In the Linux kernel, the following vulnerability has been resolved:netfilter: complete validation of user inputIn my recent commit, I missed that do_replace() handlers
use copy_from_sockptr() (which I fixed), followed
by unsafe copy_from_sockptr_offset() calls.In all functions, we can perform the @optlen validation
before even calling xt_alloc_table_info() with the following
check:if ((u64)optlen < (u64)tmp.size + sizeof(tmp))
        return -EINVAL;