In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix signed integer overflow in __ip6_append_data
Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.
UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170
Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2: -Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.236-227.928Upgrade kernel-headersUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.15.180-122.191Upgrade kernel-tools-debuginfoUpgrade perfUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64 | Apr 30, 2025 | Feb 26, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-tools | Jul 1, 2025 | Feb 26, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-oracleUpgrade linux-image-5.15.0-1039-nvidia-tegra-rtUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1082-kvmUpgrade linux-image-gkeUpgrade linux-image-awsUpgrade linux-image-intel-iotgUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-20.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1039-nvidia-tegraUpgrade linux-image-5.15.0-142-generic-64kUpgrade linux-image-5.15.0-1085-gcp-fipsUpgrade linux-image-5.15.0-1085-gcpUpgrade linux-image-5.15.0-142-genericUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-kvmUpgrade linux-image-5.15.0-142-lowlatencyUpgrade linux-image-realtimeUpgrade linux-image-5.15.0-1083-gkeUpgrade linux-image-gkeop-5.15Upgrade linux-image-virtualUpgrade linux-image-5.15.0-1050-xilinx-zynqmpUpgrade linux-image-5.15.0-1086-realtimeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1080-raspiUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1079-intel-iot-realtimeUpgrade linux-image-5.15.0-142-fipsUpgrade linux-image-5.15.0-1091-azureUpgrade linux-image-5.15.0-1091-azure-fipsUpgrade linux-image-5.15.0-142-generic-lpaeUpgrade linux-image-oem-20.04bUpgrade linux-image-intelUpgrade linux-image-5.15.0-1080-nvidia-lowlatencyUpgrade linux-image-5.15.0-1083-oracleUpgrade linux-image-azure-lts-22.04Upgrade linux-image-genericUpgrade linux-image-ibmUpgrade linux-image-oem-20.04cUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1086-aws-fipsUpgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-5.15.0-1028-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1028-nvidia-tegra-igxUpgrade linux-image-gcp-fipsUpgrade linux-image-gke-5.15Upgrade linux-image-fipsUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-142-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1068-gkeopUpgrade linux-image-5.15.0-1081-intel-iotgUpgrade linux-image-raspiUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-aws-fipsUpgrade linux-image-5.15.0-1086-aws-64kUpgrade linux-image-5.15.0-1083-intel-iotgUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-nvidia-tegraUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-azure-fipsUpgrade linux-image-5.15.0-1080-nvidiaUpgrade linux-image-5.15.0-1078-ibmUpgrade linux-image-nvidiaUpgrade linux-image-lowlatencyUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1086-awsUpgrade linux-image-gkeopUpgrade linux-image-lowlatency-hwe-20.04 | Jun 20, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 10, 2025 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub