All vulnerabilities
CVE-2026-98495

Linux: net: arp: terminate device name before lookup

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in47107491b48ceef0a2faa7a010cfa961f211ef9fAlso 7389757d88f54237951d7497d9c4dae7cc6d64be, 1b08c5c3ac27c9ff91c5309f4a32b4e91ce2263b and 2 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 47107491b48ceef0a2faa7a010cfa961f211ef9fLinuxCVE List
  • 7389757d88f54237951d7497d9c4dae7cc6d64beLinuxCVE List
  • 1b08c5c3ac27c9ff91c5309f4a32b4e91ce2263bLinuxCVE List
  • 414bbad9928598904313299ac9e037a73f520be1LinuxCVE List
  • 35e716a70733472ede300540082d64c33bf3b4c9LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: arp: terminate device name before lookup

The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp_dev field may contain IFNAMSIZ bytes without a NUL terminator.

Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where strcmp() can read past the end of the stack object when a matching alternative interface name exists.

Terminate the field before the lookup to prevent the out-of-bounds read.

Text from CVE List

Affected versions 18

  • Linuxaffected: 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc before ae6d704dbf9542b0a0830ec91a2db4f30307e7d8CVE List
  • Linuxaffected: 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc before 47107491b48ceef0a2faa7a010cfa961f211ef9fCVE List
  • Linuxaffected: 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc before 7389757d88f54237951d7497d9c4dae7cc6d64beCVE List
  • Linuxaffected: 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc before 1b08c5c3ac27c9ff91c5309f4a32b4e91ce2263bCVE List
  • Linuxaffected: 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc before 414bbad9928598904313299ac9e037a73f520be1CVE List
  • Linuxaffected: 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc before ba664d83638640cf454b65167339cbf20dfd6f10CVE List
  • Linuxaffected: 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc before 35e716a70733472ede300540082d64c33bf3b4c9CVE List
  • Linuxaffected: 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc before d8b6529e80bcb4fb8177121404cbb3377acaebd2CVE List
  • Linuxaffected: 5.5CVE List
  • Linuxunaffected: all versions before 5.5CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8