net: ipconfig: bound DHCP option construction

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98493
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:00 UTC
Updated2026-10-21 13:21:31 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded. A 64-byte hostname together with the maximum 252-byte dhcpclass= identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available bytes even before the terminating END marker, so the vendor-class memcpy runs past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is reported as a field-spanning write and, when the kernel is booted with panic_on_warn=1, aborts boot with a panic. Route the optional options through a common helper that makes sure the option, its 2-byte header and the END marker all fit and drops an option that would not. Configurations with short options keep sending exactly the same bytes as before.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 38a6a118260ebfc82d0c653194d616bdfbd236ac git Not specified
CNA Linux Linux affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 abcba6f080c63e403037ecdffde43170d242376a git Not specified
CNA Linux Linux affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 24e79508b237dd2a69bc6fb6ac5cf7f126178307 git Not specified
CNA Linux Linux affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 cbaad2922bd5d4d303055ae9afecc8999e6b40c9 git Not specified
CNA Linux Linux affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 e47a1958e12abc3a17b5231a4f21c8f1bf662e08 git Not specified
CNA Linux Linux affected 2.6.36 Not specified
CNA Linux Linux unaffected 2.6.36 semver Not specified
CNA Linux Linux unaffected 6.6.160 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.112 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.55 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.9 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/cbaad2922bd5d4d303055ae9afecc8999e6b40c9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/24e79508b237dd2a69bc6fb6ac5cf7f126178307 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/abcba6f080c63e403037ecdffde43170d242376a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/38a6a118260ebfc82d0c653194d616bdfbd236ac 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e47a1958e12abc3a17b5231a4f21c8f1bf662e08 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report