Description
In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: prevent possible heap overwrite In riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send() cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check that userspace sent sufficient data. The result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr which were outside the bounds of the space which cm_chan_msg_send() allocated. Address this by teaching riocm_ch_send() to check that the entire rio_ch_chan_hdr was copied in from userspace.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b6e8d4aa1110306378af0f3472a6b85a1f039a16 to < a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6affectedb6e8d4aa1110306378af0f3472a6b85a1f039a16 to < c03ddc183249f03fc7e057e02cae6f89144d0123affectedb6e8d4aa1110306378af0f3472a6b85a1f039a16 to < 58f664614f8c3d6142ab81ae551e466dc6e092e8affectedb6e8d4aa1110306378af0f3472a6b85a1f039a16 to < ecf5ee280b702270afb02f61b299d3dfe3ec7730affectedb6e8d4aa1110306378af0f3472a6b85a1f039a16 to < 1921781ec4a8824bd0c520bf9363e28a880d14ecaffectedb6e8d4aa1110306378af0f3472a6b85a1f039a16 to < 1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53affectedb6e8d4aa1110306378af0f3472a6b85a1f039a16 to < 6d5c6711a55c35ce09b90705546050408d9d4b61affectedb6e8d4aa1110306378af0f3472a6b85a1f039a16 to < 50695153d7ddde3b1696dbf0085be0033bf3ddb3affected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected5.4.295 to ≤ 5.4.*unaffected5.10.239 to ≤ 5.10.*unaffected5.15.186 to ≤ 5.15.*unaffected6.1.142 to ≤ 6.1.*unaffected6.6.95 to ≤ 6.6.*unaffected6.12.35 to ≤ 6.12.*unaffected6.15.4 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6 ↗
- https://git.kernel.org/stable/c/c03ddc183249f03fc7e057e02cae6f89144d0123 ↗
- https://git.kernel.org/stable/c/58f664614f8c3d6142ab81ae551e466dc6e092e8 ↗
- https://git.kernel.org/stable/c/ecf5ee280b702270afb02f61b299d3dfe3ec7730 ↗
- https://git.kernel.org/stable/c/1921781ec4a8824bd0c520bf9363e28a880d14ec ↗
- https://git.kernel.org/stable/c/1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53 ↗
- https://git.kernel.org/stable/c/6d5c6711a55c35ce09b90705546050408d9d4b61 ↗
- https://git.kernel.org/stable/c/50695153d7ddde3b1696dbf0085be0033bf3ddb3 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