AZL-56337
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-56337.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-56337
- Upstream
- Published
- 2025-01-31T12:15:27Z
- Modified
- 2026-04-01T05:18:52.160646Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- CVE-2025-21666 affecting package kernel for versions less than 5.15.180.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
vsock: prevent null-ptr-deref in vsock_*[hasdata|hasspace]
Recent reports have shown how we sometimes call vsock_*hasdata() when a vsock socket has been de-assigned from a transport (see attached links), but we shouldn't.
Previous commits should have solved the real problems, but we may have more in the future, so to avoid null-ptr-deref, we can return 0 (no space, no data available) but with a warning.
This way the code should continue to run in a nearly consistent state and have a warning that allows us to debug future problems.
- References