CVE-2026-90327
Description
In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pep_getsockopt() clamps the reported length to the caller's buffer with min_t(), but then stores the value with put_user(val, (int __user *) optval), which always writes sizeof(int) bytes. A getsockopt() call with an optlen smaller than sizeof(int) thus reports the clamped length yet writes a full int, one to three bytes past the user buffer. Write the value with copy_to_user() bounded by len, so at most optlen bytes are copied, matching the length reported back to userspace.
How to fix
- Linux Linux6054fed6bad08b6d03973e8ffca7f0c9394d1c30, eac733a0b6fe0a52d91f9f623425735ed50ac6c2, 95e0ed2439dd1792eb454c68ae8d10f30ffe3bff, 056eea1a2068ad2fb7c3093c5f1095268f87d0c7, 1bf499e438da80455e258049bce60ffb3a53f3fa, c4487e4d5309de587479ecc2f5173b49586f46f4, f97022fefe6eb06ee18549d603420440f2959802, 77e5eb0e192aec6710c03ca8144582fd2af36ca4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a ≤ v < 6054fed6bad08b6d03973e8ffca7f0c9394d1c30, 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a ≤ v < eac733a0b6fe0a52d91f9f623425735ed50ac6c2, 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a ≤ v < 95e0ed2439dd1792eb454c68ae8d10f30ffe3bff, 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a ≤ v < 056eea1a2068ad2fb7c3093c5f1095268f87d0c7, 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a ≤ v < 1bf499e438da80455e258049bce60ffb3a53f3fa, 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a ≤ v < c4487e4d5309de587479ecc2f5173b49586f46f4, 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a ≤ v < f97022fefe6eb06ee18549d603420440f2959802, 02a47617cdce440f60c71a51f3a93f9f5fcc5a7a ≤ v < 77e5eb0e192aec6710c03ca8144582fd2af36ca4, 2.6.28 | 6054fed6bad08b6d03973e8ffca7f0c9394d1c30, eac733a0b6fe0a52d91f9f623425735ed50ac6c2, 95e0ed2439dd1792eb454c68ae8d10f30ffe3bff, 056eea1a2068ad2fb7c3093c5f1095268f87d0c7, 1bf499e438da80455e258049bce60ffb3a53f3fa, c4487e4d5309de587479ecc2f5173b49586f46f4, f97022fefe6eb06ee18549d603420440f2959802, 77e5eb0e192aec6710c03ca8144582fd2af36ca4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.