SB20261023216 - Out-of-bounds read in Linux kernel net driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-98952)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause out-of-bounds reads that populate tunnel metadata with unintended memory contents.

The vulnerability exists due to an out-of-bounds read in pfcp_session_recv() in drivers/net/pfcp.c when processing PFCP packets with the S flag set without ensuring that the entire session endpoint identifier (SEID) is present in the linear packet data. A remote attacker can send a short PFCP packet or one whose session header lies in a fragment to cause an eight-byte SEID read beyond the available packet data, with the resulting value stored in tunnel metadata used by flower for classification.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/23609bce9e1de525d1d0e73fc68c6e7971d0b49e
• https://git.kernel.org/stable/c/2fb6d05f706d79bbdc88835be2f4f45ab56dd819
• https://git.kernel.org/stable/c/3192a5e398c64d48aad64a09e29643e327369bc4
• https://git.kernel.org/stable/c/b18a6496495495e2dc27e525aa3315a0c59b9513