In the Linux kernel, the following vulnerability has been resolved:
mei: vsc: Fix fortify-panic caused by invalid counted_by() use
gcc 15 honors the __counted_by(len) attribute on vsc_tp_packet.buf[] and the vsc-tp.c code is using this in a wrong way. len does not contain the available size in the buffer, it contains the actual packet length *without* the crc. So as soon as vsc_tp_xfer() tries to add the crc to buf[] the fortify-panic handler gets triggered:
[ 80.842193] memcpy: detected buffer overflow: 4 byte write of buffer size 0 [ 80.842243] WARNING: CPU: 4 PID: 272 at lib/string_helpers.c:1032 __fortify_report+0x45/0x50 ... [ 80.843175] __fortify_panic+0x9/0xb [ 80.843186] vsc_tp_xfer.cold+0x67/0x67 [mei_vsc_hw] [ 80.843210] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90 [ 80.843229] ? lockdep_hardirqs_on+0x7c/0x110 [ 80.843250] mei_vsc_hw_start+0x98/0x120 [mei_vsc] [ 80.843270] mei_reset+0x11d/0x420 [mei]
The easiest fix would be to just drop the counted-by but with the exception of the ack buffer in vsc_tp_xfer_helper() which only contains enough room for the packet-header, all other uses of vsc_tp_packet always use a buffer of VSC_TP_MAX_XFER_SIZE bytes for the packet.
Instead of just dropping the counted-by, split the vsc_tp_packet struct definition into a header and a full-packet definition and use a fixed size buf[] in the packet definition, this way fortify-source buffer overrun checking still works when enabled.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade kernel-azure-develUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-defaultUpgrade kernel-source-vanillaUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade kernel-azureUpgrade kernel-develUpgrade kernel-sourceUpgrade kernel-macrosUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-default-develUpgrade kernel-source-azureUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade kernel-64kb-develUpgrade kernel-default-vdsoUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-azure-extraUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade kernel-obs-qa | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-gke-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-awsUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-raspi-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-generic-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-realtimeUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-ibm-classicUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-aws-fips-6.8Upgrade linux-image-xilinxUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-azure-fipsUpgrade linux-image-oem-22.04dUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-kvmUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-fips-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-gcp-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-gkeopUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidiaUpgrade linux-image-ibmUpgrade linux-image-gkeUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-gkeop-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-genericUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-aws-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-6.8Upgrade linux-image-azureUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-azure-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-fipsUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-aws-fipsUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-intel-iotgUpgrade linux-image-generic-lpae | Jun 26, 2025 | May 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub