PT-2026-3763 · Linux+2 · Linux Kernel+2
Published
2026-01-01
·
Updated
2026-05-26
·
CVE-2026-22977
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.12.62
Description
The Linux kernel contained a flaw within the networking subsystem related to usercopy handling. Specifically, the
skbuff fclone cache was initialized without defining a usercopy region, unlike skbuff head cache, which properly whitelists the cb[] field. This resulted in a usercopy error when the CONFIG HARDENED USERCOPY option was enabled, and the kernel attempted to copy data from sk buff.cb to userspace via sock recv errqueue() and put cmsg(). The issue occurred when cloned skbs allocated from skbuff fclone cache were used in the socket error queue, triggering a usercopy hardening violation. The crash involved accessing the sock exterr skb structure in skb->cb through put cmsg().Recommendations
Update to Linux kernel version 6.12.62 or later.
Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu