KernelScan.io

HIGH Introduced in 2.6.12

atm SockOpt OOB

CVE-2026-74689

CVSS 7.1 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

KernelScan AI3.4LOW

01

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() vcc_setsockopt() contained an ineffective optlen check: if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname)) return -EINVAL; If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != __SO_SIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copy_from_sockptr() assuming optval contained sufficient space. Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size. Fix this by using copy_safe_from_sockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SO_SETCLP matches its sizeof(int) ABI encoding on 64-bit systems.

02

Engine v0.6.0

Risk summary

A local attacker with CAP_NET_ADMIN can trigger a slab-out-of-bounds read in the ATM socket setsockopt path by bypassing an ineffective length validation check. The read is bounded to a fixed structure size and may leak adjacent kernel slab data. Exploitation requires the ATM subsystem to be loaded and init-namespace CAP_NET_ADMIN, limiting exposure to privileged local contexts.

Affectednet/atm/common.c (ATM networking subsystem)

Vulnerability analysis

The ATM socket setsockopt handler contains a length validation check that uses short-circuit evaluation, so when a caller supplies a mismatched protocol level the size check is skipped entirely and the code proceeds to copy a fixed-size structure from the caller's buffer without verifying sufficient data was provided. A secondary path exists where a BPF cgroup setsockopt filter can shrink the buffer length after entry, causing an out-of-bounds read from kernel slab memory because the unchecked copy operation assumes the original expected size. The fix replaces the unchecked copy with a safe variant that unconditionally validates the buffer length before copying, and corrects a type mismatch in a local variable to match the ABI encoding. This vulnerability is reachable locally via the setsockopt syscall on an ATM socket, which requires CAP_NET_ADMIN in the init namespace to create, and the ATM kernel module must be loaded.

03

BranchIntroducedFixed inPatch commit
6.12.6.126.1.183b3bcd5d65ac0
6.122.6.126.12.1046eb6af887109
6.182.6.126.18.459f77c1ab3821
6.62.6.126.6.15235f258fee9ed
7.12.6.127.1.92c5988c7349c
mainline2.6.127.2d0c80dbb9704
cip/6.12.6.126.1.187-cip60b3bcd5d65ac0
cip/6.1-rt2.6.126.1.189-cip61-rt32b3bcd5d65ac0
cip/6.122.6.126.12.104-cip306eb6af887109

04

State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.

CIP treeState
cip/6.12Fixed in 6.12.104-cip30
cip/6.1Fixed in 6.1.187-cip60
cip/6.1-rtFixed in 6.1.189-cip61-rt32
cip/5.10Affected — no CIP fix yet (latest 5.10.271-cip78)
cip/5.10-rtAffected — no CIP fix yet (latest 5.10.268-cip77-rt34)
cip/4.19Affected — no CIP fix yet (latest 4.19.325-cip136)
cip/4.19-rtAffected — no CIP fix yet (latest 4.19.325-cip136-rt50)
cip/4.4Affected — no CIP fix yet (latest 4.4.302-cip115)
cip/4.4-rtAffected — no CIP fix yet (latest 4.4.302-cip115-rt63)