CVE-2026-98493net: ipconfig: bound DHCP option construction
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded. A 64-byte hostname together with the maximum 252-byte dhcpclass= identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available bytes even before the terminating END marker, so the vendor-class memcpy runs past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is reported as a field-spanning write and, when the kernel is booted with panic_on_warn=1, aborts boot with a panic. Route the optional options through a common helper that makes sure the option, its 2-byte header and the END marker all fit and drops an option that would not. Configurations with short options keep sending exactly the same bytes as before.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 130c0f47fdf9c533deb1136cad5136f6cb7020f0 before abcba6f080c63e403037ecdffde43170d242376a; 130c0f47fdf9c533deb1136cad5136f6cb7020f0 builds before 24e79508b237dd2a69bc6fb6ac5cf7f126178307; from 130c0f47fdf9c533deb1136cad5136f6cb7020f0 before cbaad2922bd5d4d303055ae9afecc8999e6b40c9; from 130c0f47fdf9c533deb1136cad5136f6cb7020f0 before e47a1958e12abc3a17b5231a4f21c8f1bf662e08 | CNA record |
References
- https://git.kernel.org/stable/c/abcba6f080c63e403037ecdffde43170d242376a
- https://git.kernel.org/stable/c/24e79508b237dd2a69bc6fb6ac5cf7f126178307
- https://git.kernel.org/stable/c/cbaad2922bd5d4d303055ae9afecc8999e6b40c9
- https://git.kernel.org/stable/c/e47a1958e12abc3a17b5231a4f21c8f1bf662e08
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.