CVE-2026-22984

Lack of explicit verification of the payload_len value before its use in the handle_auth_done() function can result in access to memory outside the allocated buffer (CWE-125: Out-of-bounds Read). A remote attacker, without authentication and without user interaction, can craft an authorization response containing an invalid payload length value. The patch introduces explicit boundary checking of the payload_len variable before passing it for further processing.

An attacker can cause disclosure of sensitive data from kernel memory, and depending on the context, also cause system integrity violations or unavailability (according to CVSS vector: C:H/I:H/A:H).

Patches available from the vendor should be applied according to the references — fixes have been published in the Linux kernel stable repository at the addresses indicated in the references section (including commits: 194cfe2af4d2, 2802ef3380fa, 2d653bb63d59, 79fe3511db41, 818156caffbf).

Linux kernel — versions indicated in vendor references (patches available in commits in the stable repository git.kernel.org)