af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). syzbot reported BUG() in sock_sendmsg_nosec(). [0] The problem is that tpacket_parse_header() casts user-provided tpacket_hdr.tp_len, which is u32, to int. If the length is larger than INT_MAX, the following condition in tpacket_parse_header() passes, if (unlikely(tp_len > size_max)) and any negative value can be returned to the caller, up to sock_sendmsg_nosec(). The repro set tpacket_hdr.tp_len to 0xfffffdef, which is cast to -EIOCBQUEUED (-529), triggering BUG() in sock_sendmsg_nosec(). *(uint64_t*)0x200000000008 = 0xfffffdef; ... syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000000ul, /*count=*/1ul); Let's define the local tp_len as u32 in tpacket_parse_header(). [0]: kernel BUG at net/socket.c:803! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5628 Comm: syz-executor176 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:sock_sendmsg_nosec+0x145/0x180 net/socket.c:803 Code: 06 67 48 0f b9 3a eb 95 e8 e8 3a 22 f8 48 89 df 4c 89 f6 4c 89 e2 4d 89 fb 2e e8 32 a5 5c 16 e9 51 ff ff ff e8 cc 3a 22 f8 90 <0f> 0b e8 c4 3a 22 f8 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28 RSP: 0018:ffffc90003aefb48 EFLAGS: 00010293 RAX: ffffffff89a578d4 RBX: ffff8880764c67c0 RCX: ffff88807fb23e80 RDX: 0000000000000000 RSI: 00000000fffffdef RDI: 000
CVE-2026-98095
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98095
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"lessThan": "3e0cad1432a0c0564f5076bab16f1aa4c0474be4",
"versionType": "git"
},
{
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"lessThan": "6d4d55f75fa0ea32d874eb33e356e9361f3e4591",
"versionType": "git"
},
{
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"lessThan": "09e3c9b32434600a6992e762bf0d6837f5902134",
"versionType": "git"
},
{
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"lessThan": "2b9fa12fbdbfc0f671ff23b0ea06c177a6b8a6b8",
"versionType": "git"
},
{
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"lessThan": "c6b3db727876a027013aa4ccb6913a153a2af41a",
"versionType": "git"
},
{
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"lessThan": "72abe77e88c3f1f71c5348124e9b28e285f26950",
"versionType": "git"
},
{
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"lessThan": "9d714076ff398ba8cc5ae0ae146f4a1ea0bbf5e8",
"versionType": "git"
},
{
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"lessThan": "73e594c19b4f815d8343461cec7074c4713bbde7",
"versionType": "git"
}
],
"programFiles": [
"net/packet/af_packet.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.31",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/packet/af_packet.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98095
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38200 · Revision 1
- Added to Heist Feed
- Publisher date