Out-of-bounds read in Linux kernel - CVE-2026-45844
Published: May 28, 2026
Vulnerability identifier: #VU132660
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-45844
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause incorrect packet filtering decisions.
The vulnerability exists due to an out-of-bounds read in arp_packet_match() when parsing ARP payloads on IEEE1394 interfaces. A local user can send a specially crafted ARP packet to cause incorrect packet filtering decisions.
The issue occurs because IPv4-over-IEEE1394 ARP omits the target hardware address field, causing rule evaluation to use incorrect bytes for target address comparisons.
How to mitigate CVE-2026-45844
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/03ea11dbefaa55c502735ee551c89ef773fe753b
- https://git.kernel.org/stable/c/1c55053f8ffdc060006df898fd3664e3d1bfac7b
- https://git.kernel.org/stable/c/1e8e3f449b1e73b73a843257635b9c50f0cc0f0a
- https://git.kernel.org/stable/c/ac698d81fd6619c7504cee913f1cab5285fba1b7
- https://git.kernel.org/stable/c/ad9973df8e0eeb123d9ec4d18828e05b7d44ff4b