The Linux kernel's net/atm subsystem contained a vulnerability in the vcc_setsockopt() function where an ineffective optlen check allowed bypass of length validation if the socket option level did not match. This caused the function to call copy_from_sockptr() assuming sufficient buffer size, potentially leading to a slab-out-of-bounds read detected by KASAN. Additionally, a cgroup BPF setsockopt filter could shrink optlen after entry, exacerbating the issue. The fix replaced copy_from_sockptr() with copy_safe_from_sockptr(), which enforces minimum size validation before copying, and changed a local variable type to ensure ABI compatibility on 64-bit systems.

This vulnerability could cause the kernel to read beyond the bounds of allocated memory (slab-out-of-bounds read), potentially leading to kernel memory corruption or crashes. However, no known exploits in the wild have been reported. The impact is limited to the net/atm subsystem and requires specific conditions related to socket option handling.

A fix has been implemented in the Linux kernel to address this vulnerability by improving validation and copying mechanisms in vcc_setsockopt(). Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the current remediation guidance.