Executive brief
A vulnerability was identified in the Linux kernel's data handling component (scatterlist) that could lead to memory management errors. Specifically, the system could incorrectly calculate data lengths when moving information between different memory buffers, potentially causing data to overlap or exceed intended boundaries. This type of flaw typically impacts system stability and could theoretically be used to access or corrupt sensitive memory, though it is currently rated as low risk.
Technical details
A vulnerability exists in lib/scatterlist.c within the Linux kernel due to improper length calculations in extract_kvec_to_sg and extract_iter_to_sg. When extracting from a kvec to a scatterlist, the code failed to prevent entries from crossing page boundaries, even though the segment length was already calculated. Additionally, when extracting user buffers, the scatterlist was used as a temporary scratch buffer for page pointers, creating a risk of overlapping with existing entries if the list was not empty. These issues can lead to memory corruption or out-of-bounds access. The flaw was originally introduced in v6.3 (in fs/netfs/iterator.c) and moved to lib/scatterlist.c in v6.5. Patches have been released for stable branches v6.5 and newer.
Affected products
- Linux Linux Kernel v6.3 to v6.9.x
Timeline
- 2026-03-26: other: Patch submitted by developer
- 2026-04-02: patched: Patch committed to mainline kernel
- 2026-06-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/07b7d66e65d9cfe6b9c2c34aa22cfcaac37a5c45
- https://git.kernel.org/stable/c/3f17500e86d730c76db638bb3ae52f9b5e496c76
- https://git.kernel.org/stable/c/8fbba6829057979149d1b37d65690c037f3ddf4d
- https://git.kernel.org/stable/c/9d38756d0a93b66163554219fa9c3365f40c4035
- https://git.kernel.org/stable/c/e5e22fc9963469e678c4f4bb38d26adcec107f1e