## Summary
A Linux kernel netconsole issue can trigger out-of-bounds reads when the message passed from the console subsystem is not guaranteed to be NUL-terminated. The fix is described as “avoid OOB reads, msg is not nul-terminated” for affected kernel versions 6.6 through 6.18.16 (exclusive).
## Technical Details
- Root condition: the msg passed to netconsole from the console subsystem is not guaranteed to be NUL-terminated.
- When netconsole_write formats the message (observed call chain includes scnprintf → vsnprintf → string), the non-terminated buffer can cause a read past the allocated region.
- The NVD text includes a KASAN report showing a slab-out-of-bounds read in string during netconsole_write, with the read occurring 1 byte past the allocated 3072-byte region within a kmalloc-4k object.
- The issue is tied to the netconsole infrastructure change: before 7eab73b18630 (“netconsole: convert to NBCON console infrastructure”), messages were placed in printk_shared_pbufs (static global buffer), making KASAN detection harder.
- Fix references include stable backports/patches: 3126a2f98beaec5a554a1fb31c46db1e8542665e, 74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58, and upstream 82aec772fca2223bc5774bd9af486fd95766e578.
## Affected
- Linux kernel 6.6 - 6.18.16 (exclusive)
## Impact
- Out-of-bounds read in kernel memory during netconsole message formatting.
- Potential kernel crash/instability (KASAN reports BUG: KASAN: slab-out-of-bounds).
- CVSS indicates high availability impact (A:H) and confidentiality impact (C:H).
## Mitigation
1. Upgrade to a kernel version that includes the fix from 82aec772fca2223bc5774bd9af486fd95766e578 (and corresponding stable commits).
2. If upgrading is not immediately possible, consider disabling netconsole to prevent the vulnerable netconsole_write path from processing console messages.
3. Validate with runtime testing under KASAN/QA where feasible to confirm the OOB read is eliminated.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-125