High · published September 18, 2025
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix a potential overflow in sctp_ifwdtsn_skip
Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only
checks the pos against the end of the chunk. However, the data left for
the last pos may be < sizeof(struct sctp_ifwdtsn_skip), and dereference
it as struct sctp_ifwdtsn_skip may cause coverflow.
This patch fixes it by checking the pos against "the end of the chunk -
sizeof(struct sctp_ifwdtsn_skip)" in sctp_ifwdtsn_skip, similar to
sctp_fwdtsn_skip.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.16, < 4.19.281 | 4.19.281 |
| linux/linux_kernel | ≥ 4.20, < 5.4.241 | 5.4.241 |
| linux/linux_kernel | ≥ 5.5, < 5.10.178 | 5.10.178 |
| linux/linux_kernel | ≥ 5.11, < 5.15.108 | 5.15.108 |
| linux/linux_kernel | ≥ 5.16, < 6.1.25 | 6.1.25 |
| linux/linux_kernel | ≥ 6.2, < 6.2.12 | 6.2.12 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |