In the Linux kernel, the following vulnerability has been resolved:

rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc

rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the
rxrpc_call.rx_dec_buffer is unallocated and assumes that upon
successful return that rx_dec_buffer must be allocated.
However, rxrpc_verify_data() does not request an allocation if
the rxrpc_skb_priv.len is zero.

In addition, failure to allocate rx_dec_buffer will result in a
call to skb_copy_bits() with a NULL destination which can
trigger a NULL pointer dereference.

To prevent these issues rxrpc_verify_data() is modified to
always attempt to allocate the rxrpc_call.rx_dec_buffer if it
is NULL.

This issue was identified with assistance of a private
sashiko instance.

https://git.kernel.org/stable/c/16c8ae9735c5bd7e54dd7478d6348e0fc860842d

https://git.kernel.org/stable/c/6563b4eb38c35d75892445bcf8aacdc29914821c

https://git.kernel.org/stable/c/8bbede0afced346b24e4fbde0c68cf12980ba948

https://git.kernel.org/stable/c/a962bc8508592c4d51092edac68579bd8b18fe44

https://git.kernel.org/stable/c/d3b642cf95d48234590cc91450d8705a9bf6b540

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rxrpc/recvmsg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a05bf6d9e621fa71e89ccebe3047ba45218d7b38","lessThan":"8bbede0afced346b24e4fbde0c68cf12980ba948","versionType":"git","status":"affected"},{"version":"b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5","lessThan":"6563b4eb38c35d75892445bcf8aacdc29914821c","versionType":"git","status":"affected"},{"version":"46cb765e2e5ad52303ea157e10d370bb6b7acbbf","lessThan":"d3b642cf95d48234590cc91450d8705a9bf6b540","versionType":"git","status":"affected"},{"version":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","lessThan":"a962bc8508592c4d51092edac68579bd8b18fe44","versionType":"git","status":"affected"},{"version":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","lessThan":"16c8ae9735c5bd7e54dd7478d6348e0fc860842d","versionType":"git","status":"affected"},{"version":"c580087743712112778a06d65a4074053072d7bf","versionType":"git","status":"affected"},{"version":"6.6.143","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.93","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"6.18.35","lessThan":"6.18.40","versionType":"semver","status":"affected"},{"version":"7.0.11","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rxrpc/recvmsg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]