Description
In the Linux kernel, the following vulnerability has been resolved:
af_netlink: Fix shift out of bounds in group mask calculation
When a netlink message is received, netlink_recvmsg() fills in the address
of the sender. One of the fields is the 32-bit bitfield nl_groups, which
carries the multicast group on which the message was received. The least
significant bit corresponds to group 1, and therefore the highest group
that the field can represent is 32. Above that, the UB sanitizer flags the
out-of-bounds shift attempts.
Which bits end up being set in such case is implementation defined, but
it's either going to be a wrong non-zero value, or zero, which is at least
not misleading. Make the latter choice deterministic by always setting to 0
for higher-numbered multicast groups.
To get information about membership in groups >= 32, userspace is expected
to use nl_pktinfo control messages[0], which are enabled by NETLINK_PKTINFO
socket option.
[0] https://lwn.net/Articles/147608/
The way to trigger this issue is e.g. through monitoring the BRVLAN group:
# bridge monitor vlan &
# ip link add name br type bridge
Which produces the following citation:
UBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19
shift exponent 32 is too large for 32-bit type 'int'
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 2.6.14 | 4.9.311 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.17.3-1 | — |
| Debian 13 | linux | 5.17.3-1 | — |
| Debian 12 | linux | 5.17.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-37.39 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1011.14 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1010.12 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1008.12 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1008.10 | — |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1007.8 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1008.11 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1010.11 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1009.12 | — |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1011.13 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-117.132 | — |
| Ubuntu 20.04 LTS | linux-aws +1 | 5.4.0-1078.84 | — |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1083.87 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1008.9~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1040.44 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 | 5.15.0-41.44~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1026.29 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1008.11~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1004.6 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1068.72 | — |
| Ubuntu 20.04 LTS | linux-lowlatency-hwe-5.15 | 5.15.0-42.45~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1076.83 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1065.75 | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-189.200 | — |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1137.148 | — |
| Ubuntu 18.04 LTS | linux-aws-5.4 +1 | 5.4.0-1078.84~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-azure-4.15 | 4.15.0-1146.161 | — |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1083.87~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp-4.15 | 4.15.0-1131.147 | — |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-117.132~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-ibm-5.4 | 5.4.0-1028.32~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1123.128 | — |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1102.113 | — |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1076.83~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1065.75~18.04.1 | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1014.14 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips +1 | 5.4.0-1078.84+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1083.87+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1054.61 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2076.81 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2057.63 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1094.105 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-gcp-fips | 4.15.0-2041.46 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1137.148~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1146.161~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-gcp | 4.15.0-1131.147~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-189.200~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-oracle | 4.15.0-1102.113~16.04.1 | — |
| Ubuntu Pro 14.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1146.161~14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.4.0-503.11.1.el9_5 | RHSA-2024:9315 |
| RHEL 9 | rv +67 | 5.14.0-503.11.1.el9_5 | RHSA-2024:9315 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.258.1 | SUSE-SU-2025:01600-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.258.1 | SUSE-SU-2025:01600-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_68 | 1-8.3.1 | SUSE-SU-2025:01600-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.276-211.499 | 1.0-0.amzn2 | ALAS2-2024-2569 |
| Amazon Linux 2 | perf +8 | 4.14.276-211.499.amzn2 | ALAS2-2024-2569 |
Advisories 3
- RHSA-2024:9315 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SUSE-SU-2025:01600-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2024-2569 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 19, 2025
References
- https://git.kernel.org/stable/c/e1c5d46f05aa23d740daae5cd3a6472145afac42
- https://git.kernel.org/stable/c/ac5883a8890a11c00b32a19949a25d4afeaa2f5a
- https://git.kernel.org/stable/c/f75f4abeec4c04b600a15b50c89a481f1e7435ee
- https://git.kernel.org/stable/c/41249fff507387c3323b198d0052faed08b14de4
- https://git.kernel.org/stable/c/b0898362188e05b2202656058cc32d98fabf3bac
- https://git.kernel.org/stable/c/7409ff6393a67ff9838d0ae1bd102fb5f020d07a
- https://git.kernel.org/stable/c/e8aaf3134bc5e943048eefe9f2ddaabf41d92b1a
- https://git.kernel.org/stable/c/e23e1e981247feb3c7d0236fe58aceb685f234ae
- https://git.kernel.org/stable/c/0caf6d9922192dd1afa8dc2131abfb4df1443b9f