CVE-2026-90327
phonet: pep: do not write beyond optlen in getsockopt
Description
In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pep_getsockopt() clamps the reported length to the caller's buffer with min_t(), but then stores the value with put_user(val, (int __user *) optval), which always writes sizeof(int) bytes. A getsockopt() call with an optlen smaller than sizeof(int) thus reports the clamped length yet writes a full int, one to three bytes past the user buffer. Write the value with copy_to_user() bounded by len, so at most optlen bytes are copied, matching the length reported back to userspace.
INFO
Published Date :
Sept. 17, 2026, 5:17 p.m.
Last Modified :
Sept. 17, 2026, 5:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Use copy_to_user bounded by length for user buffer writes.
- Ensure writes do not exceed the allocated user buffer size.
- Apply the kernel patch to correct the getsockopt behavior.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-90327.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-90327 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-90327
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90327 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-90327 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 17, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pep_getsockopt() clamps the reported length to the caller's buffer with min_t(), but then stores the value with put_user(val, (int __user *) optval), which always writes sizeof(int) bytes. A getsockopt() call with an optlen smaller than sizeof(int) thus reports the clamped length yet writes a full int, one to three bytes past the user buffer. Write the value with copy_to_user() bounded by len, so at most optlen bytes are copied, matching the length reported back to userspace. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90327.json">CVE-2026-90327</a> Added Reference https://git.kernel.org/stable/c/056eea1a2068ad2fb7c3093c5f1095268f87d0c7 Added Reference https://git.kernel.org/stable/c/1bf499e438da80455e258049bce60ffb3a53f3fa Added Reference https://git.kernel.org/stable/c/6054fed6bad08b6d03973e8ffca7f0c9394d1c30 Added Reference https://git.kernel.org/stable/c/77e5eb0e192aec6710c03ca8144582fd2af36ca4 Added Reference https://git.kernel.org/stable/c/95e0ed2439dd1792eb454c68ae8d10f30ffe3bff Added Reference https://git.kernel.org/stable/c/c4487e4d5309de587479ecc2f5173b49586f46f4 Added Reference https://git.kernel.org/stable/c/eac733a0b6fe0a52d91f9f623425735ed50ac6c2 Added Reference https://git.kernel.org/stable/c/f97022fefe6eb06ee18549d603420440f2959802