{"id":"CVE-2026-90327","revision":"056b07d8b11d4c91838cd288a2b488ab","records":[{"revision":"056b07d8b11d4c91838cd288a2b488ab","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90327","aliases":[],"title":"phonet: pep: do not write beyond optlen in getsockopt","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nphonet: pep: do not write beyond optlen in getsockopt\n\npep_getsockopt() clamps the reported length to the caller's buffer with\nmin_t(), but then stores the value with put_user(val, (int __user *)\noptval), which always writes sizeof(int) bytes. A getsockopt() call with\nan optlen smaller than sizeof(int) thus reports the clamped length yet\nwrites a full int, one to three bytes past the user buffer.\n\nWrite the value with copy_to_user() bounded by len, so at most optlen\nbytes are copied, matching the length reported back to userspace.","state":0,"publishedAt":"2026-09-17T16:08:42.017+00:00","modifiedAt":"2026-10-19T09:01:44.321+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/phonet/pep.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"02a47617cdce440f60c71a51f3a93f9f5fcc5a7a\",\n                            \"lessThan\": \"6054fed6bad08b6d03973e8ffca7f0c9394d1c30\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02a47617cdce440f60c71a51f3a93f9f5fcc5a7a\",\n                            \"lessThan\": \"eac733a0b6fe0a52d91f9f623425735ed50ac6c2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02a47617cdce440f60c71a51f3a93f9f5fcc5a7a\",\n                            \"lessThan\": \"95e0ed2439dd1792eb454c68ae8d10f30ffe3bff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02a47617cdce440f60c71a51f3a93f9f5fcc5a7a\",\n                            \"lessThan\": \"056eea1a2068ad2fb7c3093c5f1095268f87d0c7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02a47617cdce440f60c71a51f3a93f9f5fcc5a7a\",\n                            \"lessThan\": \"1bf499e438da80455e258049bce60ffb3a53f3fa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02a47617cdce440f60c71a51f3a93f9f5fcc5a7a\",\n                            \"lessThan\": \"c4487e4d5309de587479ecc2f5173b49586f46f4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02a47617cdce440f60c71a51f3a93f9f5fcc5a7a\",\n                            \"lessThan\": \"f97022fefe6eb06ee18549d603420440f2959802\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02a47617cdce440f60c71a51f3a93f9f5fcc5a7a\",\n                            \"lessThan\": \"77e5eb0e192aec6710c03ca8144582fd2af36ca4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/phonet/pep.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.28\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.28\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/6054fed6bad08b6d03973e8ffca7f0c9394d1c30","https://git.kernel.org/stable/c/eac733a0b6fe0a52d91f9f623425735ed50ac6c2","https://git.kernel.org/stable/c/95e0ed2439dd1792eb454c68ae8d10f30ffe3bff","https://git.kernel.org/stable/c/056eea1a2068ad2fb7c3093c5f1095268f87d0c7","https://git.kernel.org/stable/c/1bf499e438da80455e258049bce60ffb3a53f3fa","https://git.kernel.org/stable/c/c4487e4d5309de587479ecc2f5173b49586f46f4","https://git.kernel.org/stable/c/f97022fefe6eb06ee18549d603420440f2959802","https://git.kernel.org/stable/c/77e5eb0e192aec6710c03ca8144582fd2af36ca4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90327","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90327","identifiers":["CVE-2026-90327"]},"retained":false,"historicalAffected":[]}],"coverage":[]}