# UNDF: UNDF-2026-000000144
# linux: CWE-407 deeper scan — net/core, kernel/ CLEAN

## Subsystems scanned

| Subsystem | Files | Verdict |
|-----------|-------|---------|
| `net/core/dev.c` | for_each_netdev, adjacency lists | CLEAN |
| `net/core/fib_rules.c` | rule_find, rule_exists, list_for_each_entry | CLEAN |
| `net/core/sock.c` | proto_register, assign_proto_idx | CLEAN |
| `kernel/groups.c` | groups_search, supplementary GIDs | CLEAN |
| `kernel/user_namespace.c` | mappings_overlap, uid/gid extents | BOUNDED |
| `kernel/sched/topology.c` | find_pd, for_each_cpu perf domains | CLEAN |
| `kernel/sched/core.c` | for_each_cpu + smt_mask, cpumask_andnot | CLEAN |
| `kernel/workqueue.c` | for_each_pwq, for_each_pool | CLEAN |
| `kernel/notifier.c` | raw_notifier_call_chain | CLEAN |

## Notes

### net/core/dev.c — `__dev_alloc_name`
Outer `for_each_netdev` with inner `netdev_for_each_altname` scans a bitmap of
used slots — sets a bit per slot using `bitmap_zalloc(max_netdevices)`.
Not a membership test inside a growing list; the bitmap is reset fresh each call.
CLEAN.

### net/core/fib_rules.c — `rule_find`, `rule_exists`
Both do a single sequential pass over `ops->rules_list`.  The three sequential
passes in `fib_nl_newrule` (ctarget scan, pref-order scan, unresolved-rules
update) are not nested — each is O(R) standalone.  CLEAN.

### kernel/user_namespace.c — `mappings_overlap`
Called in outer loop over lines in the UID/GID map file; inner loop checks
overlap against already-accepted extents.  **Technically O(E²)** but bounded by
`UID_GID_MAP_MAX_EXTENTS = 340`.  Peak: 340² = 115,600 comparisons on one
`write()` call.  Not network-facing; attacker must have a user namespace.
Below threshold for a new defect ticket; noted here for completeness.

### kernel/sched/topology.c — `find_pd`
`find_pd()` walks a short linked list of `perf_domain` objects (O(P), where P =
number of distinct CPU performance domains — typically 1–4 on real hardware)
inside `for_each_cpu(i, cpu_map)`.  Worst case O(C×P) but P is structurally
bounded by hardware topology, not attacker-controlled.  CLEAN.

### net/ipv4/, fs/, mm/ — NOT IN SPARSE CLONE
The sparse clone does not include `net/ipv4/`, `fs/`, or `mm/`.  Those
subsystems require a fresh clone or broader sparse-checkout configuration.

## Conclusion

No new CWE-407 defects found in the scanned kernel subsystems beyond
linux-0001..0008.  The sparse clone limits further scanning of `net/ipv4/`,
`fs/`, and `mm/`.