All vulnerabilities
CVE-2026-98097

Linux: tipc: Dont send random pad bytes in RESET/ACTIVATE messages

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3dbb628cfc592a4148d8136dcda1f706cdcad4f3Also 48033a89356b8ae21a94db70c79bb6fcc91a23c2, 4ab2977323d5f068a872126f7818d1aeb9e9ca0d and 1 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 3dbb628cfc592a4148d8136dcda1f706cdcad4f3LinuxCVE List
  • 48033a89356b8ae21a94db70c79bb6fcc91a23c2LinuxCVE List
  • 4ab2977323d5f068a872126f7818d1aeb9e9ca0dLinuxCVE List
  • 81c600c26302a27852ed8b19c5f2f647ea3555c9LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: Dont send random pad bytes in RESET/ACTIVATE messages

The interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer. Replace the strcpy(data, l->if_name) with memcpy() so that the pad bytes are actually written (l->if_name[] is zero padded) rather than sending random bytes from the skb to the remote system.

Replace two other strcpy() with strscpy().

Text from CVE List

Affected versions 12

  • Linuxaffected: e74a386d70c793ef44678b44b021c99094b28c47 before 3dbb628cfc592a4148d8136dcda1f706cdcad4f3CVE List
  • Linuxaffected: e74a386d70c793ef44678b44b021c99094b28c47 before 48033a89356b8ae21a94db70c79bb6fcc91a23c2CVE List
  • Linuxaffected: e74a386d70c793ef44678b44b021c99094b28c47 before 4ab2977323d5f068a872126f7818d1aeb9e9ca0dCVE List
  • Linuxaffected: e74a386d70c793ef44678b44b021c99094b28c47 before bee1459e57f2e0bd240c62f35c0a284291e27971CVE List
  • Linuxaffected: e74a386d70c793ef44678b44b021c99094b28c47 before 81c600c26302a27852ed8b19c5f2f647ea3555c9CVE List
  • Linuxaffected: 4.6CVE List
  • Linuxunaffected: all versions before 4.6CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5