All vulnerabilities
CVE-2026-98493

Linux: net: ipconfig: bound DHCP option construction

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in38a6a118260ebfc82d0c653194d616bdfbd236acAlso 24e79508b237dd2a69bc6fb6ac5cf7f126178307CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 38a6a118260ebfc82d0c653194d616bdfbd236acLinuxCVE List
  • 24e79508b237dd2a69bc6fb6ac5cf7f126178307LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ipconfig: bound DHCP option construction

ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded.

A 64-byte hostname together with the maximum 252-byte dhcpclass= identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available bytes even before the terminating END marker, so the vendor-class memcpy runs past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is reported as a field-spanning write and, when the kernel is booted with panic_on_warn=1, aborts boot with a panic.

Route the optional options through a common helper that makes sure the option, its 2-byte header and the END marker all fit and drops an option that would not. Configurations with short options keep sending exactly the same bytes as before.

Text from CVE List

Affected versions 12

  • Linuxaffected: 130c0f47fdf9c533deb1136cad5136f6cb7020f0 before 38a6a118260ebfc82d0c653194d616bdfbd236acCVE List
  • Linuxaffected: 130c0f47fdf9c533deb1136cad5136f6cb7020f0 before abcba6f080c63e403037ecdffde43170d242376aCVE List
  • Linuxaffected: 130c0f47fdf9c533deb1136cad5136f6cb7020f0 before 24e79508b237dd2a69bc6fb6ac5cf7f126178307CVE List
  • Linuxaffected: 130c0f47fdf9c533deb1136cad5136f6cb7020f0 before cbaad2922bd5d4d303055ae9afecc8999e6b40c9CVE List
  • Linuxaffected: 130c0f47fdf9c533deb1136cad5136f6cb7020f0 before e47a1958e12abc3a17b5231a4f21c8f1bf662e08CVE List
  • Linuxaffected: 2.6.36CVE List
  • Linuxunaffected: all versions before 2.6.36CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5