Description
In the Linux kernel, the following vulnerability has been resolved:
net: ioam6: fix OOB and missing lock
When trace->type.bit6 is set:
if (trace->type.bit6) {
...
queue = skb_get_tx_queue(dev, skb);
qdisc = rcu_dereference(queue->qdisc);
This code can lead to an out-of-bounds access of the dev->_tx[] array
when is_input is true. In such a case, the packet is on the RX path and
skb->queue_mapping contains the RX queue index of the ingress device. If
the ingress device has more RX queues than the egress device (dev) has
TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues.
Add a check to avoid this situation since skb_get_tx_queue() does not
clamp the index. This issue has also revealed that per queue visibility
cannot be accurate and will be replaced later as a new feature.
While at it, add missing lock around qdisc_qstats_qlen_backlog(). The
function __ioam6_fill_trace_data() is called from both softirq and
process contexts, hence the use of spin_lock_bh() here.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.17 | 6.1.191 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.19.14-1 | — |
| Debian 13 | linux | 6.12.115-2 | — |
| Debian 12 | linux | No fix yet | — |
| Debian 12 | linux-6.12 | 6.12.115-2~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1028.33 | — |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1006.6 | — |
| Ubuntu 25.10 | linux | 6.17.0-40.40 | USN-8490-1 |
| Ubuntu 25.10 | linux-aws | 6.17.0-1019.19 | USN-8490-1 |
| Ubuntu 25.10 | linux-azure +1 | No fix yet | — |
| Ubuntu 25.10 | linux-gcp | 6.17.0-1020.22 | USN-8490-1 |
| Ubuntu 25.10 | linux-oracle | 6.17.0-1018.18 | USN-8490-1 |
| Ubuntu 25.10 | linux-raspi | 6.17.0-1021.21 | USN-8546-1 |
| Ubuntu 25.10 | linux-realtime | 6.17.0-1017.19 | USN-8490-2 |
| Ubuntu 25.10 | linux-riscv | 6.17.0-40.40.1 | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-137.137 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1062.65 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-aws-6.17 | 6.17.0-1019.19~24.04.1 | USN-8490-1 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1064.72 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-azure-6.17 | 6.17.0-1021.21~24.04.1 | USN-8604-1 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1063.70 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1065.73 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-gcp-6.17 | 6.17.0-1020.22~24.04.1 | USN-8490-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1060.68 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1047.51 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-hwe-6.17 | 6.17.0-40.40~24.04.1 | USN-8545-1 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1062.63 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-137.137.1 | USN-8630-2 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1060.63 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-nvidia-6.17 | 6.17.0-1026.26 | USN-8508-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1060.63.1 | USN-8630-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1031.32 | USN-8630-2 |
| Ubuntu 24.04 LTS | linux-oem-6.17 | 6.17.0-1028.28 | USN-8491-1 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1059.62 | USN-8630-2 |
| Ubuntu 24.04 LTS | linux-oracle-6.17 +1 | 6.17.0-1018.18~24.04.1 | USN-8605-1, USN-8490-1 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1062.66 | USN-8630-5 |
| Ubuntu 24.04 LTS | linux-riscv +20 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-vmware | 6.8.0-1008.8 | — |
| Ubuntu 24.04 LTS | linux-xilinx | 6.8.0-1034.35 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1062.65~22.04.2 | USN-8630-4 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1064.72~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1063.70~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1065.73~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-138.138~22.04.1 | USN-8656-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1062.63~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-137.137.1~22.04.1 | USN-8630-2 |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1060.63~22.04.1 | USN-8630-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1059.62~22.04.1 | USN-8630-3 |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv-6.8 | 6.8.0-137.137~22.04.1 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2051.53 | USN-8630-5 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1057.58 | USN-8630-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.17 | 6.17.0-1017.19~24.04.1 | USN-8490-2 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1057.58~22.04.1 | USN-8630-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1062.65+fips1 | USN-8630-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-azure-fips | 6.8.0-1064.72+fips1 | USN-8630-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-137.137+fips1 | USN-8630-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips | 6.8.0-1065.73+fips1 | USN-8630-1 |
| Ubuntu Pro 26.04 LTS | linux | 7.0.0-30.30 | LSN-0122-1 |
| Ubuntu Pro 26.04 LTS | linux-aws | 7.0.0-1011.11 | LSN-0122-1 |
| Ubuntu Pro 26.04 LTS | linux-azure | 7.0.0-1012.12 | LSN-0122-1 |
| Ubuntu Pro 26.04 LTS | linux-gcp | 7.0.0-1010.10 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux | 6.8.0-142.142 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-aws | 6.8.0-1065.68 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-azure | 6.8.0-1068.76 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-gcp | 6.8.0-1069.77 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-gke | 6.8.0-1064.72 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-ibm | 6.8.0-1065.66 | LSN-0122-1 |
| Ubuntu Pro 24.04 LTS | linux-oracle | 6.8.0-1062.65 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux | 5.15.0-202.212 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-aws | 5.15.0-1119.126 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-aws-6.8 | 6.8.0-1065.68~22.04.1 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-azure | 5.15.0-1125.134 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-gcp | 5.15.0-1120.130 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-gcp-6.8 | 6.8.0-1069.77~22.04.1 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-gke | 5.15.0-1115.121 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-hwe-6.8 | 6.8.0-149.149~22.04.1 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-ibm | 5.15.0-1113.117 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-ibm-6.8 | 6.8.0-1066.67~22.04.1 | LSN-0122-1 |
| Ubuntu Pro 22.04 LTS | linux-lowlatency | 5.15.0-197.207 | LSN-0122-1 |
| Ubuntu Pro 20.04 LTS | linux | 5.4.0-245.265 | LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux | 4.15.0-260.272 | LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-aws | 4.15.0-1197.210 | LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-azure-4.15 | 4.15.0-1207.222 | LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-gcp-4.15 | 4.15.0-1190.207 | LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-hwe-5.4 | 5.4.0-245.265~18.04.1 | LSN-0122-1 |
| Ubuntu Pro 18.04 LTS | linux-oracle | 4.15.0-1160.171 | LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux | 4.4.0-291.325 | LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-aws | 4.4.0-1200.215 | LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1197.210~16.04.1 | LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1208.223~16.04.1 | LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-gcp | 4.15.0-1190.207~16.04.1 | LSN-0122-1 |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-260.272~16.04.2 | LSN-0122-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +7 | 6.4.0-150700.53.63.1 | SUSE-SU-2026:2722-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.63.1.150700.17.37.1 | SUSE-SU-2026:2722-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1, SUSE-SU-2026:22812-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22769-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.36.1 | SUSE-SU-2026:22769-1, SUSE-SU-2026:22742-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-48.1.21.25 | SUSE-SU-2026:22460-1 |
| SLE Micro 6.1 | kernel-rt +4 | 6.4.0-48.1 | SUSE-SU-2026:22460-1, SUSE-SU-2026:22458-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-48.1.21.25 | SUSE-SU-2026:22436-1 |
| SLE Micro 6.0 | kernel-rt +4 | 6.4.0-48.1 | SUSE-SU-2026:22436-1, SUSE-SU-2026:22433-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.63.1 | SUSE-SU-2026:2722-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_17 | 1-150700.1.3.1 | SUSE-SU-2026:2799-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_17 | 1-150700.15.3.1 | SUSE-SU-2026:2722-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +2 | 6.4.0-150700.7.62.1 | SUSE-SU-2026:2799-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | openSUSE-SU-2026:21388-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.36.1 | openSUSE-SU-2026:21388-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.25-55.108 +2 | 1:1.0-0.amzn2023 | ALAS2023-2026-1894, ALAS2023-2026-1882, ALAS2023-2026-1693 |
| Amazon Linux 2023 | perf +11 | 1:6.1.175-219.357.amzn2023 | ALAS2023-2026-1882 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.92-122.166.amzn2023 | ALAS2023-2026-1894 |
| Amazon Linux 2023 | perf6.18 +11 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | No fix yet | — |
Advisories 30
- LSN-0122-1 Kernel Live Patch Security Notice Ubuntu Security Notices (USN) · Nov 12, 2026
- WID-SEC-2026-1385 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8604-1 linux-azure-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8546-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8490-2 linux-realtime, linux-realtime-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8508-1 linux-nvidia-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8491-1 linux-oem-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8545-1 linux-hwe-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8490-1 linux, linux-aws, linux-aws-6.17, linux-gcp, linux-gcp-6.17, linux-oracle, linux-oracle-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8605-1 linux-azure-fde-6.17 vulnerabilities Ubuntu Security Notices (USN) · Oct 17, 2026
- USN-8630-1 linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-6.8, linux-azure-fde, linux-azure-fde-6.8, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-6.8, linux-gcp-fips, linux-gke, linux-gkeop, linux-ibm, linux-ibm-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-realtime, linux-realtime-6.8, linux-xilinx vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- USN-8630-3 linux-oracle-6.8 vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8630-4 linux-aws-6.8 vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8630-5 linux-raspi, linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8630-2 linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia-tegra, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- USN-8656-1 linux-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Sep 11, 2026
- ALAS2023-2026-1894 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 6, 2026
- ALAS2023-2026-1882 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 1, 2026
- SUSE-SU-2026:22835-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22812-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 28, 2026
- openSUSE-SU-2026:21388-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:22769-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 23, 2026
- SUSE-SU-2026:22742-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 23, 2026
- SUSE-SU-2026:2799-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:22458-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 4, 2026
- SUSE-SU-2026:22460-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 4, 2026
- SUSE-SU-2026:22433-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 3, 2026
- SUSE-SU-2026:22436-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 3, 2026
- SUSE-SU-2026:2722-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 2, 2026
- ALAS2023-2026-1693 Important: kernel6.18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 19, 2026
References
- https://git.kernel.org/stable/c/d8fa972c543e6a41f9a0873a725fd1d8d4d9dbfc
- https://git.kernel.org/stable/c/a05a85779c2574b6534abb8cdc6d65fbc2e91208
- https://git.kernel.org/stable/c/f1af9d19503b73011dae5051c354fd39b03e240d
- https://git.kernel.org/stable/c/6d1d9ed9b409e0662241e3d245d574a18f643494
- https://git.kernel.org/stable/c/95a1334748c95dd15546056280ade0c4b8dd7b78
- https://git.kernel.org/stable/c/b30b1675aa2bcf0491fd3830b051df4e08a7c8ca