CVE-2026-43080

취약점 유형

In the Linux kernel, the following vulnerability has been resolved: l2tp: Drop large packets with UDP encap syzbot reported a WARN on my patch series [1]. The actual issue is an overflow of 16-bit UDP length field, and it exists in the upstream code. My series added a debug WARN with an overflow check that exposed the issue, that's why syzbot tripped on my patches, rather than on upstream code. syzbot's repro: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="ee", 0x34000}], 0x1) It basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP encapsulation, and l2tp_xmit_core doesn't check for overflows when it assigns the UDP length field. The value gets trimmed to 16 bites. Add an overflow check that drops oversized packets and avoids sending packets with trimmed UDP length to the wire. syzbot's stack trace (with my patch applied): len >= 65536u WARNING: ./inclu

영향받는 제품

• linux linux_kernel

참고 자료

• https://git.kernel.org/stable/c/02d787fd0922c71c0264449fe82d35983613e4e5
• https://git.kernel.org/stable/c/77c1489398c85a844f90205f5e76fd6bc8bb4089
• https://git.kernel.org/stable/c/86534c97abd6365a9a021fd767a2023e63c44469
• https://git.kernel.org/stable/c/9ccce02d501335f59a02f26c878c5e095b16302f
• https://git.kernel.org/stable/c/a42452db035577e150ffd9adf98c56fef9fb9408
• https://git.kernel.org/stable/c/c2994fd24997ed63d713c03313f863645adb4d6c