Description
In the Linux kernel, the following vulnerability has been resolved:
skmsg: Fix wrong last sg check in sk_msg_recvmsg()
Fix one kernel NULL pointer dereference as below:
[ 224.462334] Call Trace:
[ 224.462394] __tcp_bpf_recvmsg+0xd3/0x380
[ 224.462441] ? sock_has_perm+0x78/0xa0
[ 224.462463] tcp_bpf_recvmsg+0x12e/0x220
[ 224.462494] inet_recvmsg+0x5b/0xd0
[ 224.462534] __sys_recvfrom+0xc8/0x130
[ 224.462574] ? syscall_trace_enter+0x1df/0x2e0
[ 224.462606] ? __do_page_fault+0x2de/0x500
[ 224.462635] __x64_sys_recvfrom+0x24/0x30
[ 224.462660] do_syscall_64+0x5d/0x1d0
[ 224.462709] entry_SYSCALL_64_after_hwframe+0x65/0xca
In commit 9974d37ea75f ("skmsg: Fix invalid last sg check in
sk_msg_recvmsg()"), we change last sg check to sg_is_last(),
but in sockmap redirection case (without stream_parser/stream_verdict/
skb_verdict), we did not mark the end of the scatterlist. Check the
sk_msg_alloc, sk_msg_page_add, and bpf_msg_push_data functions, they all
do not mark the end of sg. They are expected to use sg.end for end
judgment. So the judgment of '(i != msg_rx->sg.end)' is added back here.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.18.18 – < 5.19, 5.15.61 – < 5.15.66, 5.19.2 – < 5.19.8 | 5.19 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.0.2-1 | — |
| Debian 13 | linux | 6.0.2-1 | — |
| Debian 12 | linux | 6.0.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-57.63 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1027.31 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1030.37 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1030.37.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1026.33 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1024.29 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1012.16 | — |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1022.25 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1023.28 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1025.30 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1026.32 | — |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1022.24 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 +1 | 5.15.0-1027.31~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1030.37~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1027.34~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 | 5.15.0-57.63~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1023.28~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-lowlatency-hwe-5.15 | 5.15.0-58.64~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1027.33~20.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1029.32 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.0.0-284.11.1.el9_2 | RHSA-2023:2458 |
| RHEL 9 | perf +48 | 5.14.0-284.11.1.el9_2 | RHSA-2023:2458 |
Advisories 2
- WID-SEC-2025-1350 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 12, 2026
- RHSA-2023:2458 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026