Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2026-72298

net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes from the wire. On 32-bit, size_t is 32 bits and ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check passes and skb_put_data(skb, data + hdrlen, size) writes past the hdrlen-sized skb and oopses the kernel. 64-bit is unaffected. This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post"), which fixed only the 64-bit case. Reject any size that cannot fit the buffer before the ALIGN.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 960b08dd36de1e341e3eb43d1c547513e338f4f8 to < 3665e644ea081c4624a1637023b0de3b29f4ae04affected
  • ad9d24c9429e2159d1e279dc3a83191ccb4daf1d to < b609f7f46916c6b05585ca82455077198a23770faffected
  • ad9d24c9429e2159d1e279dc3a83191ccb4daf1d to < 242408b5b763c01288adf3113cbce84378a76e1aaffected
  • ad9d24c9429e2159d1e279dc3a83191ccb4daf1d to < d0597074e99731fdad5593e4f6d056a3866f2cabaffected
  • ad9d24c9429e2159d1e279dc3a83191ccb4daf1d to < 689b7267f8632b4661879dc323e26ebb60978afbaffected
  • ad9d24c9429e2159d1e279dc3a83191ccb4daf1d to < 22100a8f73d4ae4f17697dae93d4e2e1d283a6ecaffected
  • ad9d24c9429e2159d1e279dc3a83191ccb4daf1d to < 7f72c285f6d3bf63968a0344beee8ab1b370198baffected
  • ad9d24c9429e2159d1e279dc3a83191ccb4daf1d to < 20054869770c7df060c5ecee3e8bbf9029c47191affected
  • f8111c0d7ed42ede41a3d0d393b104de0730a8a6affected
  • 26b8d10703a9be45d6097946b2b4011f7dd2c56faffected
  • 19892ab9c9d838e2e5a7744d36e4bb8b7c3292feaffected
  • 5.10.46 to < 5.10.261affected
  • 4.19.196 to < 4.20affected
  • 5.4.128 to < 5.5affected
  • 5.12.13 to < 5.13affected

Linux Linux

Default version status: affected

  • 5.13affected
  • 0 to < 5.13unaffected
  • 5.10.261 to ≤ 5.10.*unaffected
  • 5.15.212 to ≤ 5.15.*unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References