CVE-2026-98493

Received Received - Intake

Heap Buffer Overflow in Linux Kernel DHCP Option Handling

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded. A 64-byte hostname together with the maximum 252-byte dhcpclass= identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available bytes even before the terminating END marker, so the vendor-class memcpy runs past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is reported as a field-spanning write and, when the kernel is booted with panic_on_warn=1, aborts boot with a panic. Route the optional options through a common helper that makes sure the option, its 2-byte header and the END marker all fit and drops an option that would not. Configurations with short options keep sending exactly the same bytes as before.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98493

EUVD

EUVD-2026-103733

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	130c0f47fdf9c533deb1136cad5136f6cb7020f0
Linux	Linux	130c0f47fdf9c533deb1136cad5136f6cb7020f0
Linux	Linux	130c0f47fdf9c533deb1136cad5136f6cb7020f0
Linux	Linux	130c0f47fdf9c533deb1136cad5136f6cb7020f0
Linux	Linux	2.6.36

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow in the DHCP option construction during system boot. The function ic_dhcp_init_options() writes hostname, vendor-class, and client-ID options into a fixed 312-byte buffer without proper bounds checking for all fields. A large hostname or vendor-class identifier can exceed the buffer, causing a buffer overflow when CONFIG_FORTIFY_SOURCE is enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's DHCP option handling during boot. Detection requires checking the kernel version and configuration. Use uname -a to verify the kernel version and grep CONFIG_FORTIFY_SOURCE /boot/config-$(uname -r) to confirm if FORTIFY_SOURCE is enabled. If CONFIG_FORTIFY_SOURCE is set and the kernel version is vulnerable, the issue may manifest during boot with a panic if panic_on_warn=1 is set.

Impact Analysis

This vulnerability can cause the Linux kernel to panic and fail to boot if CONFIG_FORTIFY_SOURCE is enabled and the system is configured with panic_on_warn=1. It may lead to system crashes during startup, disrupting services that rely on network configuration via DHCP.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a kernel memory corruption issue during DHCP boot that could cause a kernel panic under specific configurations. Compliance impacts would only occur if system availability or data integrity were compromised due to failed boots, but no evidence suggests this vulnerability leads to data exposure or unauthorized access.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. If immediate patching is not possible, disable CONFIG_FORTIFY_SOURCE or set panic_on_warn=0 to prevent boot panics. Avoid using long hostnames or dhcpclass identifiers in DHCP configurations to reduce the risk of buffer overflow.

Hi! I’m here to help you understand CVE-2026-98493. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70