virtio_net: Fix misalignment bug in struct virtnet_info
概要
virtio_net: Fix misalignment bug in struct virtnet_info
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix misalignment bug in struct virtnet_info
Use the new TRAILING_OVERLAP() helper to fix a misalignment bug
along with the following warning:
drivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
This helper creates a union between a flexible-array member (FAM)
and a set of members that would otherwise follow it (in this case
u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];). This
overlays the trailing members (rss_hash_key_data) onto the FAM
(hash_key_data) while keeping the FAM and the start of MEMBERS aligned.
The static_assert() ensures this alignment remains.
Notice that due to tail padding in flexible struct virtio_net_rss_config_trailer, rss_trailer.hash_key_data
(at offset 83 in struct virtnet_info) and rss_hash_key_data (at
offset 84 in struct virtnet_info) are misaligned by one byte. See
below:
struct virtio_net_rss_config_trailer {
__le16 max_tx_vq; /* 0 2 /
__u8 hash_key_length; / 2 1 /
__u8 hash_key_data[]; / 3 0 */
/* size: 4, cachelines: 1, members: 3 */
/* padding: 1 */
/* last cacheline: 4 bytes */
};
struct virtnet_info {
...
struct virtio_net_rss_config_trailer rss_trailer; /* 80 4 */…
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- BellSoft Alpaquita BELL-CVE-2026-23143 linux-lts
- Debian DEBIAN-CVE-2026-23143 linux 修正版: 6.18.8-1
- Ubuntu UBUNTU-CVE-2026-23143 linux-hwe-edge
参照URL
- advisory github.com
- advisory nvd.nist.gov
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org