net: ipconfig: bound DHCP option construction
Summary
| CVE | CVE-2026-98493 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-18 16:17:00 UTC |
| Updated | 2026-10-30 13:21:15 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded. A 64-byte hostname together with the maximum 252-byte dhcpclass= identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available bytes even before the terminating END marker, so the vendor-class memcpy runs past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is reported as a field-spanning write and, when the kernel is booted with panic_on_warn=1, aborts boot with a panic. Route the optional options through a common helper that makes sure the option, its 2-byte header and the END marker all fit and drops an option that would not. Configurations with short options keep sending exactly the same bytes as before. |
Risk And Classification
EPSS: 0.002110000 probability, percentile 0.112890000 (date 2026-11-01)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 e0a221cec0e0ee437680ae0314a4b166509442c5 git | Not specified |
| CNA | Linux | Linux | affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 ca811550b9fa87e02845b4a332d194c2304d933f git | Not specified |
| CNA | Linux | Linux | affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 d8016c82acdd7eaa462e1f38a962b15d8c6a650b git | Not specified |
| CNA | Linux | Linux | affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 38a6a118260ebfc82d0c653194d616bdfbd236ac git | Not specified |
| CNA | Linux | Linux | affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 abcba6f080c63e403037ecdffde43170d242376a git | Not specified |
| CNA | Linux | Linux | affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 24e79508b237dd2a69bc6fb6ac5cf7f126178307 git | Not specified |
| CNA | Linux | Linux | affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 cbaad2922bd5d4d303055ae9afecc8999e6b40c9 git | Not specified |
| CNA | Linux | Linux | affected 130c0f47fdf9c533deb1136cad5136f6cb7020f0 e47a1958e12abc3a17b5231a4f21c8f1bf662e08 git | Not specified |
| CNA | Linux | Linux | affected 2.6.36 | Not specified |
| CNA | Linux | Linux | unaffected 2.6.36 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.273 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.224 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.191 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.160 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.112 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.55 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.9 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/e0a221cec0e0ee437680ae0314a4b166509442c5 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/cbaad2922bd5d4d303055ae9afecc8999e6b40c9 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/24e79508b237dd2a69bc6fb6ac5cf7f126178307 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/abcba6f080c63e403037ecdffde43170d242376a | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/ca811550b9fa87e02845b4a332d194c2304d933f | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/d8016c82acdd7eaa462e1f38a962b15d8c6a650b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/38a6a118260ebfc82d0c653194d616bdfbd236ac | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/e47a1958e12abc3a17b5231a4f21c8f1bf662e08 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.