Out-of-bounds read in Linux kernel - CVE-2026-99112

Vulnerability details

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering an out-of-bounds kernel memory read.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's flower classifier when processing nested tunnel-option attributes with an improperly validated mask cursor. A local privileged user can supply crafted filter attributes that advance the mask cursor beyond its valid payload, causing subsequent attribute parsing to read outside the mask buffer and potentially crash the kernel.

Affected software

How to mitigate CVE-2026-99112

External References

• https://git.kernel.org/stable/c/45e60747a9db2307929260d9aa9c1c6cbb70ee77
• https://git.kernel.org/stable/c/bb187146c7e5c666874784e4f3fc1bc5126e6e92
• https://git.kernel.org/stable/c/fee10655709c5c597e8e9f722f3035d9ea31ff3a

Related Security Bulletins

• Out-of-bounds read in Linux kernel sched