CVE-2026-98240

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: initialize `options_len` before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneve_opts 4660:66:11223344 dev d0 memcpy: detected buffer overflow: 4 byte write of buffer size 0 kernel BUG at lib/string_helpers.c:1044! ... ip_tun_parse_opts.part.0.cold+0x10/0x10 ip_tun_build_state+0x116/0x2a0 On kernels built with GCC 15+ and `CONFIG_FORTIFY_SOURCE`, the fortified `memcpy()` got 0 sized destination with request of 4 bytes length: static int ip_tun_parse_opts_geneve(...) { ... attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA]; data_len = nla_len(attr); /* == 4 */ struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len; memcpy(opt->opt_data, nla_data(attr), data_len); /* ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */ Fixed by initializing the counter before the options are referenced. Matching what `tunnel_key_opts_set()` already does.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98240

EUVD

EUVD-2026-93168

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	bb5e62f2d547c4de6d1b144cbce2373a76c33f18
Linux	Linux	bb5e62f2d547c4de6d1b144cbce2373a76c33f18
Linux	Linux	bb5e62f2d547c4de6d1b144cbce2373a76c33f18
Linux	Linux	6.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a buffer overflow occurs due to uninitialized memory. The issue happens when parsing GENEVE tunnel options. The kernel fails to initialize the options length counter before using it, leading to a zero-sized destination buffer during a memcpy operation. This triggers a kernel panic on systems with GCC 15+ and CONFIG_FORTIFY_SOURCE enabled.

Detection Guidance

This vulnerability can be detected by attempting to trigger the kernel panic using the provided commands. If the system crashes or shows a buffer overflow error, it may be vulnerable. Run: ip link add d0 type dummy; ip link set d0 up; ip route add 10.30.0.0/16 encap ip id 300 geneve_opts 4660:66:11223344 dev d0

Check kernel logs for messages like 'memcpy: detected buffer overflow' or 'kernel BUG at lib/string_helpers.c' after running the commands.

Impact Analysis

This vulnerability can cause system crashes (kernel panics) when specific network commands are executed. Attackers could exploit it to trigger denial-of-service conditions on affected systems. Systems using newer GCC versions and the FORTIFY_SOURCE feature are particularly vulnerable.

Compliance Impact

This vulnerability causes a kernel panic due to a buffer overflow, which could lead to system crashes or instability. While it does not directly expose data, such crashes may disrupt services handling sensitive information, potentially impacting compliance with standards like GDPR or HIPAA that require availability and integrity of systems processing personal or health data.

Mitigation Strategies

Apply the latest Linux kernel patches that fix this issue. Update to a kernel version where the options_len counter is initialized before options are referenced.

If patching is not immediately possible, avoid using the vulnerable Geneve tunnel options feature until a fix is applied.

Hi! I’m here to help you understand CVE-2026-98240. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70