bpf: Reject negative optlen in cgroup getsockopt hook
Published Sep 17, 2026
No CVSS score
EPSS 0.22%
Description
A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original length.
If BPF writes a negative optlen, that value is accepted and propagated back to the TCP getsockopt code. It can then be passed to copy_to_sockptr() as a size_t and trigger the hardened usercopy bytes > INT_MAX warning.
Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(), matching the lower-bound validation already present in the sockptr-based getsockopt hook.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 5.10.188StatusaffectedConstraints<5.10.270
- Version
-
- Version 5.12StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<5.12
- Version 5.10.270StatusunaffectedConstraints<=5.10.*
- Version 5.15.221StatusunaffectedConstraints<=5.15.*
- Version 6.1.188StatusunaffectedConstraints<=6.1.*
- Version 6.12.110StatusunaffectedConstraints<=6.12.*
- Version 6.18.52StatusunaffectedConstraints<=6.18.*
- Version 6.6.157StatusunaffectedConstraints<=6.6.*
- Version 7.2.6StatusunaffectedConstraints<=7.2.*
- Version 7.3-rc1StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
| |||||||||||||||||||||||||||||||||
| Linux | Linux | unaffected |
| |||||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
No CWE recorded.
References (9)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81750 Advisory
- https://git.kernel.org/stable/c/1b5aacd5b2419b0790e955e466d389a61c79b4b1
- https://git.kernel.org/stable/c/2bdbe00454200fcb0110f31eeca8d906a3515e74
- https://git.kernel.org/stable/c/31a89af4f513d750fec196e2bb6195a7d4473e9f
- https://git.kernel.org/stable/c/554ba7195c4108726450e24480c8449990c2268c
- https://git.kernel.org/stable/c/5b09d984b38b018b123c3a9e02a96bbc6468dbe5
- https://git.kernel.org/stable/c/d02a12b4085ffe41ea750b1007f7a9c7aee2875a
- https://git.kernel.org/stable/c/e6fbf0eba87f50084d67508898f6ad6fc7ff1ba2
- https://git.kernel.org/stable/c/f68671b1a98d426c57864bd457c125fee14ac1a5
Change history (0)
No recorded changes yet.