In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
Eric Dumazet says: nf_conntrack_dccp_packet() has an unique:
dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer.
BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..]
Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header.
While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them.
Compile tested only.
v2: first skb_header_pointer() now needs to adjust the size to only pull the generic header. (Eric)
Heads-up: I intend to remove dccp conntrack support later this year.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade kernel-livepatch-5.15.122-77.145Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.192-182.736Upgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-headersUpgrade bpftool | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade perfUpgrade kernel-libbpfUpgrade python3-perfUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernel-livepatch-6.1.41-63.109Upgrade kernel-headersUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-libbpf-develUpgrade bpftoolUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-tools | Oct 16, 2025 | Sep 16, 2025 |
| Debian | — | Upgrade linux | Sep 18, 2025 | Sep 18, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 16, 2025 |
| Ubuntu | — | Upgrade linux-iotUpgrade linux-azure-4.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-gcp-fipsUpgrade linux-hweUpgrade linux-nvidia-tegra-igxUpgrade linux-lts-xenialUpgrade linux-hwe-5.15Upgrade linux-realtimeUpgrade linuxUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-4.15Upgrade linux-awsUpgrade linux-raspi-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-ibm-5.4Upgrade linux-gcpUpgrade linux-azureUpgrade linux-hwe-5.4Upgrade linux-azure-5.4Upgrade linux-bluefieldUpgrade linux-intel-iotg-5.15Upgrade linux-oracleUpgrade linux-azure-5.15Upgrade linux-gcp-5.15Upgrade linux-aws-fipsUpgrade linux-nvidiaUpgrade linux-xilinx-zynqmpUpgrade linux-nvidia-tegraUpgrade linux-gcp-5.4Upgrade linux-ibmUpgrade linux-oracle-5.15Upgrade linux-intel-iotgUpgrade linux-oracle-5.4Upgrade linux-riscv-5.15Upgrade linux-aws-5.15Upgrade linux-raspiUpgrade linux-aws-5.4Upgrade linux-kvmUpgrade linux-gkeopUpgrade linux-aws-hweUpgrade linux-gkeUpgrade linux-azure-fipsUpgrade linux-ibm-5.15Upgrade linux-fipsUpgrade linux-lowlatency | Sep 19, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub