Out-of-bounds read in Linux kernel - CVE-2026-98952

Vulnerability identifier: #VU157556

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98952

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause out-of-bounds reads that populate tunnel metadata with unintended memory contents.

The vulnerability exists due to an out-of-bounds read in pfcp_session_recv() in drivers/net/pfcp.c when processing PFCP packets with the S flag set without ensuring that the entire session endpoint identifier (SEID) is present in the linear packet data. A remote attacker can send a short PFCP packet or one whose session header lies in a fragment to cause an eight-byte SEID read beyond the available packet data, with the resulting value stored in tunnel metadata used by flower for classification.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-realtime (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux-raspi (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-azure-fde-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-gke (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-aws-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-43.43
linux-realtime (Ubuntu package) - update to 7.0.0-43.43.1
linux-oracle (Ubuntu package) - update to 7.0.0-1016.18
linux-aws (Ubuntu package) - update to 7.0.0-1017.18
linux-gcp (Ubuntu package) - update to 7.0.0-1017.19
linux-azure (Ubuntu package) - update to 7.0.0-1020.21
linux-raspi (Ubuntu package) - update to 7.0.0-1023.23
linux-ibm (Ubuntu package) - update to 7.0.0-1018.18
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1016.18~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1017.19~24.04.1
linux-azure-fde-7.0 (Ubuntu package) - update to 7.0.0-1019.19~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1018.18
linux-gke (Ubuntu package) - update to 7.0.0-1010.11
linux-azure-fde (Ubuntu package) - update to 7.0.0-1019.19
linux-aws-7.0 (Ubuntu package) - update to 7.0.0-1017.18~24.04.1

• https://git.kernel.org/stable/c/23609bce9e1de525d1d0e73fc68c6e7971d0b49e
• https://git.kernel.org/stable/c/2fb6d05f706d79bbdc88835be2f4f45ab56dd819
• https://git.kernel.org/stable/c/3192a5e398c64d48aad64a09e29643e327369bc4
• https://git.kernel.org/stable/c/b18a6496495495e2dc27e525aa3315a0c59b9513

• Out-of-bounds read in Linux kernel net driver
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0 and more
• Ubuntu update for linux-raspi