In the Linux kernel, the following vulnerability has been resolved:
module: fix [e_shstrndx].sh_size=0 OOB access
It is trivial to craft a module to trigger OOB access in this line:
if (info->secstrings[strhdr->sh_size - 1] != '\0') {
BUG: unable to handle page fault for address: ffffc90000aa0fff PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:load_module+0x19b/0x2391
[rebased patch onto modules-next]
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade python-perfUpgrade kernel-debuginfoUpgrade perfUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.54-25.126Upgrade bpftool-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-develUpgrade kernelUpgrade bpftool | May 22, 2025 | Feb 26, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linux-gcp-5.15Upgrade linux-azureUpgrade linux-lowlatency-hwe-5.15Upgrade linux-realtimeUpgrade linux-awsUpgrade linux-gcpUpgrade linux-aws-5.15Upgrade linux-hwe-5.15Upgrade linux-ibmUpgrade linux-gkeUpgrade linux-azure-5.15Upgrade linux-lowlatencyUpgrade linux-raspiUpgrade linux-intel-iotgUpgrade linux-kvmUpgrade linux-oracleUpgrade linuxUpgrade linux-riscv-5.15Upgrade linux-gkeopUpgrade linux-nvidiaUpgrade linux-oracle-5.15Upgrade linux-intel-iotg-5.15 | Mar 19, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub