5.4.0-202-genericUpgrade linux-image-4.15.0-1175-awsUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-4.15.0-231-genericUpgrade linux-image-4.4.0-261-genericUpgrade linux-image-5.4.0-1124-kvmUpgrade linux-image-gkeUpgrade linux-image-generic-lts-xenialUpgrade linux-image-awsUpgrade linux-image-5.4.0-202-generic-lpaeUpgrade linux-image-lowlatencyUpgrade linux-image-azure-lts-18.04Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-oracleUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-azure-lts-20.04 | Nov 19, 2024 | Aug 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Aug 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub