{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98493", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.353Z", "datePublished": "2026-10-18T15:16:22.301Z", "dateUpdated": "2026-10-21T12:55:14.581Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:55:14.581Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipconfig: bound DHCP option construction\n\nic_dhcp_init_options() appends the hostname (option 12), vendor-class\n(option 60) and client-ID (option 61) options into the fixed 312-byte\nbootp_pkt.exten[] buffer. Only the client-ID branch checked the\nremaining space; the hostname and vendor-class writes were unbounded.\n\nA 64-byte hostname together with the maximum 252-byte dhcpclass=\nidentifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available\nbytes even before the terminating END marker, so the vendor-class memcpy\nruns past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is\nreported as a field-spanning write and, when the kernel is booted with\npanic_on_warn=1, aborts boot with a panic.\n\nRoute the optional options through a common helper that makes sure the\noption, its 2-byte header and the END marker all fit and drops an option\nthat would not. Configurations with short options keep sending exactly\nthe same bytes as before."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/ipconfig.c"], "versions": [{"version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "lessThan": "38a6a118260ebfc82d0c653194d616bdfbd236ac", "status": "affected", "versionType": "git"}, {"version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "lessThan": "abcba6f080c63e403037ecdffde43170d242376a", "status": "affected", "versionType": "git"}, {"version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "lessThan": "24e79508b237dd2a69bc6fb6ac5cf7f126178307", "status": "affected", "versionType": "git"}, {"version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "lessThan": "cbaad2922bd5d4d303055ae9afecc8999e6b40c9", "status": "affected", "versionType": "git"}, {"version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "lessThan": "e47a1958e12abc3a17b5231a4f21c8f1bf662e08", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/ipconfig.c"], "versions": [{"version": "2.6.36", "status": "affected"}, {"version": "0", "lessThan": "2.6.36", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/38a6a118260ebfc82d0c653194d616bdfbd236ac"}, {"url": "https://git.kernel.org/stable/c/abcba6f080c63e403037ecdffde43170d242376a"}, {"url": "https://git.kernel.org/stable/c/24e79508b237dd2a69bc6fb6ac5cf7f126178307"}, {"url": "https://git.kernel.org/stable/c/cbaad2922bd5d4d303055ae9afecc8999e6b40c9"}, {"url": "https://git.kernel.org/stable/c/e47a1958e12abc3a17b5231a4f21c8f1bf662e08"}], "title": "net: ipconfig: bound DHCP option construction", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/ipconfig.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "38a6a118260ebfc82d0c653194d616bdfbd236ac", "status": "affected", "version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "versionType": "git"}, {"lessThan": "abcba6f080c63e403037ecdffde43170d242376a", "status": "affected", "version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "versionType": "git"}, {"lessThan": "24e79508b237dd2a69bc6fb6ac5cf7f126178307", "status": "affected", "version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "versionType": "git"}, {"lessThan": "cbaad2922bd5d4d303055ae9afecc8999e6b40c9", "status": "affected", "version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "versionType": "git"}, {"lessThan": "e47a1958e12abc3a17b5231a4f21c8f1bf662e08", "status": "affected", "version": "130c0f47fdf9c533deb1136cad5136f6cb7020f0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/ipconfig.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.36"}, {"lessThan": "2.6.36", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipconfig: bound DHCP option construction\n\nic_dhcp_init_options() appends the hostname (option 12), vendor-class\n(option 60) and client-ID (option 61) options into the fixed 312-byte\nbootp_pkt.exten[] buffer. Only the client-ID branch checked the\nremaining space; the hostname and vendor-class writes were unbounded.\n\nA 64-byte hostname together with the maximum 252-byte dhcpclass=\nidentifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available\nbytes even before the terminating END marker, so the vendor-class memcpy\nruns past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is\nreported as a field-spanning write and, when the kernel is booted with\npanic_on_warn=1, aborts boot with a panic.\n\nRoute the optional options through a common helper that makes sure the\noption, its 2-byte header and the END marker all fit and drops an option\nthat would not. Configurations with short options keep sending exactly\nthe same bytes as before."}], "id": "CVE-2026-98493", "lastModified": "2026-10-21T13:21:31.873", "metrics": {}, "published": "2026-10-18T16:17:00.257", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/24e79508b237dd2a69bc6fb6ac5cf7f126178307"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/38a6a118260ebfc82d0c653194d616bdfbd236ac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abcba6f080c63e403037ecdffde43170d242376a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cbaad2922bd5d4d303055ae9afecc8999e6b40c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e47a1958e12abc3a17b5231a4f21c8f1bf662e08"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: ipconfig: bound DHCP option construction", "id": "2554885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554885"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: ipconfig: bound DHCP option construction\nic_dhcp_init_options() appends the hostname (option 12), vendor-class\n(option 60) and client-ID (option 61) options into the fixed 312-byte\nbootp_pkt.exten[] buffer. Only the client-ID branch checked the\nremaining space; the hostname and vendor-class writes were unbounded.\nA 64-byte hostname together with the maximum 252-byte dhcpclass=\nidentifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available\nbytes even before the terminating END marker, so the vendor-class memcpy\nruns past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is\nreported as a field-spanning write and, when the kernel is booted with\npanic_on_warn=1, aborts boot with a panic.\nRoute the optional options through a common helper that makes sure the\noption, its 2-byte header and the END marker all fit and drops an option\nthat would not. Configurations with short options keep sending exactly\nthe same bytes as before.", "A flaw was found in the Linux kernel. This vulnerability allows an attacker capable of specifying system boot or network parameters to cause a Denial of Service (DoS) or memory corruption. During Dynamic Host Configuration Protocol (DHCP) autoconfiguration, the kernel appends options into a fixed-size buffer without verifying available space for hostname and vendor class identifiers. Supplying oversized configuration parameters triggers an out-of-bounds memory write, which can abort the boot process with a kernel panic."], "name": "CVE-2026-98493", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98493\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98493\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98493.mbox"], "threat_severity": "Moderate"}