In the Linux kernel, the following vulnerability has been resolved:
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
Fix an issue detected by syzbot with KASAN:
BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459
The issue occurs in cmd_to_func when the call_pkg->nd_reserved2 array is accessed without verifying that call_pkg points to a buffer that is appropriately sized as a struct nd_cmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space.
To address this, a check was added in acpi_nfit_ctl() to ensure that buf is not NULL and that buf_len is less than sizeof(*call_pkg) before accessing it. This ensures safe access to the members of call_pkg, including the nd_reserved2 array.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modulesUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-uki-virt-addonsUpgrade rvUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-debug-coreUpgrade kernel-develUpgrade kernel-docUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rtUpgrade kernel-64k-debug-modules-coreUpgrade perfUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virtUpgrade libperfUpgrade kernel-zfcpdumpUpgrade kernel-toolsUpgrade kernel-64k-debug-modulesUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-devel-matchedUpgrade kernel-coreUpgrade kernel-modules-coreUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade kernel-64k-modules-extraUpgrade kernel-headersUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-debugUpgrade kernel-64k-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-64k-debugUpgrade kernel-debug-uki-virtUpgrade kernel-64k-develUpgrade kernel-rt-debugUpgrade kernelUpgrade kernel-64kUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-64k-develUpgrade kernel-debug-coreUpgrade kernel-64k-debug-develUpgrade kernel-rt-64k-debug-develUpgrade kernel-debug-develUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debugUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-64kUpgrade rtlaUpgrade kernel-rt-64k-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-coreUpgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-cross-headers | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jan 13, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libs | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftool | Apr 11, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelists | Mar 19, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools | Apr 1, 2025 | Dec 27, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Feb 11, 2025 | Dec 27, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Dec 27, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-develUpgrade libperf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-toolsUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade rvUpgrade kernel-rtUpgrade kernel-uki-virtUpgrade kernelUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-debuginfo-common-x86_64Upgrade libperfUpgrade kernel-rt-debug-develUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-develUpgrade perfUpgrade kernel-rt-debug-coreUpgrade python3-perfUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade rtlaUpgrade kernel-rt-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-extra-matchedUpgrade kernel-rt-modules-extra | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1066-xilinx-zynqmpUpgrade linux-image-raspi-nolpaeUpgrade linux-image-snapdragon-5.4Upgrade linux-image-5.4.0-1148-awsUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-5.4.0-1107-bluefieldUpgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-oracle-4.15Upgrade linux-image-5.15.0-136-genericUpgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-4.15.0-239-lowlatencyUpgrade linux-image-6.8.0-60-generic-64kUpgrade linux-image-6.8.0-1029-azureUpgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1030-gcp-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-kvmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-6.8.0-1028-nvidia-lowlatencyUpgrade linux-image-ibm-5.4Upgrade linux-image-5.4.0-219-generic-lpaeUpgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-azure-cvmUpgrade linux-image-intel-iotgUpgrade linux-image-fipsUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oemUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-gkeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-6.8.0-1029-azure-fdeUpgrade linux-image-awsUpgrade linux-image-oem-osp1Upgrade linux-image-lowlatency-5.4Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-4.15.0-1165-kvmUpgrade linux-image-oem-24.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-5.4.0-219-lowlatencyUpgrade linux-image-azure-5.4Upgrade linux-image-oracle-lts-18.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.15.0-1080-awsUpgrade linux-image-5.4.0-1153-azureUpgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-oem-20.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1030-gcpUpgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-generic-lpae-5.4Upgrade linux-image-azure-fips-5.4Upgrade linux-image-6.8.0-1028-nvidia-lowlatency-64kUpgrade linux-image-gcp-fips-5.4Upgrade linux-image-raspi2Upgrade linux-image-5.4.0-1131-raspiUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-6.11.0-1011-awsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-gcp-5.4Upgrade linux-image-realtimeUpgrade linux-image-4.15.0-1190-azureUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-raspi-5.4Upgrade linux-image-virtualUpgrade linux-image-bluefieldUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-4.15.0-239-genericUpgrade linux-image-oracleUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-4.15.0-1182-awsUpgrade linux-image-4.15.0-2120-aws-fipsUpgrade linux-image-5.4.0-1146-oracleUpgrade linux-image-virtual-5.4Upgrade linux-image-oracle-5.4Upgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-6.8.0-1028-oemUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-60-lowlatency-64kUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-5.15.0-135-fipsUpgrade linux-image-aws-lts-18.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-135-genericUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-azure-4.15Upgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-5.4.0-1094-ibmUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-4.15.0-1144-oracleUpgrade linux-image-gcp-fips-4.15Upgrade linux-image-intelUpgrade linux-image-gke-5.15Upgrade linux-image-6.11.0-21-genericUpgrade linux-image-generic-5.4Upgrade linux-image-6.8.0-1012-gkeopUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1122-fipsUpgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-6.8.1-1022-realtimeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-azure-fdeUpgrade linux-image-4.15.0-2099-azure-fipsUpgrade linux-image-oem-22.04dUpgrade linux-image-gkeop-6.8Upgrade linux-image-azure-lts-22.04Upgrade linux-image-5.4.0-1151-gcpUpgrade linux-image-6.8.0-1016-azure-nvidiaUpgrade linux-image-5.4.0-1148-aws-fipsUpgrade linux-image-5.4.0-1135-kvmUpgrade linux-image-5.4.0-1052-iotUpgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1026-ibmUpgrade linux-image-aws-fipsUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1026-oracleUpgrade linux-image-6.8.0-1028-nvidia-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-gcp-fipsUpgrade linux-image-aws-fips-5.4Upgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-nvidia-tegraUpgrade linux-image-genericUpgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-5.4.0-219-genericUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-5.15.0-136-generic-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azure-nvidiaUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-aws-4.15Upgrade linux-image-ibm-classicUpgrade linux-image-aws-hweUpgrade linux-image-6.8.0-60-lowlatencyUpgrade linux-image-6.8.0-1025-gkeUpgrade linux-image-5.4.0-1151-gcp-fipsUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-ibmUpgrade linux-image-azure-fipsUpgrade linux-image-azureUpgrade linux-image-oracle-64kUpgrade linux-image-bluefield-5.4Upgrade linux-image-aws-5.4Upgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-5.4.0-1154-azure-fipsUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-5.15.0-1086-azureUpgrade linux-image-5.15.0-1084-azureUpgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-6.8Upgrade linux-image-raspiUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-6.8.0-1028-nvidiaUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.0-1026-oracle-64kUpgrade linux-image-gcp-4.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-gkeopUpgrade linux-image-azure-lts-18.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-4.15.0-1175-gcpUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1029-awsUpgrade linux-image-xilinx-zynqmp-5.4Upgrade linux-image-6.8.0-60-genericUpgrade linux-image-oem-20.04cUpgrade linux-image-4.15.0-1137-fipsUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-fips-5.4Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-kvm-5.4Upgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-aws-fips-4.15Upgrade linux-image-4.15.0-2083-gcp-fipsUpgrade linux-image-5.15.0-1033-nvidia-tegra | Mar 28, 2025 | Dec 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub