Description
In the Linux kernel, the following vulnerability has been resolved:
net: netlink: af_netlink: Prevent empty skb by adding a check on len.
Adding a check on len parameter to avoid empty skb. This prevents a
division error in netem_enqueue function which is caused when skb->len=0
and skb->data_len=0 in the randomized corruption step as shown below.
skb->data[prandom_u32() % skb_headlen(skb)] ^= 1<<(prandom_u32() % 8);
Crash Report:
[ 343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family
0 port 6081 - 0
[ 343.216110] netem: version 1.3
[ 343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
[ 343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+
[ 343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.11.0-2.el7 04/01/2014
[ 343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem]
[ 343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff
ff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f
74 <f7> f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03
[ 343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246
[ 343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX:
0000000000000000
[ 343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI:
ffff88800f8eda40
[ 343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09:
ffffffff94fb8445
[ 343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12:
0000000000000000
[ 343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15:
0000000000000020
[ 343.247291] FS: 00007fdde2bd7700(0000) GS:ffff888109780000(0000)
knlGS:0000000000000000
[ 343.248350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4:
00000000000006e0
[ 343.250076] Call Trace:
[ 343.250423] <TASK>
[ 343.250713] ? memcpy+0x4d/0x60
[ 343.251162] ? netem_init+0xa0/0xa0 [sch_netem]
[ 343.251795] ? __sanitizer_cov_trace_pc+0x21/0x60
[ 343.252443] netem_enqueue+0xe28/0x33c0 [sch_netem]
[ 343.253102] ? stack_trace_save+0x87/0xb0
[ 343.253655] ? filter_irq_stacks+0xb0/0xb0
[ 343.254220] ? netem_init+0xa0/0xa0 [sch_netem]
[ 343.254837] ? __kasan_check_write+0x14/0x20
[ 343.255418] ? _raw_spin_lock+0x88/0xd6
[ 343.255953] dev_qdisc_enqueue+0x50/0x180
[ 343.256508] __dev_queue_xmit+0x1a7e/0x3090
[ 343.257083] ? netdev_core_pick_tx+0x300/0x300
[ 343.257690] ? check_kcov_mode+0x10/0x40
[ 343.258219] ? _raw_spin_unlock_irqrestore+0x29/0x40
[ 343.258899] ? __kasan_init_slab_obj+0x24/0x30
[ 343.259529] ? setup_object.isra.71+0x23/0x90
[ 343.260121] ? new_slab+0x26e/0x4b0
[ 343.260609] ? kasan_poison+0x3a/0x50
[ 343.261118] ? kasan_unpoison+0x28/0x50
[ 343.261637] ? __kasan_slab_alloc+0x71/0x90
[ 343.262214] ? memcpy+0x4d/0x60
[ 343.262674] ? write_comp_data+0x2f/0x90
[ 343.263209] ? __kasan_check_write+0x14/0x20
[ 343.263802] ? __skb_clone+0x5d6/0x840
[ 343.264329] ? __sanitizer_cov_trace_pc+0x21/0x60
[ 343.264958] dev_queue_xmit+0x1c/0x20
[ 343.265470] netlink_deliver_tap+0x652/0x9c0
[ 343.266067] netlink_unicast+0x5a0/0x7f0
[ 343.266608] ? netlink_attachskb+0x860/0x860
[ 343.267183] ? __sanitizer_cov_trace_pc+0x21/0x60
[ 343.267820] ? write_comp_data+0x2f/0x90
[ 343.268367] netlink_sendmsg+0x922/0xe80
[ 343.268899] ? netlink_unicast+0x7f0/0x7f0
[ 343.269472] ? __sanitizer_cov_trace_pc+0x21/0x60
[ 343.270099] ? write_comp_data+0x2f/0x90
[ 343.270644] ? netlink_unicast+0x7f0/0x7f0
[ 343.271210] sock_sendmsg+0x155/0x190
[ 343.271721] ____sys_sendmsg+0x75f/0x8f0
[ 343.272262] ? kernel_sendmsg+0x60/0x60
[ 343.272788] ? write_comp_data+0x2f/0x90
[ 343.273332] ? write_comp_data+0x2f/0x90
[ 343.273869] ___sys_sendmsg+0x10f/0x190
[ 343.274405] ? sendmsg_copy_msghdr+0x80/0x80
[ 343.274984] ? slab_post_alloc_hook+0x70/0x230
[ 343.275597] ? futex_wait_setup+0x240/0x240
[ 343.276175] ? security_file_alloc+0x3e/0x170
[ 343.276779] ? write_comp_d
---truncated---
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 3.11 | 4.4.296 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.15.15-1 | — |
| Debian 13 | linux | 5.15.15-1 | — |
| Debian 12 | linux | 5.15.15-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +22 | No fix yet | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-105.119 | — |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1069.73 | — |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1073.76 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1032.35 | — |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1068.72 | — |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1037.38 | — |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1018.20 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1059.62 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1067.72 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1056.63 | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-169.177 | — |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1121.129 | — |
| Ubuntu 18.04 LTS | linux-aws-5.4 | 5.4.0-1069.73~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-azure-4.15 | 4.15.0-1131.144 | — |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1073.76~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp-4.15 | 4.15.0-1116.130 | — |
| Ubuntu 18.04 LTS | linux-gcp-5.4 | 5.4.0-1068.72~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-105.119~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-ibm-5.4 | 5.4.0-1018.20~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1107.109 | — |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1087.95 | — |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1067.72~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1056.63~18.04.1 | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1069.73+fips2 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1073.76+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1046.52 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1067.71~20.04.1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2061.63 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2043.47 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1078.87 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-gcp-fips | 4.15.0-2026.28 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | 4.4.0-1111.118 | — |
| Ubuntu Pro 16.04 LTS | linux | 4.4.0-266.300 | USN-7332-1 |
| Ubuntu Pro 16.04 LTS | linux-aws | 4.4.0-1179.194 | USN-7332-1 |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1120.128~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1131.144~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-gcp | 4.15.0-1116.130~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-169.177~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-kvm | 4.4.0-1142.153 | USN-7332-2 |
| Ubuntu Pro 16.04 LTS | linux-oracle | 4.15.0-1087.95~16.04.1 | — |
| Ubuntu Pro 14.04 LTS | linux | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-aws | 4.4.0-1141.147 | USN-7332-1 |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1131.144~14.04.1 | — |
| Ubuntu Pro 14.04 LTS | linux-lts-xenial | 4.4.0-266.300~14.04.1 | USN-7332-3 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.3.0-427.31.1.el9_4 | RHSA-2024:5363 |
| RHEL 9 | rv +64 | 5.14.0-427.31.1.el9_4 | RHSA-2024:5363 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | bpftool | 7.3.0-427.31.1.el9_4 | ALSA-2024:5363 |
| AlmaLinux 9 | rv +60 | 5.14.0-427.31.1.el9_4 | ALSA-2024:5363 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | kernel | 5.14.0-427.31.1.el9_4 | RLSA-2024:5363 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.73.1 | SUSE-SU-2024:2939-1 |
| SLES 15 SP5 | kernel-azure +2 | 5.14.21-150500.33.63.1 | SUSE-SU-2024:2947-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.73.1.150500.6.33.8 | SUSE-SU-2024:2939-1 |
| SLES 15 SP5 | kernel-docs | 5.14.21-150500.55.73.2 | SUSE-SU-2024:2939-1 |
| SLES 12 SP5 | kernel-azure +2 | 4.12.14-16.194.1 | SUSE-SU-2024:2901-1 |
| SLES 12 SP5 | kernel-docs | 4.12.14-122.225.2 | SUSE-SU-2024:2940-1 |
