In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes
the skb straight to __rmnet_map_ingress_handler(), skipping the length
validation that rmnet_map_deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt_len without checking skb->len, so a short frame is read out
of bounds:

  BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet
  Read of size 1 at addr ffff88801118ed00 by task exploit/147
  Call Trace:
   ...
   rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)
   __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)
   rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)
   __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)
   netif_receive_skb (net/core/dev.c:6460)
   tun_get_user (drivers/net/tun.c:1955)
   tun_chr_write_iter (drivers/net/tun.c:2001)
   vfs_write (fs/read_write.c:688)
   ksys_write (fs/read_write.c:740)
   do_syscall_64 (arch/x86/entry/syscall_64.c:94)
   ...

Factor that validation out of rmnet_map_deaggregate() into
rmnet_map_validate_packet_len() and run it on the no-aggregation path too.
The MAP header is bounds-checked first, since this path can receive a frame
shorter than the header.

https://git.kernel.org/stable/c/00f4c366dbca16a40772c3b7ec2d8cba839e9724

https://git.kernel.org/stable/c/14eb0c9491385d5361a292ea4974aec0e6887299

https://git.kernel.org/stable/c/1b12612c367e4be9b0814c0468e7e687835315b4

https://git.kernel.org/stable/c/231a8a4b76cb1b1827b3b19d7b3603642f5aaaef

https://git.kernel.org/stable/c/3868c3244369ab709a90c9aad7534d406009b824

https://git.kernel.org/stable/c/a54d76d176e50d2fdbd39b7231efe256170339e4

https://git.kernel.org/stable/c/ed25befc8c36f896b5878f9078faddb67fd7e2d0

https://git.kernel.org/stable/c/f0f1887a9e30712a1df03e152dce6fb91344b1f3

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c","drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h","drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"ed25befc8c36f896b5878f9078faddb67fd7e2d0","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"a54d76d176e50d2fdbd39b7231efe256170339e4","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"00f4c366dbca16a40772c3b7ec2d8cba839e9724","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"3868c3244369ab709a90c9aad7534d406009b824","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"14eb0c9491385d5361a292ea4974aec0e6887299","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"1b12612c367e4be9b0814c0468e7e687835315b4","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"231a8a4b76cb1b1827b3b19d7b3603642f5aaaef","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"f0f1887a9e30712a1df03e152dce6fb91344b1f3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c","drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h","drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]