SB20261111206 - openEuler 22.03 LTS SP4 update for kernel
Published: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 37 vulnerabilities.
1) Race condition (CVE-ID: CVE-2026-99059)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause WireGuard to establish the same cryptographic session more than once.
The vulnerability exists due to a race condition in WireGuard's Noise handshake processing when duplicate handshake responses are processed concurrently with an intervening handshake initiation. A remote attacker can replay a handshake response under this timing condition to cause stale handshake state to be accepted and the same session to be established more than once.
2) NULL pointer dereference (CVE-ID: CVE-2026-98416)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in k3_udma_glue_release_rx_chn() in the Linux kernel TI K3 UDMA glue driver when handling a receive-channel request after memory allocation fails. A local user can trigger the affected cleanup path to cause a denial of service.
The failure occurs when devm_kcalloc() cannot allocate the receive-channel flow array and cleanup subsequently calls k3_udma_glue_release_rx_flow().
3) Numeric Truncation Error (CVE-ID: CVE-2026-98417)
CWE-ID: CWE-197 - Numeric Truncation Error
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a kernel warning.
The vulnerability exists due to integer truncation in the handle_esp() function in net/xfrm/espintcp.c when processing ESP-in-TCP packets after the stream parser trims the TCP envelope. A remote attacker can supply packets whose transport header offset cannot be represented to trigger a kernel warning.
4) Improper initialization (CVE-ID: CVE-2026-98422)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a kernel warning.
The vulnerability exists due to improper reinitialization of the crypto_tx_tailroom_needed_cnt counter in mac80211 AP_VLAN interface handling when bringing an AP_VLAN interface down. A local user can repeatedly bring the same AP_VLAN interface down and up while its parent AP interface remains up to trigger a kernel warning.
The sanity check detects a mismatch between the AP_VLAN interface's counter and the parent AP interface's counter.
5) Use-after-free (CVE-ID: CVE-2026-98432)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service through access to freed IPv6 request socket options.
The vulnerability exists due to use-after-free in tcp_v6_reqsk_destructor() when request socket migration leaves concurrent processing using shared options after they have been freed. A remote attacker can send TCP traffic that encounters concurrent request socket migration and destruction to potentially cause a kernel crash.
The affected ipv6_opt options are only set by CALIPSO.
6) Use-after-free (CVE-ID: CVE-2026-98432)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to use-after-free in the Linux kernel IPv4 TCP socket option handling when socket destruction frees shared options while another CPU is still using them to build a SYNACK or create a child socket. A remote attacker can send TCP traffic that encounters these concurrent processing paths to potentially cause a kernel crash.
The request socket migration path requires net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program. IPv6 is not affected by the child socket ownership-transfer path because it duplicates the options.
7) Use-after-free (CVE-ID: CVE-2026-98490)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service and potentially corrupt kernel memory.
The vulnerability exists due to a use-after-free in the Linux kernel Open vSwitch connection tracking component when connection tracking extensions are reallocated after helper processing for an unconfirmed connection. A local user can trigger the affected helper and extension-allocation sequence to leave a stale pointer in the expectations list, causing access to freed memory during expectation removal and potentially crashing the kernel.
8) Use-after-free (CVE-ID: CVE-2026-98625)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service through a use-after-free in the Linux kernel.
The vulnerability exists due to a use-after-free in the netfilter flowtable hardware offload worker when flow destruction overlaps with garbage collection. A local user can potentially trigger a race in which NF_FLOW_HW_DEAD is set before NF_FLOW_HW_PENDING is cleared, allowing garbage collection and an RCU callback to free the flow before the worker resumes accessing it, to cause a denial of service.
9) Improper locking (CVE-ID: CVE-2026-98899)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a denial of service.
The vulnerability exists due to improper locking in the Linux kernel netfilter ipset hash-table implementation when garbage collection accesses a shared hash table without the required read-copy-update protection. A local user can potentially trigger concurrent hash-table operations to cause unsafe table access and a denial of service.
10) Improper initialization (CVE-ID: CVE-2026-98936)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a denial of service by preventing new wireless stations or mesh peers from connecting.
The vulnerability exists due to improper reinitialization of the station counter in the Linux kernel ath11k driver's ath11k_mac_op_start() function when restarting wireless hardware. A local user can potentially exploit stale station accounting after repeated hardware restarts to cause new station or mesh peer connections to be rejected because the driver incorrectly considers its station limit reached.
11) Out-of-bounds write (CVE-ID: CVE-2026-98407)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt unrelated kernel heap objects.
The vulnerability exists due to incorrect pointer arithmetic resulting in an out-of-bounds write in the rsi_hal_load_key() function when removing a key with a null data pointer. A local user can trigger a key-removal operation to corrupt unrelated kernel heap objects.
The write occurs on every DISABLE_KEY callback, including during disconnects, roaming, and interface teardown. It writes 144 zero bytes approximately 2.4 KB beyond the end of a 160-byte heap buffer.
