Messages in this thread |  | | Date | Tue, 14 Apr 2026 11:47:08 +0200 | | Subject | Re: [PATCH net] net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() | | From | Paolo Abeni <> |
| |
On 4/11/26 1:01 PM, Greg Kroah-Hartman wrote: > A malicious USB device claiming to be a CDC Phonet modem can overflow > the skb_shared_info->frags[] array by sending an unbounded sequence of > full-page bulk transfers. > > Drop the skb and increment the length error when the frag limit is > reached. This matches the same fix that commit f0813bcd2d9d ("net: > wwan: t7xx: fix potential skb->frags overflow in RX path") did for the > t7xx driver. > > Cc: Andrew Lunn <andrew+netdev@lunn.ch> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Eric Dumazet <edumazet@google.com> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: Paolo Abeni <pabeni@redhat.com> > Cc: stable <stable@kernel.org> > Assisted-by: gregkh_clanker_t1000 > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
It looks like the fixes tag should be:
Fixes: 87cf65601e17 ("USB host CDC Phonet network interface driver")
Right?
/P
|  |