Description
In the Linux kernel, the following vulnerability has been resolved:
net_sched: keep alloc_hash updated after hash allocation
In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex")
I moved cp->hash calculation before the first
tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched.
This difference could lead to another out of bound access.
cp->alloc_hash should always be the size allocated, we should
update it after this tcindex_alloc_perfect_hash().
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 4.4.214 – < 4.4.218, 4.9.214 – < 4.9.218, 4.14.171 – < 4.14.175, 4.19.103 – < 4.19.114, 5.4.19 – < 5.4.29, 5.5.3 – < 5.5.14 | 4.4.218 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.5.17-1 | — |
| Debian 13 | linux | 5.5.17-1 | — |
| Debian 12 | linux | 5.5.17-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-realtime +1 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-99.100 | — |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1066.70 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1059.60 | — |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1038.42 | — |
| Ubuntu 16.04 LTS | linux | 4.4.0-179.209 | — |
| Ubuntu 16.04 LTS | linux-aws | 4.4.0-1107.118 | — |
| Ubuntu 16.04 LTS | linux-aws-hwe | 4.15.0-1066.70~16.04.1 | — |
| Ubuntu 16.04 LTS | linux-azure | 4.15.0-1082.92~16.04.1 | — |
| Ubuntu 16.04 LTS | linux-gcp | 4.15.0-1061.65 | — |
| Ubuntu 16.04 LTS | linux-hwe | 4.15.0-99.100~16.04.1 | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu 16.04 LTS | linux-kvm | 4.4.0-1071.78 | — |
| Ubuntu 16.04 LTS | linux-oracle | 4.15.0-1038.42~16.04.1 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1029.34 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | 4.4.0-1034.39 | — |
| Ubuntu Pro 14.04 LTS | linux-aws | 4.4.0-1067.71 | — |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1082.92~14.04.1 | — |
| Ubuntu Pro 14.04 LTS | linux-lts-xenial | 4.4.0-179.209~14.04.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | kernel-64kb +7 | 5.3.18-150300.59.207.1 | SUSE-SU-2025:01982-1 |
| SLES 15 SP3 | kernel-default-base | 5.3.18-150300.59.207.1.150300.18.124.1 | SUSE-SU-2025:01982-1 |
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.261.1 | SUSE-SU-2025:01983-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | kernel-default-base | 5.3.18-150300.59.207.1.150300.18.124.1 | SUSE-SU-2025:01982-1 |
| SLES for SAP 15 SP3 | kernel-docs +5 | 5.3.18-150300.59.207.1 | SUSE-SU-2025:01982-1 |
| SLE Micro 5.2 | kernel-default | 5.3.18-150300.59.207.1 | SUSE-SU-2025:01982-1 |
| SLE Micro 5.2 | kernel-default-base | 5.3.18-150300.59.207.1.150300.18.124.1 | SUSE-SU-2025:01982-1 |
| SLE Micro 5.2 | kernel-rt +1 | 5.3.18-150300.211.1 | SUSE-SU-2025:01995-1 |
| SLE Micro 5.1 | kernel-default | 5.3.18-150300.59.207.1 | SUSE-SU-2025:01982-1 |
| SLE Micro 5.1 | kernel-default-base | 5.3.18-150300.59.207.1.150300.18.124.1 | SUSE-SU-2025:01982-1 |
| SLE Micro 5.1 | kernel-rt +1 | 5.3.18-150300.211.1 | SUSE-SU-2025:01995-1 |
| SLE Live Patching 15 SP3 | kernel-default | 5.3.18-150300.59.207.1 | SUSE-SU-2025:01982-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_58 | 1-150300.7.3.1 | SUSE-SU-2025:01982-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.261.1 | SUSE-SU-2025:01983-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_69 | 1-8.3.1 | SUSE-SU-2025:01983-1 |
| SLE HPC 15 SP3 | kernel-64kb +6 | 5.3.18-150300.59.207.1 | SUSE-SU-2025:01982-1 |
| SLE HPC 15 SP3 | kernel-default-base | 5.3.18-150300.59.207.1.150300.18.124.1 | SUSE-SU-2025:01982-1 |
| SUSE Enterprise Storage 7.1 | kernel-64kb +6 | 5.3.18-150300.59.207.1 | SUSE-SU-2025:01982-1 |
| SUSE Enterprise Storage 7.1 | kernel-default-base | 5.3.18-150300.59.207.1.150300.18.124.1 | SUSE-SU-2025:01982-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.177-139.253 | 1.0-0.amzn2 | ALAS2-2020-1440 |
| Amazon Linux 2 | perf +8 | 4.14.177-139.253.amzn2 | ALAS2-2020-1440 |
Advisories 4
- SUSE-SU-2025:01995-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01982-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:01983-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2020-1440 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 29, 2025
References
- https://git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454
- https://git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386
- https://git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266
- https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2
- https://git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf
- https://git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9
- https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3
- https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534
- https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html