In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_tunnel: fix geneve_opt type confusion addition
When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly. Hence, when deciding the next geneve_opt position, the pointer addition should be in units of char *.
However, the current implementation erroneously does type conversion before the addition, which will lead to heap out-of-bounds write.
[ 6.989857] ================================================================== [ 6.990293] BUG: KASAN: slab-out-of-bounds in nft_tunnel_obj_init+0x977/0xa70 [ 6.990725] Write of size 124 at addr ffff888005f18974 by task poc/178 [ 6.991162] [ 6.991259] CPU: 0 PID: 178 Comm: poc-oob-write Not tainted 6.1.132 #1 [ 6.991655] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 6.992281] Call Trace: [ 6.992423] <TASK> [ 6.992586] dump_stack_lvl+0x44/0x5c [ 6.992801] print_report+0x184/0x4be [ 6.993790] kasan_report+0xc5/0x100 [ 6.994252] kasan_check_range+0xf3/0x1a0 [ 6.994486] memcpy+0x38/0x60 [ 6.994692] nft_tunnel_obj_init+0x977/0xa70 [ 6.995677] nft_obj_init+0x10c/0x1b0 [ 6.995891] nf_tables_newobj+0x585/0x950 [ 6.996922] nfnetlink_rcv_batch+0xdf9/0x1020 [ 6.998997] nfnetlink_rcv+0x1df/0x220 [ 6.999537] netlink_unicast+0x395/0x530 [ 7.000771] netlink_sendmsg+0x3d0/0x6d0 [ 7.001462] __sock_sendmsg+0x99/0xa0 [ 7.001707] ____sys_sendmsg+0x409/0x450 [ 7.002391] ___sys_sendmsg+0xfd/0x170 [ 7.003145] __sys_sendmsg+0xea/0x170 [ 7.004359] do_syscall_64+0x5e/0x90 [ 7.005817] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 7.006127] RIP: 0033:0x7ec756d4e407 [ 7.006339] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 faf [ 7.007364] RSP: 002b:00007ffed5d46760 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 7.007827] RAX: ffffffffffffffda RBX: 00007ec756cc4740 RCX: 00007ec756d4e407 [ 7.008223] RDX: 0000000000000000 RSI: 00007ffed5d467f0 RDI: 0000000000000003 [ 7.008620] RBP: 00007ffed5d468a0 R08: 0000000000000000 R09: 0000000000000000 [ 7.009039] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 7.009429] R13: 00007ffed5d478b0 R14: 00007ec756ee5000 R15: 00005cbd4e655cb8
Fix this bug with correct pointer addition and conversion in parse and dump code.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-modulesUpgrade kernel-docUpgrade kernel-rt-debug-develUpgrade kernel-64k-modules-extraUpgrade kernel-debugUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debugUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernel-headersUpgrade libperfUpgrade perfUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-modules-coreUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modulesUpgrade rvUpgrade kernel-64k-develUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-rt-64k-modules-extraUpgrade kernel-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-develUpgrade kernel-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade kernel-uki-virtUpgrade kernel-zfcpdumpUpgrade kernel-64k-debug-develUpgrade kernel-abi-stablelistsUpgrade kernel-rt-develUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-debugUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64k-develUpgrade kernel-64k-modules-coreUpgrade kernel-cross-headersUpgrade kernel-64kUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modules-coreUpgrade rtlaUpgrade kernel-rt-64kUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-64k-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debugUpgrade kernelUpgrade kernel-64k-debug-coreUpgrade kernel-64k-coreUpgrade kernel-rt-coreUpgrade kernel-rt-64k-debug-coreUpgrade kernel-tools-libsUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-debug-modules-extra | Nov 20, 2025 | Nov 11, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.180-122.191Upgrade kernel-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.236-227.928Upgrade perf | May 22, 2025 | Apr 16, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade kernel-modules-extraUpgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12Upgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-modules-extraUpgrade kernel-libbpfUpgrade python3-perf-debuginfoUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel6.12Upgrade bpftoolUpgrade kernel-livepatch-6.12.23-29.97Upgrade kernel-libbpf-develUpgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel-develUpgrade python3-perf6.12Upgrade kernel-debuginfo-common-aarch64Upgrade python3-perf6.12-debuginfoUpgrade kernel-livepatch-6.1.134-150.224Upgrade kernel-modules-extra-commonUpgrade python3-perfUpgrade kernel-tools-develUpgrade kernel-libbpf-staticUpgrade kernelUpgrade perf | Jun 11, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Apr 29, 2025 | Apr 16, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Apr 16, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Apr 16, 2025 |
