CVE-2026-74689

In the Linux kernel, the following vulnerability has been resolved:

net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

vcc_setsockopt() contained an ineffective optlen check:

if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname))

return -EINVAL;

If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller

passed a mismatched level), the length check optlen != __SO_SIZE(optname)

was short-circuited and bypassed. Execution then fell through to switch(optname),

calling copy_from_sockptr() assuming optval contained sufficient space.

Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink

optlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(),

this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the

expected structure size.

Fix this by using copy_safe_from_sockptr(), which unconditionally validates

that optlen is at least the expected size before copying. Also change the local

'value' variable type from 'unsigned long' to 'int' so that SO_SETCLP matches

its sizeof(int) ABI encoding on 64-bit systems.