SB20261029208 - Out-of-bounds read in Linux kernel sched

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-99112)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering an out-of-bounds kernel memory read.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's flower classifier when processing nested tunnel-option attributes with an improperly validated mask cursor. A local privileged user can supply crafted filter attributes that advance the mask cursor beyond its valid payload, causing subsequent attribute parsing to read outside the mask buffer and potentially crash the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/45e60747a9db2307929260d9aa9c1c6cbb70ee77
• https://git.kernel.org/stable/c/bb187146c7e5c666874784e4f3fc1bc5126e6e92
• https://git.kernel.org/stable/c/fee10655709c5c597e8e9f722f3035d9ea31ff3a