CVE-2026-98493: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98493 Overview

CVE-2026-98493 is a bounds-checking flaw in the Linux kernel's net/ipconfig subsystem. The function ic_dhcp_init_options() appends DHCP options into the fixed 312-byte bootp_pkt.exten[] buffer without validating remaining space for the hostname (option 12) and vendor-class (option 60) fields. Only the client-ID (option 61) branch performed length checks. A 64-byte hostname combined with a maximum 252-byte dhcpclass= identifier requires 338 bytes, causing the memcpy for vendor-class to write past the end of exten[]. With CONFIG_FORTIFY_SOURCE enabled, the kernel reports a field-spanning write and panics boot when panic_on_warn=1 is set.

Critical Impact
An out-of-bounds write during early DHCP autoconfiguration can corrupt adjacent kernel memory or abort boot on hardened kernels.

Affected Products

Linux kernel versions containing the unbounded ic_dhcp_init_options() DHCP option construction logic
Systems using kernel-level DHCP autoconfiguration (CONFIG_IP_PNP_DHCP)
Hardened kernels built with CONFIG_FORTIFY_SOURCE booted with panic_on_warn=1

Discovery Timeline

2026-10-18 - CVE-2026-98493 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98493

Vulnerability Analysis

The vulnerability lives in the kernel's early IP autoconfiguration code path used before user space is available. During DHCP negotiation, ic_dhcp_init_options() constructs the options area of a BOOTP packet in a statically sized 312-byte buffer named exten[]. The routine writes three optional fields: hostname, vendor-class identifier, and client-ID. Of these, only the client-ID write validated the remaining buffer space before copying.

When the hostname is at its maximum 64 bytes and the kernel command line supplies a vendor-class identifier (dhcpclass=) of the maximum 252 bytes, the combined option headers and payloads exceed 312 bytes. The vendor-class memcpy then writes beyond exten[]. This classifies as an Out-of-Bounds Write affecting kernel memory during boot.

Root Cause

The root cause is missing length validation in two of three DHCP option append operations. The code assumed that typical hostname and vendor-class values would fit in the fixed buffer. It did not account for worst-case combinations of operator-supplied kernel parameters. The fix routes all optional DHCP options through a common helper that verifies the option body, its 2-byte header, and the terminating END marker all fit before copying.

Attack Vector

This flaw is triggered during kernel boot when IP autoconfiguration via DHCP is enabled and sufficiently long values are supplied through kernel command-line parameters such as ip= and dhcpclass=. Exploitation requires control over kernel boot parameters, which typically implies local or physical access to the bootloader. On systems with CONFIG_FORTIFY_SOURCE and panic_on_warn=1, the condition produces a boot-time denial of service rather than silent memory corruption.

See the upstream commits for the technical fix: Kernel Git Commit 24e79508, Kernel Git Commit 38a6a118, Kernel Git Commit abcba6f0, Kernel Git Commit cbaad292, and Kernel Git Commit e47a1958.

Detection Methods for CVE-2026-98493

Indicators of Compromise

Kernel boot logs containing FORTIFY: ...field-spanning write warnings referencing bootp_pkt or exten
Boot panics on hardened kernels configured with panic_on_warn=1 during the DHCP autoconfiguration phase
Unexpected failures in early-boot network initialization on systems using CONFIG_IP_PNP_DHCP

Detection Strategies

Audit kernel command-line parameters (/proc/cmdline) for long ip= hostname fields and dhcpclass= identifiers approaching their maximums
Correlate boot-time dmesg output with kernel versions below the patched stable releases listed in the upstream commits
Inventory systems using in-kernel DHCP (initramfs-less or netboot configurations) to identify exposure

Monitoring Recommendations

Collect and centralize kernel boot logs from Linux fleets to detect FORTIFY_SOURCE warnings
Alert on repeated boot panics tied to the ipconfig subsystem
Track Linux kernel package versions through configuration management to confirm patch rollout

How to Mitigate CVE-2026-98493

Immediate Actions Required

Upgrade affected systems to a Linux kernel release that includes the net: ipconfig: bound DHCP option construction patch referenced in the upstream commits
Review bootloader configurations and remove or shorten unnecessarily long ip= hostname and dhcpclass= parameters
Restrict physical and bootloader access to prevent attacker-controlled kernel command-line modification

Patch Information

The upstream fix introduces a common helper that bounds every optional DHCP option write and drops any option that would not fit alongside its header and the END marker. Short-option configurations continue to transmit identical bytes. Patched commits are available in the mainline and stable trees: 24e79508, 38a6a118, abcba6f0, cbaad292, and e47a1958. Distribution vendors should backport one of these commits to supported stable branches.

Workarounds

Disable kernel-level DHCP autoconfiguration where feasible and perform network configuration in user space via an init system or initramfs
Avoid passing a dhcpclass= identifier on the kernel command line, or constrain its length well below the 252-byte maximum
Keep hostnames supplied via the ip= parameter short to prevent crossing the 312-byte exten[] boundary

bash

# Example: inspect current kernel command line for risky DHCP parameters
cat /proc/cmdline | tr ' ' '\n' | grep -E '^(ip=|dhcpclass=)'

# Example: verify installed kernel version against patched stable releases
uname -r