In the Linux kernel, the following vulnerability has been resolved:
sctp: linearize cloned gso packets in sctp_rcv
A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs.
syzbot reported two use-of-uninitialized-memory bugs caused by this:
BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline]
and
BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline]
This patch fixes it by linearizing cloned gso packets in sctp_rcv().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debugUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-develUpgrade kernel-64k-modules-coreUpgrade kernel-rt-coreUpgrade kernel-64k-coreUpgrade kernel-64kUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernelUpgrade python3-perfUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-coreUpgrade kernel-cross-headersUpgrade kernel-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-coreUpgrade kernel-headersUpgrade rtlaUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-debugUpgrade kernel-tools-libsUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-debug-develUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-64k-debug-develUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade bpftoolUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade rvUpgrade perfUpgrade kernel-develUpgrade kernel-rt-kvmUpgrade kernel-zfcpdumpUpgrade kernel-docUpgrade kernel-rt-develUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-devel-matchedUpgrade libperfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-rt-64kUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debugUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-coreUpgrade kernel-tools | Oct 2, 2025 | Sep 29, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-develUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-headersUpgrade kernel-livepatch-5.10.242-239.961Upgrade perf-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.191-132.213Upgrade perf | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel6.12-libbpf-staticUpgrade kernel-livepatch-6.12.46-66.121Upgrade perfUpgrade kernel6.12-libbpfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel6.12-libbpf-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel-toolsUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-tools-debuginfoUpgrade perf6.12Upgrade bpftool6.12Upgrade kernel-tools-debuginfoUpgrade kernel6.12-headersUpgrade python3-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-libbpf-develUpgrade kernel6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-modules-extraUpgrade python3-perf6.12Upgrade bpftool6.12-debuginfoUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-toolsUpgrade kernel-libbpf-staticUpgrade kernel6.12-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-6.1.163-186.299Upgrade kernelUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-x86_64Upgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-modules-extraUpgrade kernel-libbpfUpgrade python3-perfUpgrade kernel6.12-tools-develUpgrade kernel-headers | Sep 30, 2025 | Sep 4, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Oct 14, 2025 | Oct 14, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perf | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelists | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Feb 3, 2026 | Jan 30, 2026 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Sep 30, 2025 | Sep 4, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Oct 1, 2025 | Sep 4, 2025 |
| Rocky_linux | — | Upgrade python3-perfUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade python3-perf-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade libperfUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernelUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-coreUpgrade kernel-tools-debuginfoUpgrade kernel-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-coreUpgrade kernel-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-develUpgrade kernel-rt-debug-develUpgrade kernel-rt-develUpgrade kernel-tools-libs-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-rtUpgrade kernel-rt-debuginfoUpgrade kernel-modulesUpgrade kernel-debug-modulesUpgrade rvUpgrade kernel-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdumpUpgrade bpftoolUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modulesUpgrade bpftool-debuginfoUpgrade perfUpgrade libperf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade kernel-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade perf-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-modules-core | Feb 5, 2026 | Oct 6, 2025 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-develUpgrade kernel-symsUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade kernel-default-extraUpgrade kernel-docsUpgrade kernel-sourceUpgrade reiserfs-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-zfcpdumpUpgrade kernel-obs-buildUpgrade kernel-default-develUpgrade kernel-64kb | Dec 5, 2025 | Sep 30, 2025 |
| Ubuntu | — | Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-5.15.0-1097-gcpUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-5.15.0-1091-raspiUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-163-fipsUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-163-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1089-kvmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1092-nvidiaUpgrade linux-image-azure-lts-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-ibm-5.15Upgrade linux-image-5.15.0-1089-intel-iot-realtimeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-5.15.0-1102-azureUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-aws-fipsUpgrade linux-image-ibmUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-gcp-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-nvidia-tegraUpgrade linux-image-fipsUpgrade linux-image-5.15.0-1080-gkeopUpgrade linux-image-azure-fips-5.15Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-kvm-5.15Upgrade linux-image-oracleUpgrade linux-image-5.15.0-1094-oracleUpgrade linux-image-5.15.0-163-genericUpgrade linux-image-5.15.0-1091-ibmUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-genericUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-5.15.0-1096-realtimeUpgrade linux-image-lowlatency-5.15Upgrade linux-image-generic-64kUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-intelUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-5.15.0-163-generic-lpaeUpgrade linux-image-aws-64k-5.15Upgrade linux-image-oem-20.04bUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04aUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-generic-5.15Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1092-intel-iotgUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-5.15.0-1049-nvidia-tegra-rtUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1097-gcp-fipsUpgrade linux-image-5.15.0-1092-nvidia-lowlatencyUpgrade linux-image-aws-lts-24.04Upgrade linux-image-aws-5.15Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-oem-20.04dUpgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-oem-22.04dUpgrade linux-image-virtual-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-azureUpgrade linux-image-5.15.0-1093-gkeUpgrade linux-image-raspi-5.15Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-realtime-6.8.1Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-azure-fips-6.8Upgrade linux-image-aws-fips-5.15Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-azure-5.15Upgrade linux-image-5.15.0-1097-awsUpgrade linux-image-5.15.0-163-generic-64kUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-gcp-5.15Upgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1097-aws-64kUpgrade linux-image-aws-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-5.15.0-1101-azure-fipsUpgrade linux-image-xilinx-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-5.15.0-163-lowlatencyUpgrade linux-image-5.15.0-1097-aws-fipsUpgrade linux-image-realtimeUpgrade linux-image-raspiUpgrade linux-image-oracle-5.15Upgrade linux-image-nvidia-5.15Upgrade linux-image-ibm-6.8Upgrade linux-image-5.15.0-1049-nvidia-tegraUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-generic-64k-5.15Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-nvidia-64kUpgrade linux-image-virtual-5.15Upgrade linux-image-aws-64k-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-gcpUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-5.15.0-1101-azureUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-gcp-64kUpgrade linux-image-fips-5.15Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-5.15.0-1061-xilinx-zynqmpUpgrade linux-image-5.15.0-1038-nvidia-tegra-igx-rtUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-azure-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-oem-22.04cUpgrade linux-image-realtime-5.15Upgrade linux-image-xilinxUpgrade linux-image-oracle-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-gkeop-5.15Upgrade linux-image-azure-cvmUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-nvidia-6.8Upgrade linux-image-gke-64kUpgrade linux-image-awsUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-5.15.0-1038-nvidia-tegra-igxUpgrade linux-image-oem-20.04Upgrade linux-image-raspi-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-aws-64k | Dec 5, 2025 | Sep 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 19, 2025 | Sep 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub