In the Linux kernel, the following vulnerability has been resolved:
udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
Syzbot reported a slab-out-of-bounds Write bug:
loop0: detected capacity change from 0 to 2048 ================================================================== BUG: KASAN: slab-out-of-bounds in udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253 Write of size 105 at addr ffff8880123ff896 by task syz-executor323/3610
CPU: 0 PID: 3610 Comm: syz-executor323 Not tainted 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 kasan_check_range+0x2a7/0x2e0 mm/kasan/generic.c:189 memcpy+0x3c/0x60 mm/kasan/shadow.c:66 udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ffab0d164d9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe1a7e6bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffab0d164d9 RDX: 00007ffab0d164d9 RSI: 0000000000000000 RDI: 0000000020000180 RBP: 00007ffab0cd5a10 R08: 0000000000000000 R09: 0000000000000000 R10: 00005555573552c0 R11: 0000000000000246 R12: 00007ffab0cd5aa0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK>
Allocated by task 3610: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:576 [inline] udf_find_entry+0x7b6/0x14f0 fs/udf/namei.c:243 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff8880123ff800 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 150 bytes inside of 256-byte region [ffff8880123ff800, ffff8880123ff900)
The buggy address belongs to the physical page: page:ffffea000048ff80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x123fe head:ffffea000048ff80 order:1 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 ffffea00004b8500 dead000000000003 ffff888012041b40 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 1, tgid 1 (swapper/0), ts 1841222404, free_ts 0 create_dummy_stack mm/page_owner.c: ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-64k-debugUpgrade kernel-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-cross-headersUpgrade kernel-modules-coreUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade rtlaUpgrade kernel-64k-modules-coreUpgrade kernel-debug-develUpgrade kernel-rt-debug-develUpgrade kernel-64kUpgrade kernel-rt-64k-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-headersUpgrade kernel-64k-modulesUpgrade kernel-develUpgrade python3-perfUpgrade kernel-64k-debug-develUpgrade perfUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-debugUpgrade kernel-64k-develUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-rt-coreUpgrade kernelUpgrade kernel-rt-debug-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade libperfUpgrade kernel-rt-debug-modules-coreUpgrade rvUpgrade kernel-rt-64kUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-64k-coreUpgrade kernel-64k-modules-extraUpgrade kernel-uki-virtUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-debugUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-debug-modules-extraUpgrade kernel-rtUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-kvmUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-libsUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-coreUpgrade bpftoolUpgrade kernel-docUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-toolsUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-modules-core | Jul 14, 2025 | May 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-livepatch-5.10.155-138.670Upgrade kernel-livepatch-5.15.79-51.138Upgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade python-perfUpgrade kernel-headersUpgrade kernelUpgrade kernel-livepatch-4.14.301-224.520Upgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64 | Jun 23, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | May 5, 2025 | May 1, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Sep 15, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftool | Aug 13, 2025 | Aug 9, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 9, 2025 | May 1, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 9, 2025 | May 1, 2025 |
| Rocky_linux | — | Upgrade rtlaUpgrade libperf-debuginfoUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-debuginfoUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debug-uki-virtUpgrade libperfUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-devel-matchedUpgrade perfUpgrade python3-perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-uki-virtUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-modules-coreUpgrade kernel-headersUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-coreUpgrade rvUpgrade kernel-zfcpdumpUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rtUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-coreUpgrade kernel-tools-libsUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-develUpgrade kernel-debug-devel-matchedUpgrade kernel-toolsUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modules-core | Feb 5, 2026 | Oct 4, 2025 |
| Ubuntu | — | Upgrade linux-nvidia-tegra-5.15Upgrade linux-azure-fdeUpgrade linux-ibm-5.4Upgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-aws-5.15Upgrade linux-raspi-5.4Upgrade linux-oracle-5.15Upgrade linuxUpgrade linux-realtimeUpgrade linux-intel-iotgUpgrade linux-awsUpgrade linux-gkeUpgrade linux-bluefieldUpgrade linux-aws-hweUpgrade linux-fipsUpgrade linux-aws-5.4Upgrade linux-riscv-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-lowlatencyUpgrade linux-azure-4.15Upgrade linux-kvmUpgrade linux-nvidiaUpgrade linux-gcp-5.15Upgrade linux-gcp-4.15Upgrade linux-azure-5.4Upgrade linux-gcp-fipsUpgrade linux-azure-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-hwe-5.4Upgrade linux-iotUpgrade linux-hwe-5.15Upgrade linux-oracleUpgrade linux-gcp-5.4Upgrade linux-ibmUpgrade linux-xilinx-zynqmpUpgrade linux-gkeopUpgrade linux-hweUpgrade linux-aws-fipsUpgrade linux-azure-fipsUpgrade linux-gcpUpgrade linux-azureUpgrade linux-intel-iotg-5.15 | May 6, 2025 | May 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub