CVE-2026-90327

A flaw was found in the Linux kernel's phonet: pep component. A local attacker could exploit an out-of-bounds write vulnerability in the pep_getsockopt() function. This occurs when a getsockopt() call provides an optlen smaller than sizeof(int), causing the function to write a full integer beyond the user-provided buffer. This could lead to memory corruption and potentially information disclosure or denial of service.

A moderate-severity out-of-bounds write flaw was found in the Linux kernel's Phonet/PEP socket option handling. In pep_getsockopt(), the length reported back to userspace is clamped to the caller's buffer size, but the option value is stored with put_user(), which always writes sizeof(int) bytes. A local attacker with low privileges could exploit this by issuing a getsockopt() call on a Phonet/PEP socket with an optlen smaller than sizeof(int), causing one to three bytes of kernel-controlled data to be written past the end of the user-supplied buffer. This out-of-bounds write can corrupt adjacent memory and potentially cause a kernel panic, resulting in a denial of service. Red Hat assigned this flaw a CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting no assessed confidentiality or integrity impact and high availability impact. All Red Hat products currently listed in this flaw, including Red Hat Enterprise Linux (kernel and kernel-rt), Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm), and OpenShift Container Platform RHEL CoreOS 8 and 9 containers, are marked not affected because the vulnerable code is not present in the shipped kernels. The Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel entry is out of support scope and remains unassessed for affectedness.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.