CVE-2026-74689

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

vcc_setsockopt() contained an ineffective optlen check:

if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname))

return -EINVAL;

If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller

passed a mismatched level), the length check optlen != __SO_SIZE(optname)

was short-circuited and bypassed. Execution then fell through to switch(optname),

calling copy_from_sockptr() assuming optval contained sufficient space.

Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink

optlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(),

this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the

expected structure size.

Fix this by using copy_safe_from_sockptr(), which unconditionally validates

that optlen is at least the expected size before copying. Also change the lo

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References