12) Observable discrepancy (CVE-ID: CVE-2026-99077)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to discover the ephemeral port used by a connected UDP socket through a cache side channel.
The vulnerability exists due to an observable discrepancy in IPv4 UDP error handling in the Linux kernel when processing locally delivered ICMP Fragmentation Needed or Redirect messages that quote UDP packets. A remote attacker can send crafted ICMP messages containing guessed UDP ports and observe changes in the FIB nexthop exception (FNHE) cache to distinguish packets matching an existing socket and discover its ephemeral port.
13) Use-after-free (CVE-ID: CVE-2026-99117)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the Linux kernel bridge multicast subsystem when tearing down port groups. A local user can trigger a teardown sequence in which deleting the iterator's saved next node prematurely terminates the port-group walk, leaving dangling port pointers that are subsequently accessed during a multicast database dump to cause a denial of service.
14) Out-of-bounds write (CVE-ID: CVE-2026-99142)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to corrupt kernel memory, potentially causing a denial of service.
The vulnerability exists due to an out-of-bounds write in the Linux kernel tracing predicate_parse() function when processing opening parentheses in tracing filter expressions. A local privileged user can submit a crafted filter expression that causes an operator stack push beyond the last allocated entry to corrupt kernel memory, potentially causing a denial of service.
15) Use-after-free (CVE-ID: CVE-2026-99167)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption.
The vulnerability exists due to a use-after-free in __tcf_action_put() in the Linux kernel traffic control subsystem when concurrent operations release an action. A local user can trigger concurrent action releases to potentially cause a kernel crash: another thread may free the action after its reference count is decremented but before its binding count is updated, causing a write to freed memory.
16) Use-after-free (CVE-ID: CVE-2026-99233)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially execute arbitrary code in kernel context, disclose sensitive information, or cause a denial of service.
The vulnerability exists due to a use-after-free caused by incorrect synthetic-event reference counting in the Linux kernel tracing histogram subsystem when registering or unregistering histograms on non-synthetic events with basenames matching synthetic events. A local user can register a histogram on a non-synthetic event before creating a same-named synthetic event and remove the histogram afterwards to prematurely free the synthetic event while an active histogram action retains a pointer to it, potentially enabling arbitrary kernel code execution, sensitive information disclosure, or a kernel crash.
17) Use-after-free (CVE-ID: CVE-2026-99235)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service and potentially execute arbitrary code in kernel context or disclose sensitive kernel information.
The vulnerability exists due to use-after-free in the Linux kernel tracing histogram implementation when removing histogram triggers. A local user can remove a compatible histogram while a target histogram still retains a pointer to it, then remove the target to trigger a dereference of freed memory, causing a kernel crash and potentially enabling arbitrary code execution or sensitive information disclosure.
18) Out-of-bounds read (CVE-ID: CVE-2026-99236)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially disclose sensitive kernel information, compromise kernel integrity, or cause a denial of service.
The vulnerability exists due to an out-of-bounds read in predicate_parse() in kernel/trace/trace_events_filter.c when processing incomplete event filter expressions ending with logical operators, optionally followed by unary negations. A local user can submit a crafted filter through PERF_EVENT_IOC_SET_FILTER on a self-targeted perf tracepoint counting event to trigger a read of prog[-1] and potentially copy an out-of-bounds word into a branch target, which may expose kernel memory, compromise kernel integrity, or cause a kernel crash.
19) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-99239)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially disclose sensitive information, modify system data, or cause a denial of service.
The vulnerability exists due to a time-of-check time-of-use race condition in the Linux kernel Bluetooth L2CAP channel management code when binding and connecting a socket concurrently. A local user can race bind and connect operations to link the same channel to a connection more than once, violating assumptions used during channel cleanup and potentially compromising system confidentiality, integrity, and availability.
20) Use-after-free (CVE-ID: CVE-2026-90292)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a use-after-free condition.
The vulnerability exists due to improper reference counting in the RDMA/siw siw_accept() function when handling a userspace-supplied queue pair that is already in the RTS state. A local user can supply such a queue pair to cause a use-after-free condition.
21) Out-of-bounds read (CVE-ID: CVE-2026-64097)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() when parsing a malformed VBIOS GPIO pin LUT table. A local attacker can supply a crafted VBIOS image with an invalid structuresize field to disclose sensitive information.
22) NULL pointer dereference (CVE-ID: CVE-2026-64331)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in vep_dequeue() when cancelling FunctionFS AIO requests. A local user can trigger request cancellation on the FunctionFS AIO path to cause a denial of service.
The issue is reachable when stressing FunctionFS endpoints via AIO in usbip's vudc path.
23) Use-after-free (CVE-ID: CVE-2026-64408)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in bnep_add_connection() during network device registration when handling a concurrent controller teardown. A local user can trigger a race condition to cause a denial of service.
