CVE-2026-74689

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-out-of-bounds read exists in the vcc setsockopt() function. The issue stems from an ineffective optlen check that could be bypassed if the SO LEVEL MATCH(optname, level) condition evaluated to false, such as when a mismatched level was provided. This allowed execution to proceed to copy from sockptr() without verifying if optval had sufficient space. Additionally, a cgroup BPF setsockopt filter could shrink optlen after entry, leading to a KASAN slab-out-of-bounds read during the memcpy() operation performed by copy from sockptr() when optlen was smaller than the expected structure size.

Recommendations Update the Linux kernel to a version where vcc setsockopt() utilizes copy safe from sockptr() to ensure optlen is validated before copying and the value variable is updated to type int for correct ABI encoding on 64-bit systems.