CVE-2026-90327
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
phonet: pep: do not write beyond optlen in getsockopt
In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pep_getsockopt() clamps the reported length to the caller's buffer with min_t(), but then stores the value with put_user(val, (int __user *) optval), which always writes sizeof(int) bytes. A getsockopt() call with an optlen smaller than sizeof(int) thus reports the clamped length yet writes a full int, one to three bytes past the user buffer. Write the value with copy_to_user() bounded by len, so at most optlen bytes are copied, matching the length reported back to userspace.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a | affected | git | 6054fed6bad08b6d03973e8ffca7f0c9394d1c30 | Unavailable | None listed |
| 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a | affected | git | eac733a0b6fe0a52d91f9f623425735ed50ac6c2 | Unavailable | None listed |
| 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a | affected | git | 95e0ed2439dd1792eb454c68ae8d10f30ffe3bff | Unavailable | None listed |
| 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a | affected | git | 056eea1a2068ad2fb7c3093c5f1095268f87d0c7 | Unavailable | None listed |
| 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a | affected | git | 1bf499e438da80455e258049bce60ffb3a53f3fa | Unavailable | None listed |
| 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a | affected | git | c4487e4d5309de587479ecc2f5173b49586f46f4 | Unavailable | None listed |
| 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a | affected | git | f97022fefe6eb06ee18549d603420440f2959802 | Unavailable | None listed |
| 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a | affected | git | 77e5eb0e192aec6710c03ca8144582fd2af36ca4 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.6.28 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 2.6.28 | Unavailable | None listed |
| 5.10.270 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.221 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.188 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.157 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.110 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.52 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.6 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |