CVE-2026-98495: Linux Kernel ARP Buffer Overflow Vulnerability

CVE-2026-98495 Overview

CVE-2026-98495 is an out-of-bounds read vulnerability in the Linux kernel's Address Resolution Protocol (ARP) ioctl handler. The ARP ioctl copies a user-provided struct arpreq into a stack object, where the arp_dev field may contain IFNAMSIZ bytes without a NUL terminator. The unterminated string is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where strcmp() can read past the end of the stack object when a matching alternative interface name exists. The fix terminates the field before the lookup to prevent the out-of-bounds read [CWE-125].

Critical Impact
Local users can trigger a kernel stack out-of-bounds read through the ARP ioctl interface, potentially leaking adjacent kernel stack memory contents.

Affected Products

Linux kernel (multiple stable branches, see referenced commits)
Distributions shipping unpatched Linux kernels with ARP ioctl support
Systems where unprivileged processes can issue ARP ioctl calls on network sockets

Discovery Timeline

2026-10-18 - CVE-2026-98495 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98495

Vulnerability Analysis

The vulnerability resides in the Linux kernel ARP ioctl handling path. User-space supplies a struct arpreq whose arp_dev field holds an interface name of up to IFNAMSIZ bytes. The kernel copies this structure onto its stack and passes arp_dev directly to interface lookup helpers such as dev_get_by_name_rcu() and __dev_get_by_name().

These helpers iterate the network device list and compare names using strcmp(). When the attacker-controlled arp_dev buffer fills the full IFNAMSIZ without a trailing NUL byte, strcmp() continues reading past the end of the stack object. If an alternative interface name happens to match the leading bytes, the comparison extends into adjacent stack memory before terminating.

Root Cause

The root cause is a missing NUL terminator enforcement on untrusted input before use in C string operations. The ARP ioctl path trusted that arp_dev would be properly terminated by the caller, but no kernel-side guarantee existed. The upstream fix explicitly NUL-terminates arp_dev at offset IFNAMSIZ - 1 prior to invoking any name-lookup routine.

Attack Vector

Exploitation requires local access and the ability to issue ARP-related ioctl calls (SIOCGARP, SIOCSARP, or SIOCDARP) on a socket. An attacker crafts an arpreq with arp_dev fully populated and without a terminator. If a network interface with a matching alternative name exists, the resulting strcmp() reads bytes beyond the stack buffer. The out-of-bounds read may surface in kernel error paths or timing-observable behavior and could be chained with other primitives for information disclosure.

See the upstream fix in Linux Kernel Commit 1b08c5c and the backports across stable branches referenced in the NVD entry.

Detection Methods for CVE-2026-98495

Indicators of Compromise

Unexpected kernel log entries or KASAN reports referencing dev_get_by_name_rcu or __dev_get_by_name with out-of-bounds access warnings.
Processes without an operational need issuing SIOCGARP, SIOCSARP, or SIOCDARP ioctl calls at unusual rates.
Creation of network interface alternative names (IFLA_ALT_IFNAME) by unprivileged or unexpected workloads.

Detection Strategies

Enable KASAN on test or canary kernels to catch out-of-bounds reads originating from ARP ioctl code paths.
Audit ioctl() syscalls targeting AF_INET sockets with ARP command numbers using eBPF, auditd, or syscall tracing.
Correlate kernel oops or warning events with the invoking process and parent lineage to attribute attempts.

Monitoring Recommendations

Collect kernel ring buffer messages centrally and alert on stack-related KASAN or BUG reports.
Monitor for userspace binaries that invoke rare ARP ioctls outside of networking utilities such as arp or ip.
Track installed kernel versions across the fleet and flag hosts running builds without the referenced stable commits.

How to Mitigate CVE-2026-98495

Immediate Actions Required

Inventory all Linux hosts and identify kernels built before the stable backports listed in the NVD references.
Apply vendor-supplied kernel updates that include the ARP ioctl NUL-termination fix and reboot affected systems.
Restrict local shell access and container escape paths that could grant attackers the ability to issue ARP ioctls.

Patch Information

The fix adds explicit NUL termination of arp_dev before the device lookup. It has been merged upstream and backported across multiple stable trees. Reference commits include 1b08c5c, 35e716a, 414bbad, 4710749, 7389757, ae6d704, ba664d8, and d8b6529. Install the distribution kernel package that incorporates the matching backport for your release.

Workarounds

Use seccomp profiles to deny ioctl requests for SIOCSARP, SIOCGARP, and SIOCDARP in untrusted workloads.
Avoid assigning alternative interface names (IFLA_ALT_IFNAME) on hosts that cannot be patched promptly, reducing the chance of a matching comparison.
Limit CAP_NET_ADMIN and container network capabilities so only trusted services can manipulate ARP state.

bash

# Verify your running kernel contains the fix after update
uname -r
# Example: list applied patches on Debian/Ubuntu
dpkg -l | grep linux-image
# Example: list applied patches on RHEL/CentOS
rpm -qa kernel