24) Double free (CVE-ID: CVE-2026-68236)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a double free in dm_update_crtc_state() in the AMD display manager when handling error paths after releasing new_stream on the skip_modeset path. A local user can trigger a later error condition after the initial release to cause a denial of service.
The issue occurs because a dangling pointer may be released again after a color management failure reaches the fail label.
25) Out-of-bounds read (CVE-ID: CVE-2026-74598)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in rt6_route_rcv() when processing a crafted IPv6 Router Advertisement containing a malformed Route Information option. A remote attacker can send a specially crafted Router Advertisement to disclose sensitive information.
When additional options follow the malformed Route Information option, data from the next option can be incorporated into the installed route and become visible to userspace.
26) Integer overflow (CVE-ID: CVE-2026-80978)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause skb header offsets to wrap.
The vulnerability exists due to an integer overflow in IP tunnel device headroom configuration when configuring a stack of user-created IP tunnel devices. A local user can create a stacked tunnel-device configuration with excessive headroom to cause skb header offsets to wrap.
The affected skb header offsets use a 16-bit representation.
27) Improper locking (CVE-ID: CVE-2026-90143)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a kernel warning.
The vulnerability exists due to improper locking in kcm_parse_func_strparser() when executing a KCM strparser BPF program. A local user can invoke BPF map operations from the program to cause a kernel warning.
28) NULL pointer dereference (CVE-ID: CVE-2026-90149)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the NFSv4 flexfiles data server session and error-handling paths when processing I/O for NFSv4.0 data servers. A remote user can perform I/O operations against an NFSv4.0 flexfiles data server to cause a denial of service.
NFSv4.0 data server clients do not maintain sessions.
29) Improper resource shutdown or release (CVE-ID: CVE-2026-31661)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper memory management in the brcmsmac driver when freeing DMA-coherent memory. A local user can trigger the vulnerable code path to cause a denial of service.
30) Use-after-free (CVE-ID: CVE-2026-93054)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the __uio_register_device() UIO registration failure path when an opener races with a failed registration after device_add(). A local user can race opening /dev/uioX with a failed device registration to cause a denial of service.
31) Use-after-free (CVE-ID: CVE-2026-93796)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to access freed memory.
The vulnerability exists due to a use-after-free condition in the iwlwifi PCIe RX cleanup routine when RX initialization fails and cleanup or retry paths are invoked. A local user can invoke the affected cleanup or retry paths after a failed RX initialization to access freed memory.
32) Use-after-free (CVE-ID: CVE-2026-98311)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free in the kernel.
The vulnerability exists due to use-after-free in virt_wifi_newlink() when transferring operational state before device registration. A local user can attempt to create a virtual wireless device with an invalid name while its lower device is dormant to trigger a use-after-free in the kernel.
Exploitation requires device registration to fail and a subsequent linkwatch_fire_event() call to access the queued list entry after the device object has been freed.
33) NULL pointer dereference (CVE-ID: CVE-2026-98314)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in ALSA PCM timer initialization when concurrent timer callbacks execute before the registered timer's private data is initialized. A local user can read /proc/asound/timers concurrently with PCM timer initialization to cause a denial of service.
34) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98331)
CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to retaining references to unregistered interfaces in the mac80211 interface list when unregistering a network device without going through ieee80211_if_remove(). A local user can trigger destruction of a network namespace containing a wiphy to cause a denial of service.
Exploitation depends on allocation failures preventing the wiphy from being moved to the initial network namespace. Subsequent hardware unregistration can trigger a kernel BUG.
35) Use-after-free (CVE-ID: CVE-2026-98343)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free read in the kernel.
The vulnerability exists due to use-after-free in dma_chan_put() and dma_release_channel() when releasing a DMA channel drops the last reference to its device and frees the device and its channels. A local user can trigger DMA channel release to trigger a use-after-free read in the kernel.
36) Out-of-bounds read (CVE-ID: CVE-2026-98362)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause incorrect clock rates to be reported to consumers.
The vulnerability exists due to an out-of-bounds read in scpi_dvfs_recalc_rate() in the SCPI clock driver when recalculating a clock rate using an out-of-range DVFS index returned by SCP firmware. A local user can trigger clock-rate recalculation using such an index to cause incorrect clock rates to be reported to consumers.
The SCP firmware may supply the invalid index because it is buggy or returns a stale value.
37) Out-of-bounds read (CVE-ID: CVE-2026-98377)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose uninitialized kernel slab memory.
The vulnerability exists due to an out-of-bounds read caused by insufficient verification of MAC header availability in __vlan_insert_inner_tag() when inserting VLAN tags into undersized frames. A local user can send a one-byte AF_PACKET/SOCK_RAW frame through an IFF_TUN device subjected to repeated VLAN pushes to disclose uninitialized kernel slab memory.
The IFF_TUN device has hard_header_len set to zero. The first VLAN push sets only a hardware-accelerated tag; subsequent pushes reach the helper through a clsact VLAN push action or bpf_skb_vlan_push().
Remediation
Install update from vendor's website.