CVE-2026-90327

What it actually does

Out-of-bounds write in pep_getsockopt() where min_t() clamps the reported optlen but put_user() always writes a full sizeof(int) (4 bytes) to the user buffer, allowing 1-3 bytes of kernel write past the caller's allocation when optlen < sizeof(int).

Why it matters to the business

Local memory corruption in the kernel can cause system crashes, denial of service, or local privilege escalation on systems exposing the phonet protocol; low EPSS and no known exploitation keep immediate enterprise risk modest but still requires prompt patching of affected kernels.

How an attack unfolds

An attacker with local access creates a PF_PHONET socket, invokes getsockopt() on it with an optlen smaller than 4 bytes, and triggers the unbounded put_user() to corrupt adjacent user memory; successful corruption may be leveraged for further kernel exploitation or DoS.

How to fix it

Upgrade to a Linux kernel containing the upstream fix that replaces put_user() with a length-bounded copy_to_user() call; apply vendor kernel packages as soon as available and reboot.

How to confirm the fix worked

Confirm the running kernel is newer than the vulnerable commit, review the source of pep_getsockopt() to verify copy_to_user() is bounded by optlen, and test that getsockopt() with optlen < 4 no longer writes past the supplied buffer.

Typical attack path

1. Obtain local shell on target Linux system
2. Create a PF_PHONET/PEP socket
3. Prepare a small user buffer and call getsockopt() with optlen < sizeof(int)
4. Trigger the write beyond the buffer to corrupt adjacent memory
5. Leverage resulting corruption for privilege escalation or crash

How to detect it

Examine kernel logs for unexpected oops or corruption around phonet/pep code paths; audit system call traces for getsockopt() invocations on PF_PHONET sockets with unusually small optlen values; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on all systems that may load the phonet module
• Monitor upstream stable and distribution kernel changelogs for the fix
• Restrict unprivileged creation of PF_PHONET sockets via LSM or seccomp where feasible
• Include this kernel issue in the next scheduled patch window given absence from KEV