| Rocky_linux | — | Upgrade kernel-coreUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-modules-extraUpgrade rtlaUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libsUpgrade python3-perf-debuginfoUpgrade kernel-modules-extra-matchedUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-uki-virtUpgrade kernel-rt-develUpgrade kernel-modulesUpgrade perfUpgrade python3-perfUpgrade kernel-rt-coreUpgrade perf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-debug-modules-extraUpgrade libperf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade rvUpgrade kernel-uki-virt-addonsUpgrade kernel-modules-coreUpgrade kernel-rtUpgrade kernel-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernelUpgrade kernel-toolsUpgrade kernel-rt-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-develUpgrade libperfUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-debuginfoUpgrade kernel-debuginfo-common-x86_64 | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade kernel-obs-buildUpgrade kernel-default-develUpgrade kernel-debugUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-azureUpgrade kernel-kvmsmall-develUpgrade kernel-rtUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-source-azureUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-rt-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-64kb-develUpgrade kselftests-kmp-64kbUpgrade dtb-amazonUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade kernel-default-optionalUpgrade kernel-debug-vdsoUpgrade dtb-mediatekUpgrade kernel-64kbUpgrade kernel-source-rtUpgrade dtb-sprdUpgrade kernel-rt-develUpgrade kernel-azure-optionalUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-azureUpgrade dtb-qcomUpgrade kernel-sourceUpgrade dtb-rockchipUpgrade dtb-caviumUpgrade dtb-exynosUpgrade dtb-hisiliconUpgrade kernel-develUpgrade dtb-freescaleUpgrade dtb-lgUpgrade dtb-xilinxUpgrade kernel-source-vanillaUpgrade dtb-alteraUpgrade kernel-devel-rtUpgrade kernel-rt_debug-develUpgrade kernel-default-base-rebuildUpgrade kernel-default-extraUpgrade kernel-debug-develUpgrade dtb-appleUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dtb-amdUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmallUpgrade dtb-broadcomUpgrade kernel-rt_debugUpgrade kernel-default-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-64kb-optionalUpgrade kernel-rt-vdsoUpgrade kernel-docsUpgrade dtb-amlogicUpgrade dtb-armUpgrade dtb-apmUpgrade kernel-zfcpdumpUpgrade kernel-macrosUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade dlm-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-syms-rtUpgrade kernel-symsUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade dtb-marvellUpgrade kselftests-kmp-defaultUpgrade kernel-defaultUpgrade kernel-azure-extraUpgrade dtb-socionextUpgrade dtb-nvidiaUpgrade gfs2-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-azure-develUpgrade kernel-kvmsmall-vdso | Dec 5, 2025 | Jun 12, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-22-genericUpgrade linux-image-azure-6.8Upgrade linux-image-intelUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-oracle-6.8Upgrade linux-image-5.15.0-142-lowlatency-64kUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.1-1036-realtimeUpgrade linux-image-6.8.0-1038-gke-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1039-ibmUpgrade linux-image-fipsUpgrade linux-image-6.8.0-1042-gcp-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.14.0-1007-azureUpgrade linux-image-5.15.0-1085-gcp-fipsUpgrade linux-image-oem-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-5.15.0-1085-gcpUpgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1041-aws-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-5.15.0-1082-kvmUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-oem-22.04dUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-5.15.0-1039-nvidia-tegraUpgrade linux-image-aws-64kUpgrade linux-image-genericUpgrade