Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash or potentially execute unauthorized code. The issue exists in how the system handles specific network address information when displaying internal status reports. This could impact the stability and security of servers or devices running affected versions of the Linux operating system.
Technical details
A stack-based buffer overflow exists in net/rxrpc/proc.c due to insufficient buffer sizing when using the %pISpc format specifier. The AF_RXRPC procfs helpers utilize fixed 50-byte stack buffers to store formatted local and remote socket addresses. However, certain IPv6 address configurations (specifically ISATAP addresses with port numbers) can produce strings up to 51 bytes (including the null terminator). An attacker with local access could potentially trigger this overflow by manipulating network configurations that are subsequently processed by the procfs helpers, leading to memory corruption, system instability, or local privilege escalation. The fix involves increasing the buffer size to accommodate the maximum possible textual representation and transitioning to scnprintf() to prevent out-of-bounds writes.
Affected products
- Linux Linux kernel 4.9 to 6.18.23, 6.19 to 6.19.13, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-18: patched: Patched in stable tree by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874
- https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b
- https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668
- https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1
- https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272
- https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9