When processing the IPPROTO_TCP level socket option TCP_CCALGOOPT, the kernel allocates memory based on the user provided option_len parameter. This option is currently only used by the newreno CC module, where the size used is 8 bytes.
This patch limits the size of allocated memory to 2048 bytes.
This issue was found by using syzkaller.