Out-of-bounds read in Linux kernel - CVE-2026-98287

Vulnerability details

The vulnerability allows a local user to trigger an out-of-bounds memory read.

The vulnerability exists due to an out-of-bounds read in pppoatm_send() when inspecting the first data byte of zero-length or non-linear packet buffers. A local user can submit zero-length or non-linear frames to trigger an out-of-bounds memory read.

Frames can reach the affected function through PPP channel bridging (PPPIOCBRIDGECHAN).

Affected software

How to mitigate CVE-2026-98287

External References

• https://git.kernel.org/stable/c/208ccc4d08b1897451e9ba01c016bf93ff107966
• https://git.kernel.org/stable/c/30992fe39e65589ed8e000425e088fa74994b811
• https://git.kernel.org/stable/c/8e66c5969acd859ba72fb0a7fa895623fc1b3769
• https://git.kernel.org/stable/c/e2f5529b0016db7d34f411408607f5cf395a542e
• https://git.kernel.org/stable/c/e6cd1bba7d113c15c00ac63671213a096fe4d686
• https://git.kernel.org/stable/c/ecc7253683a3c55caa868ce0ee530fcb0044bd3c
• https://git.kernel.org/stable/c/ffc448eb54f5ba80d4212c1e870cdb92b0f709fa

Related Security Bulletins

• Out-of-bounds read in Linux kernel atm
• Debian update for linux