5.5

CVE-2025-39718

vsock/virtio: Validate length in packet header before skb_put()

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: Validate length in packet header before skb_put()

When receiving a vsock packet in the guest, only the virtqueue buffer
size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately,
virtio_vsock_skb_rx_put() uses the length from the packet header as the
length argument to skb_put(), potentially resulting in SKB overflow if
the host has gone wonky.

Validate the length as advertised by the packet header before calling
virtio_vsock_skb_rx_put().
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.1.63 < 6.1.149
Linux ≫ Linux Kernel Version >= 6.3 < 6.6.103
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.44
Linux ≫ Linux Kernel Version >= 6.13 < 6.16.4
Debian ≫ Debian Linux Version11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.034
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://git.kernel.org/stable/c/969b06bd8b7560efb100a34227619e7d318fbe05
Patch
https://git.kernel.org/stable/c/ee438c492b2e0705d819ac0e25d04fae758d8f8f
Patch
https://git.kernel.org/stable/c/faf332a10372390ce65d0b803888f4b25a388335
Patch
https://git.kernel.org/stable/c/676f03760ca1d69c2470cef36c44dc152494b47c
Patch
https://git.kernel.org/stable/c/0dab92484474587b82e8e0455839eaf5ac7bf894
Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html