CVE-2026-98393

Received Received - Intake

UDP Length Overflow in Linux Kernel with PMTU Discovery

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce: 1. Set device MTU bigger than IP_MAX_MTU + 20. cork->base.fragsize will be set to that MTU in ip_setup_cork. 2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be set to device MTU (cork->fragsize) in __ip_append_data, rather than to IP_MAX_MTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of IPv4 header). Device MTU allows it (it's only one byte bigger than IP_MAX_MTU + IPv4 header, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp_set_len_short. Note: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward always clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward. The Fixes tag points at the first commit where I could reproduce the overflow with IPv4 and IP_PMTUDISC_PROBE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98393

EUVD

EUVD-2026-101042

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	daba287b299ec7a2c61ae3a714920e90e8396ad5
Linux	Linux	daba287b299ec7a2c61ae3a714920e90e8396ad5
Linux	Linux	daba287b299ec7a2c61ae3a714920e90e8396ad5
Linux	Linux	3.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a UDP length overflow when Path MTU Discovery (PMTUD) is used with a large Maximum Transmission Unit (MTU). The issue occurs when IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE and a large packet is sent over a network device with an unusually large MTU. The cork->base.fragsize is set to the device MTU, which can exceed IP_MAX_MTU, leading to an overflow in the 16-bit UDP length field.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv4 UDP handling with PMTU discovery. Detection requires checking kernel version and configuration. Use 'uname -r' to check kernel version and 'sysctl net.ipv4.ip_mtu_discover' to verify if IP_PMTUDISC_PROBE is enabled. Monitor kernel logs for WARN messages from udp_set_len_short.

Impact Analysis

This vulnerability could cause system instability or crashes due to the WARN triggered in udp_set_len_short when processing oversized UDP packets. It may also lead to packet corruption or unexpected behavior in network applications relying on UDP.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level network stack issue in the Linux kernel that could cause system instability or crashes under specific conditions, but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix. Avoid using IP_PMTUDISC_PROBE with IPv4. If IP_MTU_DISCOVER must be used, ensure it is set to IP_PMTUDISC_DO instead. Monitor network devices for unusually large MTU settings.

Hi! I’m here to help you understand CVE-2026-98393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70