| SLES 12 SP5 | kernel-syms +3 | 4.12.14-122.225.1 | SUSE-SU-2024:2940-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | kernel-azure +2 | 4.12.14-16.194.1 | SUSE-SU-2024:2901-1 |
| SLES for SAP 12 SP5 | kernel-syms +2 | 4.12.14-122.225.1 | SUSE-SU-2024:2940-1 |
| SLE Real Time 12 SP5 | kernel-rt +3 | 4.12.14-10.197.1 | SUSE-SU-2024:2892-1 |
| SLE Micro 5.5 | kernel-default | 5.14.21-150500.55.73.1 | SUSE-SU-2024:2939-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.73.1.150500.6.33.8 | SUSE-SU-2024:2939-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.64.1 | SUSE-SU-2024:2894-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.73.1 | SUSE-SU-2024:2939-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_17 +1 | 1-150500.11.3.1 | SUSE-SU-2024:2939-1, SUSE-SU-2024:2894-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.225.1 | SUSE-SU-2024:2940-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_59 | 1-8.3.1 | SUSE-SU-2024:2940-1 |
| SUSE Real Time Module 15 SP5 | kernel-rt +3 | 5.14.21-150500.13.64.1 | SUSE-SU-2024:2894-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | dtb-aarch64 +9 | 5.14.21-150500.55.73.1 | SUSE-SU-2024:2939-1 |
| openSUSE Leap 15.5 | kernel-azure +2 | 5.14.21-150500.33.63.1 | SUSE-SU-2024:2947-1 |
| openSUSE Leap 15.5 | kernel-default-base | 5.14.21-150500.55.73.1.150500.6.33.8 | SUSE-SU-2024:2939-1 |
| openSUSE Leap 15.5 | kernel-docs | 5.14.21-150500.55.73.2 | SUSE-SU-2024:2939-1 |
| openSUSE Leap 15.5 | kernel-rt +3 | 5.14.21-150500.13.64.1 | SUSE-SU-2024:2894-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | kernel-default | 5.14.21-150500.55.73.1 | SUSE-SU-2024:2939-1 |
| openSUSE Leap Micro 5.5 | kernel-default-base | 5.14.21-150500.55.73.1.150500.6.33.8 | SUSE-SU-2024:2939-1 |
| openSUSE Leap Micro 5.5 | kernel-rt | 5.14.21-150500.13.64.1 | SUSE-SU-2024:2894-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.262-200.489 | 1.0-0.amzn2 | ALAS2-2022-1749 |
| Amazon Linux 2 | perf +8 | 4.14.262-200.489.amzn2 | ALAS2-2022-1749 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | bpftool | 7.3.0-427.31.1.el9_4 | ELSA-2024-5363 |
| Oracle Linux 9 | rv +27 | 5.14.0-427.31.1.el9_4 | ELSA-2024-5363 |
Advisories 16
- USN-7332-1 linux, linux-aws vulnerabilities Ubuntu Security Notices (USN) · Oct 29, 2026
- USN-7332-2 linux-kvm vulnerabilities Ubuntu Security Notices (USN) · Oct 29, 2026
- USN-7332-3 linux-lts-xenial vulnerabilities Ubuntu Security Notices (USN) · Oct 29, 2026
- ALSA-2024:5363 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:5363 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2024-1418 Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Sep 8, 2026
- RLSA-2024:5363 Important: kernel security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2024:2892-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2940-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2947-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2939-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2901-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1293 IBM DataPower Gateway: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 3, 2025
- ALAS2-2022-1749 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 19, 2025
- SUSE-SU-2024:2894-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2024-5363 Important: kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 14, 2024
References
- https://git.kernel.org/stable/c/c54a60c8fbaa774f828e26df79f66229a8a0e010
- https://git.kernel.org/stable/c/40cf2e058832d9cfaae98dfd77334926275598b6
- https://git.kernel.org/stable/c/54e785f7d5c197bc06dbb8053700df7e2a093ced
- https://git.kernel.org/stable/c/ff3f517bf7138e01a17369042908a3f345c0ee41
- https://git.kernel.org/stable/c/c0315e93552e0d840e9edc6abd71c7db82ec8f51
- https://git.kernel.org/stable/c/dadce61247c6230489527cc5e343b6002d1114c5
- https://git.kernel.org/stable/c/4c986072a8c9249b9398c7a18f216dc26a9f0e35
- https://git.kernel.org/stable/c/f123cffdd8fe8ea6c7fded4b88516a42798797d0