{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98952", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.382Z", "datePublished": "2026-10-23T12:19:12.127Z", "dateUpdated": "2026-10-24T14:09:37.815Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:37.815Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: make sure the SEID is linear before reading it\n\npfcp_encap_recv() only makes sure that the UDP header and the 4 byte\nPFCP header are in the linear area. When the S flag is set,\npfcp_session_recv() then reads the 8 byte SEID that follows, which is\nnot covered by the pskb_may_pull() check.\n\nA short PFCP packet with the S flag set, or one whose session header\nlies in a fragment, therefore makes pfcp_session_recv() read beyond the\nend of the packet data, and whatever it finds there is stored in the\ntunnel metadata that flower later classifies on.\n\nPull up to the end of the SEID before reading it, and drop packets\nthat are too short to contain it. Reload the header pointer afterwards\nsince pskb_may_pull() may reallocate the skb head.\n\nUse offsetofend() rather than sizeof(struct pfcphdr_session): the\nstructure is not packed, so its size is 16 bytes because of the\nalignment of the __be64 member, while the header on the wire is only 12\nbytes, and valid session messages would be dropped." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - pfcp_create_sock() binds an unconnected AF_INET socket to INADDR_ANY:8805; an IPv4 PFCP request setting PFCP_SEID_FLAG follows udp_rcv() → udp_queue_rcv_one_skb() → pfcp_encap_recv() → pfcp_session_recv(), so the bytes causing the over-read arrive in a routable UDP message.\nAC:L - A sender needs only a 12–19-byte UDP/PFCP packet with PFCP_SEID_FLAG set, or a fragmented packet leaving the SEID non-linear; the original pskb_may_pull() covers only PFCP_HLEN, so pfcp_session_recv() deterministically reads the unpulled field without a race.\nPR:N - udp_sock_create4() binds PFCP_PORT without restricting a peer, and udp_queue_rcv_one_skb() invokes pfcp_encap_recv() after only packet-policy and checksum checks; neither it nor pfcp_session_recv() authenticates the sender. CAP_NET_ADMIN is needed only to configure the listening device.\nUI:N - pfcp_encap_recv() executes automatically in the UDP receive path when the crafted PFCP request reaches port 8805; no victim action is required after the PFCP interface is configured.\nS:U - The over-read, resulting per-skb tunnel metadata, and flower classification remain within the host kernel's networking security authority; no VM, IOMMU, or other authority boundary is crossed.\nC:L - pfcp_session_recv() copies exactly eight stale bytes beyond the short or non-linear packet data into pfcp_metadata.seid; fl_classify() then uses that value as an SEID key, permitting a bounded classification oracle rather than arbitrary-memory disclosure.\nI:L - The stale md->seid is copied by skb_flow_dissect_tunnel_info() into the flower key used by fl_classify(), so a session packet can take the wrong drop, redirect, or other action. There is no out-of-bounds write or control-flow primitive.\nA:L - The eight-byte read remains in allocated skb tailroom or skb_shared_info rather than furnishing a production-kernel fault; however, the false SEID can make fl_classify() drop or misdirect valid fragmented PFCP requests, limiting availability impact to packet or service degradation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/pfcp.c" ], "versions": [ { "version": "6dd514f48110ebb4bf36875b9e7e02d07b589caa", "lessThan": "3192a5e398c64d48aad64a09e29643e327369bc4", "status": "affected", "versionType": "git" }, { "version": "6dd514f48110ebb4bf36875b9e7e02d07b589caa", "lessThan": "b18a6496495495e2dc27e525aa3315a0c59b9513", "status": "affected", "versionType": "git" }, { "version": "6dd514f48110ebb4bf36875b9e7e02d07b589caa", "lessThan": "2fb6d05f706d79bbdc88835be2f4f45ab56dd819", "status": "affected", "versionType": "git" }, { "version": "6dd514f48110ebb4bf36875b9e7e02d07b589caa", "lessThan": "23609bce9e1de525d1d0e73fc68c6e7971d0b49e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/pfcp.c" ], "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3192a5e398c64d48aad64a09e29643e327369bc4" }, { "url": "https://git.kernel.org/stable/c/b18a6496495495e2dc27e525aa3315a0c59b9513" }, { "url": "https://git.kernel.org/stable/c/2fb6d05f706d79bbdc88835be2f4f45ab56dd819" }, { "url": "https://git.kernel.org/stable/c/23609bce9e1de525d1d0e73fc68c6e7971d0b49e" } ], "title": "pfcp: make sure the SEID is linear before reading it", "x_generator": { "engine": "bippy-1.2.0" } } } }