In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10942
Reference (s):
- https://security.netapp.com/advisory/ntap-20200403-0003/
- DEBIAN:DSA-4667
- URL: https://www.debian.org/security/2020/dsa-4667
- DEBIAN:DSA-4698
- URL: https://www.debian.org/security/2020/dsa-4698