GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74689 (GCVE-0-2026-74689)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() vcc_setsockopt() contained an ineffective optlen check: if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname)) return -EINVAL; If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != __SO_SIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copy_from_sockptr() assuming optval contained sufficient space. Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size. Fix this by using copy_safe_from_sockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SO_SETCLP matches its sizeof(int) ABI encoding on 64-bit systems.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b3bcd5d65ac03c15787b2a5b36c718e26a689336 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 35f258fee9ed358c6d0f57f91c30bf029c3724af (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6eb6af88710977eb529b558a07294874d8c40c4d (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9f77c1ab382188f5b51982fab6d913443b6dc59f (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2c5988c7349c0b64a7e0441bfc6e1dca54f7116a (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/atm/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3bcd5d65ac03c15787b2a5b36c718e26a689336",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "35f258fee9ed358c6d0f57f91c30bf029c3724af",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6eb6af88710977eb529b558a07294874d8c40c4d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9f77c1ab382188f5b51982fab6d913443b6dc59f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2c5988c7349c0b64a7e0441bfc6e1dca54f7116a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/atm/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/atm: fix slab-out-of-bounds read in vcc_setsockopt()\n\nvcc_setsockopt() contained an ineffective optlen check:\n  if (__SO_LEVEL_MATCH(optname, level) \u0026\u0026 optlen != __SO_SIZE(optname))\n      return -EINVAL;\n\nIf __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller\npassed a mismatched level), the length check optlen != __SO_SIZE(optname)\nwas short-circuited and bypassed. Execution then fell through to switch(optname),\ncalling copy_from_sockptr() assuming optval contained sufficient space.\n\nFurthermore, even if level matched, a cgroup BPF setsockopt filter could shrink\noptlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(),\nthis leads to a KASAN slab-out-of-bounds read when optlen is smaller than the\nexpected structure size.\n\nFix this by using copy_safe_from_sockptr(), which unconditionally validates\nthat optlen is at least the expected size before copying. Also change the local\n\u0027value\u0027 variable type from \u0027unsigned long\u0027 to \u0027int\u0027 so that SO_SETCLP matches\nits sizeof(int) ABI encoding on 64-bit systems."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the local setsockopt(2) syscall on an AF_ATMPVC/AF_ATMSVC socket (do_sock_setsockopt -\u003e pvc_setsockopt/svc_setsockopt -\u003e vcc_setsockopt); no remote ATM packet or network-facing handler invokes this path.\nAC:L - The attacker fully controls level, optname, and optlen; passing a mismatched level bypasses the short-circuited length check, and cgroup BPF setsockopt can shrink optlen after entry, deterministically triggering a full-size memcpy past a small kmalloc buffer with no race.\nPR:L - No capability check guards SO_ATMQOS or SO_SETCLP on unconnected ATM sockets; any unprivileged local user in init_net (required because ATM socket creation rejects non-init network namespaces) can open AF_ATMPVC sockets and issue the crafted setsockopt without CAP_NET_ADMIN.\nUI:N - The attacker triggers the out-of-bounds read entirely from their own process with a single crafted setsockopt call; no victim interaction or cooperation is required.\nS:U - Impact is kernel heap memory disclosure and potential crash within the host kernel security boundary; no VM escape, IOMMU bypass, or cross-sandbox boundary crossing occurs.\nC:H - copy_from_sockptr() performs a slab-out-of-bounds read of up to 92 bytes (struct atm_qos) or 8 bytes (SO_SETCLP) past a kmalloc buffer into kernel stack memory; adjacent slab contents can populate vcc-\u003eqos and be retrieved via subsequent SO_ATMQOS getsockopt.\nI:N - The defect is a pure out-of-bounds read with no arbitrary kernel write, heap corruption, or control-flow hijack primitive; although leaked bytes may influence vcc-\u003eqos if validation passes, no attacker-controlled data modification occurs.\nA:H - The KASAN-reported slab-out-of-bounds read triggers kernel oops on hardened kernels, and reading past a small kmalloc object into adjacent slab memory on production kernels risks faulting on unmapped redzone pages or corrupting adjacent objects leading to panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:33.932Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3bcd5d65ac03c15787b2a5b36c718e26a689336"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f258fee9ed358c6d0f57f91c30bf029c3724af"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eb6af88710977eb529b558a07294874d8c40c4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f77c1ab382188f5b51982fab6d913443b6dc59f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c5988c7349c0b64a7e0441bfc6e1dca54f7116a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3"
        }
      ],
      "title": "net/atm: fix slab-out-of-bounds read in vcc_setsockopt()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74689",
    "datePublished": "2026-08-22T15:32:54.034Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:33.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74689",
      "date": "2026-09-16",
      "epss": "0.00139",
      "percentile": "0.03645"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:45:46.000Z",
      "cve": "CVE-2026-74689",
      "id": "msrc_CVE-2026-74689",
      "initial_release_date": "2026-08-24T01:02:25.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/atm: fix slab-out-of-bounds read in vcc_setsockopt()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74689.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74689\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:43.303\",\"lastModified\":\"2026-08-25T06:18:51.960\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/atm: fix slab-out-of-bounds read in vcc_setsockopt()\\n\\nvcc_setsockopt() contained an ineffective optlen check:\\n  if (__SO_LEVEL_MATCH(optname, level) \u0026\u0026 optlen != __SO_SIZE(optname))\\n      return -EINVAL;\\n\\nIf __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller\\npassed a mismatched level), the length check optlen != __SO_SIZE(optname)\\nwas short-circuited and bypassed. Execution then fell through to switch(optname),\\ncalling copy_from_sockptr() assuming optval contained sufficient space.\\n\\nFurthermore, even if level matched, a cgroup BPF setsockopt filter could shrink\\noptlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(),\\nthis leads to a KASAN slab-out-of-bounds read when optlen is smaller than the\\nexpected structure size.\\n\\nFix this by using copy_safe_from_sockptr(), which unconditionally validates\\nthat optlen is at least the expected size before copying. Also change the local\\n\u0027value\u0027 variable type from \u0027unsigned long\u0027 to \u0027int\u0027 so that SO_SETCLP matches\\nits sizeof(int) ABI encoding on 64-bit systems.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/atm/common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b3bcd5d65ac03c15787b2a5b36c718e26a689336\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"35f258fee9ed358c6d0f57f91c30bf029c3724af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"6eb6af88710977eb529b558a07294874d8c40c4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"9f77c1ab382188f5b51982fab6d913443b6dc59f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"2c5988c7349c0b64a7e0441bfc6e1dca54f7116a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/atm/common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2c5988c7349c0b64a7e0441bfc6e1dca54f7116a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/35f258fee9ed358c6d0f57f91c30bf029c3724af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6eb6af88710977eb529b558a07294874d8c40c4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9f77c1ab382188f5b51982fab6d913443b6dc59f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b3bcd5d65ac03c15787b2a5b36c718e26a689336\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:54:20+00:00",
      "cve": "CVE-2026-74689",
      "id": "CVE-2026-74689",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/atm: fix slab-out-of-bounds read in vcc_setsockopt()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74689.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-15T01:16:34Z",
      "cve": "CVE-2026-74689",
      "id": "CVE-2026-74689",
      "initial_release_date": "2026-09-03T16:27:13Z",
      "product_status:known_affected": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74689",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74689.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.