linux-image-realtimeUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-5.15.0-1086-realtimeUpgrade linux-image-6.8.0-86-lowlatencyUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-5.15.0-1039-nvidia-tegra-rtUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1038-gkeUpgrade linux-image-intel-iotgUpgrade linux-image-lowlatency-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-5.15.0-1080-raspiUpgrade linux-image-gcp-6.8Upgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-oem-20.04Upgrade linux-image-oracleUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-6.8.0-1044-azure-fipsUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1083-gkeUpgrade linux-image-5.15.0-1080-nvidiaUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-cvmUpgrade linux-image-gcp-64kUpgrade linux-image-aws-fipsUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-6.8.0-1038-oracleUpgrade linux-image-5.15.0-1091-azure-fipsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-6.8.0-1041-azureUpgrade linux-image-lowlatency-6.8Upgrade linux-image-5.15.0-1080-nvidia-lowlatencyUpgrade linux-image-5.15.0-1050-xilinx-zynqmpUpgrade linux-image-gkeUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1079-intel-iot-realtimeUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-5.15.0-1083-oracleUpgrade linux-image-raspiUpgrade linux-image-azure-fipsUpgrade linux-image-5.15.0-1086-aws-64kUpgrade linux-image-oracle-64kUpgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-86-generic-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-ibm-classicUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-oem-20.04bUpgrade linux-image-gke-64kUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1038-oracle-64kUpgrade linux-image-5.15.0-1028-nvidia-tegra-igx-rtUpgrade linux-image-awsUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-5.15.0-1083-intel-iotgUpgrade linux-image-nvidiaUpgrade linux-image-generic-6.8Upgrade linux-image-oem-24.04bUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-ibmUpgrade linux-image-5.15.0-142-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1041-nvidia-lowlatencyUpgrade linux-image-5.15.0-1091-azureUpgrade linux-image-6.8.0-2032-raspi-realtimeUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1029-azure-nvidiaUpgrade linux-image-nvidia-tegraUpgrade linux-image-aws-lts-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-azure-fde-edgeUpgrade linux-image-oem-22.04aUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-22.04cUpgrade linux-image-kvmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-aws-6.8Upgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-5.15.0-142-generic-64kUpgrade linux-image-5.15.0-1086-aws-fipsUpgrade linux-image-5.15.0-142-fipsUpgrade linux-image-virtual-6.8Upgrade linux-image-azure-fdeUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1025-gkeopUpgrade linux-image-6.8.0-1041-raspiUpgrade linux-image-raspi-realtimeUpgrade linux-image-lowlatency-6.11Upgrade linux-image-gkeop-6.8Upgrade linux-image-generic-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1041-nvidiaUpgrade linux-image-5.15.0-1086-awsUpgrade linux-image-5.15.0-1068-gkeopUpgrade linux-image-gke-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1028-nvidia-tegra-igxUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-oem-20.04cUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-gcpUpgrade linux-image-6.8.0-86-lowlatency-64kUpgrade linux-image-6.8.0-1041-nvidia-64kUpgrade linux-image-5.15.0-1078-ibmUpgrade linux-image-gke-5.15Upgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-5.15.0-142-lowlatencyUpgrade linux-image-5.15.0-1081-intel-iotgUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1042-gcpUpgrade linux-image-6.8.0-1041-awsUpgrade linux-image-generic-64k-6.8Upgrade linux-image-azureUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oem-20.04dUpgrade linux-image-6.8.0-1041-nvidia-lowlatency-64kUpgrade linux-image-azure-6.11Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-5.15.0-142-generic-lpaeUpgrade linux-image-gcp-fipsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-86-genericUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.11.0-1018-azureUpgrade linux-image-azure-fde-6.11Upgrade linux-image-generic-hwe-22.04 | Jun 20, 2025 | Apr 16, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 16, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub