In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_tunnel: fix geneve_opt type confusion addition
When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly. Hence, when deciding the next geneve_opt position, the pointer addition should be in units of char *.
However, the current implementation erroneously does type conversion before the addition, which will lead to heap out-of-bounds write.
[ 6.989857] ================================================================== [ 6.990293] BUG: KASAN: slab-out-of-bounds in nft_tunnel_obj_init+0x977/0xa70 [ 6.990725] Write of size 124 at addr ffff888005f18974 by task poc/178 [ 6.991162] [ 6.991259] CPU: 0 PID: 178 Comm: poc-oob-write Not tainted 6.1.132 #1 [ 6.991655] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 6.992281] Call Trace: [ 6.992423] <TASK> [ 6.992586] dump_stack_lvl+0x44/0x5c [ 6.992801] print_report+0x184/0x4be [ 6.993790] kasan_report+0xc5/0x100 [ 6.994252] kasan_check_range+0xf3/0x1a0 [ 6.994486] memcpy+0x38/0x60 [ 6.994692] nft_tunnel_obj_init+0x977/0xa70 [ 6.995677] nft_obj_init+0x10c/0x1b0 [ 6.995891] nf_tables_newobj+0x585/0x950 [ 6.996922] nfnetlink_rcv_batch+0xdf9/0x1020 [ 6.998997] nfnetlink_rcv+0x1df/0x220 [ 6.999537] netlink_unicast+0x395/0x530 [ 7.000771] netlink_sendmsg+0x3d0/0x6d0 [ 7.001462] __sock_sendmsg+0x99/0xa0 [ 7.001707] ____sys_sendmsg+0x409/0x450 [ 7.002391] ___sys_sendmsg+0xfd/0x170 [ 7.003145] __sys_sendmsg+0xea/0x170 [ 7.004359] do_syscall_64+0x5e/0x90 [ 7.005817] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 7.006127] RIP: 0033:0x7ec756d4e407 [ 7.006339] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 faf [ 7.007364] RSP: 002b:00007ffed5d46760 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 7.007827] RAX: ffffffffffffffda RBX: 00007ec756cc4740 RCX: 00007ec756d4e407 [ 7.008223] RDX: 0000000000000000 RSI: 00007ffed5d467f0 RDI: 0000000000000003 [ 7.008620] RBP: 00007ffed5d468a0 R08: 0000000000000000 R09: 0000000000000000 [ 7.009039] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 7.009429] R13: 00007ffed5d478b0 R14: 00007ec756ee5000 R15: 00005cbd4e655cb8
Fix this bug with correct pointer addition and conversion in parse and dump code.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-develUpgrade kernel-modules-extraUpgrade kernel-64k-develUpgrade kernel-modulesUpgrade kernel-64k-debug-modules-extraUpgrade perfUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade libperfUpgrade kernel-rt-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-coreUpgrade kernel-uki-virtUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-debugUpgrade kernel-64k-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-rtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debugUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-docUpgrade kernel-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade rvUpgrade kernel-debug-uki-virtUpgrade kernel-debug-develUpgrade kernel-coreUpgrade kernel-toolsUpgrade kernel-64k-coreUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-64kUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64k-debug-develUpgrade kernelUpgrade kernel-64k-debug-develUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modules-coreUpgrade rtlaUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-develUpgrade kernel-rt-64k-coreUpgrade kernel-rt-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-64kUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debugUpgrade kernel-64k-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-debug-modules | Nov 20, 2025 | Nov 11, 2025 |
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-develUpgrade perfUpgrade python-perfUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-tools-develUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.236-227.928Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.15.180-122.191Upgrade kernel-headersUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfo | May 22, 2025 | Apr 16, 2025 |
| Amazon_linux_2023 | — | Upgrade perfUpgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade python3-perfUpgrade kernel-livepatch-6.12.23-29.97Upgrade kernelUpgrade python3-perf6.12-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade kernel-livepatch-6.1.134-150.224Upgrade kernel-modules-extra-commonUpgrade kernel-libbpf-staticUpgrade python3-perf6.12Upgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel6.12Upgrade perf-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-libbpf-debuginfoUpgrade bpftoolUpgrade perf6.12Upgrade python3-perf-debuginfoUpgrade kernel6.12-modules-extra | Jun 11, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Apr 29, 2025 | Apr 16, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Apr 16, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 9, 2025 | Apr 16, 2025 |
| Rocky_linux | — | Upgrade kernel-uki-virtUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-uki-virtUpgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-modules-extra-matchedUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-develUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade rtlaUpgrade kernel-develUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade rvUpgrade kernel-zfcpdump-modulesUpgrade perf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-tools-libs-develUpgrade libperfUpgrade kernel-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-develUpgrade kernel-rtUpgrade kernel-debug-devel-matchedUpgrade kernelUpgrade kernel-debug-modules-coreUpgrade kernel-toolsUpgrade kernel-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-develUpgrade kernel-rt-debuginfoUpgrade libperf-debuginfo | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade kernel-debug-develUpgrade dlm-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-rtUpgrade kernel-rt_debugUpgrade dtb-nvidiaUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-vdsoUpgrade dtb-amdUpgrade dtb-renesasUpgrade dtb-marvellUpgrade kernel-azure-develUpgrade dlm-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-defaultUpgrade