In the Linux kernel, the following vulnerability has been resolved:
arm64: csum: Fix OoB access in IP checksum code for negative lengths
Although commit c2c24edb1d9c ("arm64: csum: Fix pathological zero-length calls") added an early return for zero-length input, syzkaller has popped up with an example of a _negative_ length which causes an undefined shift and an out-of-bounds read:
| BUG: KASAN: slab-out-of-bounds in do_csum+0x44/0x254 arch/arm64/lib/csum.c:39 | Read of size 4294966928 at addr ffff0000d7ac0170 by task syz-executor412/5975 | | CPU: 0 PID: 5975 Comm: syz-executor412 Not tainted 6.4.0-rc4-syzkaller-g908f31f2a05b #0 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 | Call trace: | dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233 | show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240 | __dump_stack lib/dump_stack.c:88 [inline] | dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 | print_address_description mm/kasan/report.c:351 [inline] | print_report+0x174/0x514 mm/kasan/report.c:462 | kasan_report+0xd4/0x130 mm/kasan/report.c:572 | kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187 | __kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31 | do_csum+0x44/0x254 arch/arm64/lib/csum.c:39 | csum_partial+0x30/0x58 lib/checksum.c:128 | gso_make_checksum include/linux/skbuff.h:4928 [inline] | __udp_gso_segment+0xaf4/0x1bc4 net/ipv4/udp_offload.c:332 | udp6_ufo_fragment+0x540/0xca0 net/ipv6/udp_offload.c:47 | ipv6_gso_segment+0x5cc/0x1760 net/ipv6/ip6_offload.c:119 | skb_mac_gso_segment+0x2b4/0x5b0 net/core/gro.c:141 | __skb_gso_segment+0x250/0x3d0 net/core/dev.c:3401 | skb_gso_segment include/linux/netdevice.h:4859 [inline] | validate_xmit_skb+0x364/0xdbc net/core/dev.c:3659 | validate_xmit_skb_list+0x94/0x130 net/core/dev.c:3709 | sch_direct_xmit+0xe8/0x548 net/sched/sch_generic.c:327 | __dev_xmit_skb net/core/dev.c:3805 [inline] | __dev_queue_xmit+0x147c/0x3318 net/core/dev.c:4210 | dev_queue_xmit include/linux/netdevice.h:3085 [inline] | packet_xmit+0x6c/0x318 net/packet/af_packet.c:276 | packet_snd net/packet/af_packet.c:3081 [inline] | packet_sendmsg+0x376c/0x4c98 net/packet/af_packet.c:3113 | sock_sendmsg_nosec net/socket.c:724 [inline] | sock_sendmsg net/socket.c:747 [inline] | __sys_sendto+0x3b4/0x538 net/socket.c:2144
Extend the early return to reject negative lengths as well, aligning our implementation with the generic code in lib/checksum.c
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.15.133-86.144Upgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-5.10.196-185.743Upgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perfUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade perfUpgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf-debuginfoUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-livepatch-6.1.55-75.123Upgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade perf-debuginfo | Nov 6, 2025 | Oct 22, 2025 |
| Debian | — | Upgrade linux | Oct 24, 2025 | Oct 24, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade bpftool | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Nov 14, 2025 | Oct 22, 2025 |
| Ubuntu | — | Upgrade linux-ibmUpgrade linux-intel-iotg-5.15Upgrade linux-intel-iotgUpgrade linux-gkeUpgrade linux-azure-5.15Upgrade linux-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-gkeopUpgrade linux-aws-fipsUpgrade linux-oracleUpgrade linux-gcp-5.15Upgrade linux-oracle-5.15Upgrade linux-nvidiaUpgrade linuxUpgrade linux-riscv-5.15Upgrade linux-kvmUpgrade linux-gcp-fipsUpgrade linux-ibm-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-lowlatencyUpgrade linux-bluefieldUpgrade linux-nvidia-tegra-5.15Upgrade linux-aws-5.15Upgrade linux-awsUpgrade linux-gcpUpgrade linux-intel-iot-realtimeUpgrade linux-hwe-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-nvidia-tegraUpgrade linux-azureUpgrade linux-raspiUpgrade linux-realtime | Oct 28, 2025 | Oct 24, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Oct 22, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub