{"api_version":"1","generated_at":"2026-10-27T04:28:09+00:00","cve":"CVE-2026-98952","urls":{"html":"https://cve.report/CVE-2026-98952","api":"https://cve.report/api/cve/CVE-2026-98952.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98952","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98952"},"summary":{"title":"pfcp: make sure the SEID is linear before reading it","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: make sure the SEID is linear before reading it\n\npfcp_encap_recv() only makes sure that the UDP header and the 4 byte\nPFCP header are in the linear area. When the S flag is set,\npfcp_session_recv() then reads the 8 byte SEID that follows, which is\nnot covered by the pskb_may_pull() check.\n\nA short PFCP packet with the S flag set, or one whose session header\nlies in a fragment, therefore makes pfcp_session_recv() read beyond the\nend of the packet data, and whatever it finds there is stored in the\ntunnel metadata that flower later classifies on.\n\nPull up to the end of the SEID before reading it, and drop packets\nthat are too short to contain it. Reload the header pointer afterwards\nsince pskb_may_pull() may reallocate the skb head.\n\nUse offsetofend() rather than sizeof(struct pfcphdr_session): the\nstructure is not packed, so its size is 16 bytes because of the\nalignment of the __be64 member, while the header on the wire is only 12\nbytes, and valid session messages would be dropped.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-23 13:17:16","updated_at":"2026-10-24 14:16:49"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.3","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.3","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","data":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/23609bce9e1de525d1d0e73fc68c6e7971d0b49e","name":"https://git.kernel.org/stable/c/23609bce9e1de525d1d0e73fc68c6e7971d0b49e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b18a6496495495e2dc27e525aa3315a0c59b9513","name":"https://git.kernel.org/stable/c/b18a6496495495e2dc27e525aa3315a0c59b9513","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2fb6d05f706d79bbdc88835be2f4f45ab56dd819","name":"https://git.kernel.org/stable/c/2fb6d05f706d79bbdc88835be2f4f45ab56dd819","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3192a5e398c64d48aad64a09e29643e327369bc4","name":"https://git.kernel.org/stable/c/3192a5e398c64d48aad64a09e29643e327369bc4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98952","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98952","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6dd514f48110ebb4bf36875b9e7e02d07b589caa 3192a5e398c64d48aad64a09e29643e327369bc4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6dd514f48110ebb4bf36875b9e7e02d07b589caa b18a6496495495e2dc27e525aa3315a0c59b9513 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6dd514f48110ebb4bf36875b9e7e02d07b589caa 2fb6d05f706d79bbdc88835be2f4f45ab56dd819 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6dd514f48110ebb4bf36875b9e7e02d07b589caa 23609bce9e1de525d1d0e73fc68c6e7971d0b49e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.10","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.10 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.113 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.57 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.11 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/pfcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3192a5e398c64d48aad64a09e29643e327369bc4","status":"affected","version":"6dd514f48110ebb4bf36875b9e7e02d07b589caa","versionType":"git"},{"lessThan":"b18a6496495495e2dc27e525aa3315a0c59b9513","status":"affected","version":"6dd514f48110ebb4bf36875b9e7e02d07b589caa","versionType":"git"},{"lessThan":"2fb6d05f706d79bbdc88835be2f4f45ab56dd819","status":"affected","version":"6dd514f48110ebb4bf36875b9e7e02d07b589caa","versionType":"git"},{"lessThan":"23609bce9e1de525d1d0e73fc68c6e7971d0b49e","status":"affected","version":"6dd514f48110ebb4bf36875b9e7e02d07b589caa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/pfcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.113","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.113","versionStartIncluding":"6.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.57","versionStartIncluding":"6.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.11","versionStartIncluding":"6.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: make sure the SEID is linear before reading it\n\npfcp_encap_recv() only makes sure that the UDP header and the 4 byte\nPFCP header are in the linear area. When the S flag is set,\npfcp_session_recv() then reads the 8 byte SEID that follows, which is\nnot covered by the pskb_may_pull() check.\n\nA short PFCP packet with the S flag set, or one whose session header\nlies in a fragment, therefore makes pfcp_session_recv() read beyond the\nend of the packet data, and whatever it finds there is stored in the\ntunnel metadata that flower later classifies on.\n\nPull up to the end of the SEID before reading it, and drop packets\nthat are too short to contain it. Reload the header pointer afterwards\nsince pskb_may_pull() may reallocate the skb head.\n\nUse offsetofend() rather than sizeof(struct pfcphdr_session): the\nstructure is not packed, so its size is 16 bytes because of the\nalignment of the __be64 member, while the header on the wire is only 12\nbytes, and valid session messages would be dropped."}],"metrics":[{"cvssV3_1":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - pfcp_create_sock() binds an unconnected AF_INET socket to INADDR_ANY:8805; an IPv4 PFCP request setting PFCP_SEID_FLAG follows udp_rcv() → udp_queue_rcv_one_skb() → pfcp_encap_recv() → pfcp_session_recv(), so the bytes causing the over-read arrive in a routable UDP message.\nAC:L - A sender needs only a 12–19-byte UDP/PFCP packet with PFCP_SEID_FLAG set, or a fragmented packet leaving the SEID non-linear; the original pskb_may_pull() covers only PFCP_HLEN, so pfcp_session_recv() deterministically reads the unpulled field without a race.\nPR:N - udp_sock_create4() binds PFCP_PORT without restricting a peer, and udp_queue_rcv_one_skb() invokes pfcp_encap_recv() after only packet-policy and checksum checks; neither it nor pfcp_session_recv() authenticates the sender. CAP_NET_ADMIN is needed only to configure the listening device.\nUI:N - pfcp_encap_recv() executes automatically in the UDP receive path when the crafted PFCP request reaches port 8805; no victim action is required after the PFCP interface is configured.\nS:U - The over-read, resulting per-skb tunnel metadata, and flower classification remain within the host kernel's networking security authority; no VM, IOMMU, or other authority boundary is crossed.\nC:L - pfcp_session_recv() copies exactly eight stale bytes beyond the short or non-linear packet data into pfcp_metadata.seid; fl_classify() then uses that value as an SEID key, permitting a bounded classification oracle rather than arbitrary-memory disclosure.\nI:L - The stale md->seid is copied by skb_flow_dissect_tunnel_info() into the flower key used by fl_classify(), so a session packet can take the wrong drop, redirect, or other action. There is no out-of-bounds write or control-flow primitive.\nA:L - The eight-byte read remains in allocated skb tailroom or skb_shared_info rather than furnishing a production-kernel fault; however, the false SEID can make fl_classify() drop or misdirect valid fragmented PFCP requests, limiting availability impact to packet or service degradation."}]}],"providerMetadata":{"dateUpdated":"2026-10-24T14:09:37.815Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/3192a5e398c64d48aad64a09e29643e327369bc4"},{"url":"https://git.kernel.org/stable/c/b18a6496495495e2dc27e525aa3315a0c59b9513"},{"url":"https://git.kernel.org/stable/c/2fb6d05f706d79bbdc88835be2f4f45ab56dd819"},{"url":"https://git.kernel.org/stable/c/23609bce9e1de525d1d0e73fc68c6e7971d0b49e"}],"title":"pfcp: make sure the SEID is linear before reading it","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98952","datePublished":"2026-10-23T12:19:12.127Z","dateReserved":"2026-09-25T10:25:14.382Z","dateUpdated":"2026-10-24T14:09:37.815Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-23 13:17:16","lastModifiedDate":"2026-10-24 14:16:49","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98952","Ordinal":"1","Title":"pfcp: make sure the SEID is linear before reading it","CVE":"CVE-2026-98952","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98952","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: make sure the SEID is linear before reading it\n\npfcp_encap_recv() only makes sure that the UDP header and the 4 byte\nPFCP header are in the linear area. When the S flag is set,\npfcp_session_recv() then reads the 8 byte SEID that follows, which is\nnot covered by the pskb_may_pull() check.\n\nA short PFCP packet with the S flag set, or one whose session header\nlies in a fragment, therefore makes pfcp_session_recv() read beyond the\nend of the packet data, and whatever it finds there is stored in the\ntunnel metadata that flower later classifies on.\n\nPull up to the end of the SEID before reading it, and drop packets\nthat are too short to contain it. Reload the header pointer afterwards\nsince pskb_may_pull() may reallocate the skb head.\n\nUse offsetofend() rather than sizeof(struct pfcphdr_session): the\nstructure is not packed, so its size is 16 bytes because of the\nalignment of the __be64 member, while the header on the wire is only 12\nbytes, and valid session messages would be dropped.","Type":"Description","Title":"pfcp: make sure the SEID is linear before reading it"}]}}}