CVE-2026-98541
Received Received - Intake

Memory Leak in Linux Kernel FOU Direct Encapsulation

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT Commit 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.") added NLA_POLICY_MIN(NLA_U8, 1) to fou_nl_policy[FOU_ATTR_IPPROTO], which rejects an explicitly supplied FOU_ATTR_IPPROTO == 0 attribute with -ERANGE. However, FOU_ATTR_IPPROTO is an optional netlink attribute. When a user sends FOU_CMD_ADD with FOU_ATTR_TYPE set to FOU_ENCAP_DIRECT and omits FOU_ATTR_IPPROTO entirely, nla_policy validation succeeds and parse_nl_config() leaves cfg->protocol as 0 (from memset(cfg, 0, sizeof(*cfg))). fou_create() then creates a FOU_ENCAP_DIRECT socket with fou->protocol == 0. In fou_udp_recv(), returning -fou->protocol to udp_queue_rcv_one_skb() triggers IP protocol resubmission when fou->protocol > 0, whereas returning 0 tells the UDP tunnel layer that the skb was consumed without freeing it. When fou->protocol == 0, every packet received on the socket returns 0 from fou_udp_recv() and leaks the sk_buff. Reject FOU_ENCAP_DIRECT when !cfg->protocol in fou_create() so that creating a direct encapsulation port without FOU_ATTR_IPPROTO fails with -EINVAL while leaving FOU_CMD_DEL and FOU_CMD_GET (which share parse_nl_config()) unaffected. Tested in QEMU against Linux 7.3.0-rc3 by sending a FOU_CMD_ADD Generic Netlink request with FOU_ATTR_PORT = 5555 and FOU_ATTR_TYPE = FOU_ENCAP_DIRECT while omitting FOU_ATTR_IPPROTO. On the unfixed kernel, FOU_CMD_ADD succeeds (err = 0), FOU_CMD_GET reports fou->type = 1 and fou->protocol = 0, and sending 4000 UDP packets to 127.0.0.1:5555 leaks all 4000 sk_buffs (SUnreclaim in /proc/meminfo grows from 41456 kB to 59008 kB, +17552 kB); with this patch applied, FOU_CMD_ADD is rejected with -EINVAL (-22).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98541
EUVD
EUVD-2026-103586

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 23461551c00628c3f3fe9cf837bf53cf8f212b63
Linux Linux 23461551c00628c3f3fe9cf837bf53cf8f212b63
Linux Linux 23461551c00628c3f3fe9cf837bf53cf8f212b63
Linux Linux 23461551c00628c3f3fe9cf837bf53cf8f212b63
Linux Linux 23461551c00628c3f3fe9cf837bf53cf8f212b63
Linux Linux 23461551c00628c3f3fe9cf837bf53cf8f212b63
Linux Linux 23461551c00628c3f3fe9cf837bf53cf8f212b63
Linux Linux 23461551c00628c3f3fe9cf837bf53cf8f212b63
Linux Linux 3.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the FOU (Foo Over UDP) module where omitting the FOU_ATTR_IPPROTO attribute during socket creation for FOU_ENCAP_DIRECT leads to memory leaks. When FOU_ATTR_IPPROTO is omitted, the protocol value defaults to 0, causing received packets to be incorrectly handled and leaking sk_buff structures.

Detection Guidance

This vulnerability involves FOU (Foo Over UDP) encapsulation in the Linux kernel. Detection requires checking for FOU_ENCAP_DIRECT sockets with protocol 0. Use 'ip fou show' to list FOU ports and inspect their types and protocols. Look for entries with type=1 (FOU_ENCAP_DIRECT) and protocol=0.

Impact Analysis

This vulnerability can cause memory leaks on systems using FOU_ENCAP_DIRECT sockets. Attackers could exploit this to consume kernel memory by sending UDP packets to a vulnerable system, potentially leading to denial-of-service conditions due to memory exhaustion.

Mitigation Strategies

Apply the kernel patch that rejects FOU_ENCAP_DIRECT creation without FOU_ATTR_IPPROTO. Update to a fixed Linux kernel version. Alternatively, disable FOU functionality if not required by unloading the fou kernel module using 'modprobe -r fou'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart