« Volver al listado

CVE-2026-98095

Estado: En análisisSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().

syzbot reported BUG() in sock_sendmsg_nosec(). [0]

The problem is that tpacket_parse_header() casts user-provided tpacket_hdr.tp_len, which is u32, to int.

If the length is larger than INT_MAX, the following condition in tpacket_parse_header() passes,

and any negative value can be returned to the caller, up to sock_sendmsg_nosec().

The repro set tpacket_hdr.tp_len to 0xfffffdef, which is cast to -EIOCBQUEUED (-529), triggering BUG() in sock_sendmsg_nosec().

Let's define the local tp_len as u32 in tpacket_parse_header().

Detalles técnicos trazas, registros y código del informe original
  if (unlikely(tp_len > size_max))

  *(uint64_t*)0x200000000008 = 0xfffffdef;
  ...
  syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000000ul, /*count=*/1ul);

[0]:
kernel BUG at net/socket.c:803!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5628 Comm: syz-executor176 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:sock_sendmsg_nosec+0x145/0x180 net/socket.c:803
Code: 06 67 48 0f b9 3a eb 95 e8 e8 3a 22 f8 48 89 df 4c 89 f6 4c 89 e2 4d 89 fb 2e e8 32 a5 5c 16 e9 51 ff ff ff e8 cc 3a 22 f8 90 <0f> 0b e8 c4 3a 22 f8 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28
RSP: 0018:ffffc90003aefb48 EFLAGS: 00010293
RAX: ffffffff89a578d4 RBX: ffff8880764c67c0 RCX: ffff88807fb23e80
RDX: 0000000000000000 RSI: 00000000fffffdef RDI: 00000000fffffdef
RBP: 00000000fffffdef R08: ffffc90003aef747 R09: 1ffff9200075dee8
R10: dffffc0000000000 R11: fffff5200075dee9 R12: 0000000000000001
R13: dffffc0000000000 R14: ffffc90003aefbc0 R15: ffffffff8aac4310
FS:  000055559101b400(0000) GS:ffff888124ce0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000210 CR3: 0000000073dca000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __sock_sendmsg net/socket.c:815 [inline]
 sock_write_iter+0x2de/0x3e0 net/socket.c:1266
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x612/0xba0 fs/read_write.c:687
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f173130ecb9
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd67e44248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f173130ecb9
RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd67e44388
R13: 0000000000000002 R14: 00002000000000c0 R15: 0000000000000002
 </TASK>

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98095",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "lessThan": "3e0cad1432a0c0564f5076bab16f1aa4c0474be4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "lessThan": "6d4d55f75fa0ea32d874eb33e356e9361f3e4591",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "lessThan": "09e3c9b32434600a6992e762bf0d6837f5902134",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "lessThan": "2b9fa12fbdbfc0f671ff23b0ea06c177a6b8a6b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "lessThan": "c6b3db727876a027013aa4ccb6913a153a2af41a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "lessThan": "72abe77e88c3f1f71c5348124e9b28e285f26950",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "lessThan": "9d714076ff398ba8cc5ae0ae146f4a1ea0bbf5e8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "lessThan": "73e594c19b4f815d8343461cec7074c4713bbde7",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.31",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:39.243",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/09e3c9b32434600a6992e762bf0d6837f5902134",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2b9fa12fbdbfc0f671ff23b0ea06c177a6b8a6b8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3e0cad1432a0c0564f5076bab16f1aa4c0474be4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6d4d55f75fa0ea32d874eb33e356e9361f3e4591",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/72abe77e88c3f1f71c5348124e9b28e285f26950",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/73e594c19b4f815d8343461cec7074c4713bbde7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9d714076ff398ba8cc5ae0ae146f4a1ea0bbf5e8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c6b3db727876a027013aa4ccb6913a153a2af41a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().\n\nsyzbot reported BUG() in sock_sendmsg_nosec(). [0]\n\nThe problem is that tpacket_parse_header() casts user-provided\ntpacket_hdr.tp_len, which is u32, to int.\n\nIf the length is larger than INT_MAX, the following condition\nin tpacket_parse_header() passes,\n\n  if (unlikely(tp_len > size_max))\n\nand any negative value can be returned to the caller, up to\nsock_sendmsg_nosec().\n\nThe repro set tpacket_hdr.tp_len to 0xfffffdef, which is cast\nto -EIOCBQUEUED (-529), triggering BUG() in sock_sendmsg_nosec().\n\n  *(uint64_t*)0x200000000008 = 0xfffffdef;\n  ...\n  syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000000ul, /*count=*/1ul);\n\nLet's define the local tp_len as u32 in tpacket_parse_header().\n\n[0]:\nkernel BUG at net/socket.c:803!\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 0 UID: 0 PID: 5628 Comm: syz-executor176 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026\nRIP: 0010:sock_sendmsg_nosec+0x145/0x180 net/socket.c:803\nCode: 06 67 48 0f b9 3a eb 95 e8 e8 3a 22 f8 48 89 df 4c 89 f6 4c 89 e2 4d 89 fb 2e e8 32 a5 5c 16 e9 51 ff ff ff e8 cc 3a 22 f8 90 <0f> 0b e8 c4 3a 22 f8 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28\nRSP: 0018:ffffc90003aefb48 EFLAGS: 00010293\nRAX: ffffffff89a578d4 RBX: ffff8880764c67c0 RCX: ffff88807fb23e80\nRDX: 0000000000000000 RSI: 00000000fffffdef RDI: 00000000fffffdef\nRBP: 00000000fffffdef R08: ffffc90003aef747 R09: 1ffff9200075dee8\nR10: dffffc0000000000 R11: fffff5200075dee9 R12: 0000000000000001\nR13: dffffc0000000000 R14: ffffc90003aefbc0 R15: ffffffff8aac4310\nFS:  000055559101b400(0000) GS:ffff888124ce0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000000210 CR3: 0000000073dca000 CR4: 00000000003526f0\nCall Trace:\n <TASK>\n __sock_sendmsg net/socket.c:815 [inline]\n sock_write_iter+0x2de/0x3e0 net/socket.c:1266\n new_sync_write fs/read_write.c:595 [inline]\n vfs_write+0x612/0xba0 fs/read_write.c:687\n ksys_write+0x150/0x270 fs/read_write.c:739\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f173130ecb9\nCode: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffd67e44248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f173130ecb9\nRDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd67e44388\nR13: 0000000000000002 R14: 00002000000000c0 R15: 0000000000000002\n </TASK>"
    }
  ],
  "lastModified": "2026-10-03T11:18:31.633",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}