Threats tagged 'ghsa-pxpq-p89v-xx8g'

A vulnerability in the Linux kernel's caif subsystem was resolved involving an integer underflow in the cffrml_receive() function. The function subtracts 2 from a length field without ensuring the length is at least 2 when FCS is disabled. Malicious packets with length 0 or 1 can trigger this underflow, potentially causing memory exhaustion, kernel instability, and information disclosure from uninitialized kernel memory. The issue is fixed by validating the length before subtraction.