Description
The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.3-1 | — |
| Debian 13 | linux | 4.3-1 | — |
| Debian 12 | linux | 4.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-87.133 | USN-2989-1 |
| Ubuntu 14.04 LTS | linux-lts-utopic | 3.16.0-73.95~14.04.1 | USN-3000-1 |
| Ubuntu 14.04 LTS | linux-lts-vivid | 3.19.0-61.69~14.04.1 | USN-3001-1 |
| Ubuntu 14.04 LTS | linux-lts-wily | 4.2.0-38.45~14.04.1 | USN-3002-1 |
Advisories 4
- USN-2989-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3000-1 linux-lts-utopic vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3001-1 linux-lts-vivid vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3002-1 linux-lts-wily vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- USN-3004-1 vendor-advisory
- 74669 vdb-entry
- [linux-kernel] 20150513 [PATCH 0/4] ozwpan: Four remote packet-of-death vulnerabilities mailing-list
- USN-3001-1 vendor-advisory
- USN-3000-1 vendor-advisory
- USN-3002-1 vendor-advisory
- USN-2989-1 vendor-advisory
- [oss-security] 20150605 Re: CVE Request: Linux Kernel Ozwpan Driver - Remote packet-of-death vulnerabilities mailing-list
- USN-3003-1 vendor-advisory
- USN-2998-1 vendor-advisory