dtb-socionextUpgrade kernel-default-baseUpgrade kernel-azure-extraUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade kernel-symsUpgrade dtb-appleUpgrade kernel-docs-htmlUpgrade kernel-macrosUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-64kbUpgrade dtb-amlogicUpgrade kselftests-kmp-rtUpgrade dtb-apmUpgrade dtb-broadcomUpgrade dtb-armUpgrade kernel-obs-qaUpgrade kernel-default-extraUpgrade kernel-docsUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-default-base-rebuildUpgrade dtb-rockchipUpgrade dlm-kmp-64kbUpgrade kernel-azureUpgrade dtb-alteraUpgrade kernel-source-vanillaUpgrade dtb-xilinxUpgrade kernel-obs-buildUpgrade ocfs2-kmp-defaultUpgrade dtb-lgUpgrade dtb-exynosUpgrade dtb-freescaleUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-64kbUpgrade dtb-mediatekUpgrade dtb-amazonUpgrade kselftests-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt-optionalUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-source-rtUpgrade kernel-default-optionalUpgrade dtb-sprdUpgrade dtb-hisiliconUpgrade dtb-allwinnerUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-debug-vdsoUpgrade kernel-debugUpgrade reiserfs-kmp-azureUpgrade dtb-qcomUpgrade cluster-md-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-default-livepatchUpgrade kernel-64kb-extraUpgrade kernel-64kb-develUpgrade kernel-rtUpgrade kernel-kvmsmall-develUpgrade kernel-rt-extraUpgrade kernel-default-develUpgrade dtb-cavium | Dec 5, 2025 | Jun 12, 2025 |
| Ubuntu | — | Upgrade linux-image-aws-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-142-lowlatency-64kUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.8.0-1038-gke-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1085-gcpUpgrade linux-image-5.15.0-1039-nvidia-tegra-rtUpgrade linux-image-6.8.0-86-lowlatencyUpgrade linux-image-5.15.0-1083-gkeUpgrade linux-image-5.15.0-1080-nvidiaUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1041-azureUpgrade linux-image-realtimeUpgrade linux-image-5.15.0-1079-intel-iot-realtimeUpgrade linux-image-oem-20.04Upgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-oracleUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1044-azure-fipsUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-gkeopUpgrade linux-image-azure-cvmUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1038-oracleUpgrade linux-image-5.15.0-1050-xilinx-zynqmpUpgrade linux-image-5.15.0-1083-oracleUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-gkeUpgrade linux-image-genericUpgrade linux-image-5.15.0-1080-nvidia-lowlatencyUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-5.15.0-1086-realtimeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-5.15.0-1091-azure-fipsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-intelUpgrade linux-image-azure-6.8Upgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-oracle-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.14.0-1007-azureUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-1085-gcp-fipsUpgrade linux-image-6.8.1-1036-realtimeUpgrade linux-image-5.15.0-1082-kvmUpgrade linux-image-virtualUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-1038-gkeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1041-aws-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-fipsUpgrade linux-image-6.8.0-1042-gcp-64kUpgrade linux-image-6.8.0-1039-ibmUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-5.15.0-1080-raspiUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-5.15.0-1039-nvidia-tegraUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-gcp-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1041-awsUpgrade linux-image-5.15.0-1081-intel-iotgUpgrade linux-image-generic-64k-6.8Upgrade linux-image-azureUpgrade linux-image-azure-6.11Upgrade linux-image-oem-20.04dUpgrade linux-image-6.8.0-1041-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1042-gcpUpgrade linux-image-5.15.0-142-generic-lpaeUpgrade linux-image-nvidia-tegraUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-5.15.0-1028-nvidia-tegra-igx-rtUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-gcp-fipsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.11.0-28-genericUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1038-oracle-64kUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidiaUpgrade linux-image-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-generic-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-5.15.0-1078-ibmUpgrade linux-image-5.15.0-1028-nvidia-tegra-igxUpgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-1041-nvidia-64kUpgrade linux-image-6.8.0-86-lowlatency-64kUpgrade linux-image-azure-fde-6.11Upgrade linux-image-6.8.0-86-genericUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-5.15.0-142-fipsUpgrade linux-image-5.15.0-142-lowlatencyUpgrade linux-image-6.8.0-86-generic-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-gke-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibm-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-ibm-classicUpgrade linux-image-awsUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-5.15.0-1086-aws-64kUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1068-gkeopUpgrade linux-image-raspi-realtimeUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1041-raspiUpgrade linux-image-5.15.0-1086-awsUpgrade linux-image-gke-6.8Upgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-oem-22.04aUpgrade linux-image-oem-24.04bUpgrade linux-image-oem-20.04bUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1083-intel-iotgUpgrade linux-image-5.15.0-142-generic-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-22.04cUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-aws-6.8Upgrade linux-image-5.15.0-1086-aws-fipsUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-lowlatency-6.11Upgrade linux-image-6.8.0-1041-nvidiaUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1025-gkeopUpgrade linux-image-6.8.0-1041-nvidia-lowlatencyUpgrade linux-image-aws-64k-lts-24.04 | Jun 20, 2025 | Apr 16, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub