Executive brief
A vulnerability exists in the Linux kernel's implementation of the X.25 networking protocol, which is used for packet-switched data communications. An attacker could exploit this flaw to cause a system crash or instability by sending specially crafted network packets that exceed internal memory limits. This primarily impacts the availability of the affected system, potentially leading to a denial-of-service condition.
Technical details
An integer overflow vulnerability exists in the net/x25 component of the Linux kernel. The root cause is a lack of bounds checking on the `x25_sock.fraglen` variable when accumulating incoming packet fragments in `x25_queue_rx_frame`. Additionally, the `fraglen` counter was not properly reset when purging the `fragment_queue` in `x25_clear_queues()`. A remote attacker can exploit this by sending a sequence of X.25 packets that cause `fraglen` to exceed its maximum value (USHRT_MAX), potentially leading to memory corruption or a kernel panic. Patches have been released across multiple stable kernel branches to add the necessary bounds checks and reset logic.
Affected products
- Linux Linux Kernel versions from 2.6.12.1 up to 5.10.253, 5.11 up to 5.15.203, 5.16 up to 6.1.168, 6.2 up to 6.6.134, 6.7 up to 6.12.81, 6.13 up to 6.18.22, 6.19 up to 6.19.12
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory
- 2026-04-11: patched: Patched in various stable branches by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/1734bd85c5e0a7a801295b729efb56b009cb8fc3
- https://git.kernel.org/stable/c/4e2d1bcef78d21247fe8fef13bc7ed95885df2b5
- https://git.kernel.org/stable/c/6e568835ea54a3e1d08e310e34f95d434e739477
- https://git.kernel.org/stable/c/798d613afb64b01a203f448fb0f43c37c6afe79d
- https://git.kernel.org/stable/c/8c92969c197b91c134be27dc3afb64ab468853a9
- https://git.kernel.org/stable/c/96fc16370b0bceb289c7e0479bd0540b81e257aa
- https://git.kernel.org/stable/c/a1822cb524e89b4cd2cf0b82e484a2335496a6d9