CVE-2025-22056

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly. Hence, when deciding the next geneve_opt position, the pointer addition should be in units of char *. However, the current implementation erroneously does type conversion before the addition, which will lead to heap out-of-bounds write. [ 6.989857] ================================================================== [ 6.9902...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 925d844696d9287f841d6b3e0ed62a35fb175970 < 31d49eb436f2da61280508d7adf8c9b473b967aa, >= 925d844696d9287f841d6b3e0ed62a35fb175970 < ca2adfc03cd6273f0b589fe65afc6f75e0fe116e, >= 925d844696d9287f841d6b3e0ed62a35fb175970 < a263d31c8c92e5919d41af57d9479cfb66323782, >= 925d844696d9287f841d6b3e0ed62a35fb175970 < 28d88ee1e1cc8ac2d79aeb112717b97c5c833d43, >= 925d844696d9287f841d6b3e0ed62a35fb175970 < 0a93a710d6df334b828ea064c6d39fda34f901dc, >= 925d844696d9287f841d6b3e0ed62a35fb175970 < 446d94898c560ed2f61e26ae445858a4c4830762, >= 925d844696d9287f841d6b3e0ed62a35fb175970 < 708e268acb3a446ad2a8a3d2e9bd41cc23660cd6, >= 925d844696d9287f841d6b3e0ed62a35fb175970 < 1b755d8eb1ace3870789d48fbd94f386ad6e30be, >= 5.7, >= V3.1.6, >= 5.7 < 5.10.236, >= 5.11 < 5.15.180, >= 5.16 < 6.1.134, >= 6.2 < 6.6.87, >= 6.7 < 6.12.23, >= 6.13 < 6.13.11, >= 6.14 < 6.14.2

Fixed versions

5.10.236, 5.15.180, 6.1.134, 6.6.87, 6.12.23, 6.13.11, 6.14.2

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787