Description
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and
in tcp_add_backlog(), the variable limit is caculated by adding
sk_rcvbuf, sk_sndbuf and 64 * 1024, it may exceed the max value
of int and overflow. This patch reduces the limit budget by
halving the sndbuf to solve this issue since ACK packets are much
smaller than the payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 4.9 | 5.4.278 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.0.7-1 | — |
| Debian 13 | linux | 6.0.7-1 | — |
| Debian 12 | linux | 6.0.7-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1014.16 | — |
| Ubuntu 24.04 LTS | linux-riscv +10 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-60.66 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1030.34 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1033.40 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1033.40.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1029.36 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1027.32 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1015.19 | — |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1025.28 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1025.30 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1028.33 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1017.17 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1029.35 | — |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1024.26 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-192.212 | — |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1130.140 | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1030.34~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1135.142 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1033.40~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1090.97 | — |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1134.143 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1029.36~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-60.66~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1077.82 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1025.30~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1042.43 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1118.125 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1129.138 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1029.35~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1114.126 | — |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1029.33~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1049.53 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1130.140+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1135.142+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1104.114 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1134.143+fips1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +5 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux-aws-5.4 | 5.4.0-1130.140~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-azure-5.4 | 5.4.0-1135.142~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-gcp-5.4 | 5.4.0-1134.143~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-hwe-5.4 | 5.4.0-192.212~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-ibm-5.4 | 5.4.0-1077.82~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-oracle-5.4 | 5.4.0-1129.138~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-raspi-5.4 | 5.4.0-1114.126~18.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-gcp +4 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-azure | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.2.0-362.8.1.el9_3 | RHSA-2023:6583 |
| RHEL 9 | rv +64 | 5.14.0-362.8.1.el9_3 | RHSA-2023:6583 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.100.1.rt7.441.el8_10 | RHSA-2026:1661 |
| RHEL 8 | perf +26 | 4.18.0-553.100.1.el8_10 | RHSA-2026:1662 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 E4S | bpftool | 7.0.0-284.155.1.el9_2 | RHSA-2026:1909 |
| RHEL 9.2 E4S | kernel-rt +14 | 5.14.0-284.155.1.rt14.440.el9_2 | RHSA-2026:1946 |
| RHEL 9.2 E4S | perf +47 | 5.14.0-284.155.1.el9_2 | RHSA-2026:1909 |
| RHEL 9.0 E4S | kernel-rt +12 | 5.14.0-70.165.1.rt21.237.el9_0 | RHSA-2026:2577 |
| RHEL 9.0 E4S | perf +28 | 5.14.0-70.165.1.el9_0 | RHSA-2026:2573 |
| RHEL 8.8 TUS | perf +17 | 4.18.0-477.130.1.el8_8 | RHSA-2026:3277 |
| RHEL 8.8 E4S | perf +18 | 4.18.0-477.130.1.el8_8 | RHSA-2026:3277 |
| RHEL 8.6 TUS | perf +17 | 4.18.0-372.179.1.el8_6 | RHSA-2026:2490 |
| RHEL 8.6 E4S | perf +25 | 4.18.0-372.179.1.el8_6 | RHSA-2026:2490 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.179.1.el8_6 | RHSA-2026:2490 |
| RHEL 8.4 EUS Long Life | perf +17 | 4.18.0-305.186.1.el8_4 | RHSA-2026:3360 |
| RHEL 8.4 AUS | perf +17 | 4.18.0-305.186.1.el8_4 | RHSA-2026:3360 |
| RHEL 8.2 AUS | perf +17 | 4.18.0-193.187.1.el8_2 | RHSA-2026:3388 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.100.1.rt7.441.el8_10 | ALSA-2026:1661 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.100.1.el8_10 | ALSA-2026:1662 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | kernel | 4.18.0-553.100.1.el8_10 | RLSA-2026:1662 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.100.1.rt7.441.el8_10 | RLSA-2026:1661 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.293.1 | SUSE-SU-2026:0473-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.293.1 | SUSE-SU-2026:0473-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_77 | 1-8.3.1 | SUSE-SU-2026:0473-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | perf +19 | 4.18.0-553.100.1.el8_10 | ELSA-2026-1662 |
Advisories 19
- WID-SEC-2025-2941 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 9, 2026
- ALSA-2026:1661 Moderate: kernel-rt security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1662 Moderate: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:6583 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:3388 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- RHSA-2026:3360 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- RHSA-2026:3277 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- RHSA-2026:2577 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- RHSA-2026:2573 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- RHSA-2026:2490 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- RHSA-2026:1946 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- RHSA-2026:1909 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- RHSA-2026:1661 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- RHSA-2026:1662 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 27, 2026
- WID-SEC-2026-0783 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- SUSE-SU-2026:0473-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- RLSA-2026:1661 Moderate: kernel-rt security update Rocky Linux Security Advisories · Feb 11, 2026
- RLSA-2026:1662 Moderate: kernel security update Rocky Linux Security Advisories · Feb 11, 2026
- ELSA-2026-1662 Moderate: kernel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 2, 2026
References
- https://git.kernel.org/stable/c/9d04b4d0feee12bce6bfe37f30d8e953d3c30368
- https://git.kernel.org/stable/c/4f23cb2be530785db284a685d1b1c30224d8a538
- https://git.kernel.org/stable/c/a85d39f14aa8a71e29cfb5eb5de02878a8779898
- https://git.kernel.org/stable/c/28addf029417d53b1df062b4c87feb7bc033cb5f
- https://git.kernel.org/stable/c/ec791d8149ff60c40ad2074af3b92a39c916a03f