In the Linux kernel, the following vulnerability has been resolved:
can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
Syzkaller reported the following issue:
===================================================== BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline] BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600 aio_rw_done fs/aio.c:1520 [inline] aio_write+0x899/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline] __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc+0x11d/0x3b0 mm/slab_common.c:981 kmalloc_array include/linux/slab.h:636 [inline] bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930 bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] sock_write_iter+0x495/0x5e0 net/socket.c:1108 call_write_iter include/linux/fs.h:2189 [inline] aio_write+0x63a/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 =====================================================
We can follow the call chain and find that 'bcm_tx_setup' function calls 'memcpy_from_msg' to copy some content to the newly allocated frame of 'op->frames'. After that the 'len' field of copied structure being compared with some constant value (64 or 8). However, if 'memcpy_from_msg' returns an error, we will compare some uninitialized memory. This triggers 'uninit-value' issue.
This patch will add 'memcpy_from_msg' possible errors processing to avoid uninit-value issue.
Tested via syzkaller
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernelUpgrade kernel-livepatch-5.10.177-158.645Upgrade kernel-tools-debuginfoUpgrade python-perfUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-develUpgrade perfUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Sep 19, 2025 | Sep 19, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 17, 2025 |
| Ubuntu | — | Upgrade linux-nvidia-tegra-igxUpgrade linux-nvidiaUpgrade linux-oracle-5.15Upgrade linux-ibm-5.4Upgrade linux-riscv-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-aws-5.15Upgrade linux-nvidia-tegraUpgrade linux-gcp-5.4Upgrade linux-ibm-5.15Upgrade linux-azure-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-oracle-5.4Upgrade linux-azure-fipsUpgrade linux-intel-iotgUpgrade linux-lowlatencyUpgrade linux-gkeUpgrade linux-oracleUpgrade linux-fipsUpgrade linux-kvmUpgrade linux-nvidia-tegra-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-gcpUpgrade linux-gkeopUpgrade linux-aws-5.4Upgrade linux-realtimeUpgrade linux-raspi-5.4Upgrade linuxUpgrade linux-azure-5.4Upgrade linux-intel-iotg-5.15Upgrade linux-iotUpgrade linux-azureUpgrade linux-awsUpgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-raspiUpgrade linux-ibmUpgrade linux-aws-fipsUpgrade linux-hwe-5.15Upgrade linux-hwe-5.4Upgrade linux-gcp-5.15 | Sep 26, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub