CVE-2026-98541: Linux Kernel FOU Information Disclosure

CVE-2026-98541 Overview

CVE-2026-98541 is a memory leak vulnerability in the Linux kernel's Foo-over-UDP (FOU) encapsulation subsystem. The flaw resides in fou_create() and fou_udp_recv(), where a user can create a FOU_ENCAP_DIRECT socket without specifying FOU_ATTR_IPPROTO. When the attribute is omitted, cfg->protocol remains zero after parse_nl_config(), and the socket is created with fou->protocol == 0. Every subsequent UDP packet received on that port leaks its sk_buff, exhausting unreclaimable slab memory over time.

Critical Impact
A local user with CAP_NET_ADMIN can trigger unbounded kernel memory exhaustion by sending UDP packets to a misconfigured FOU port, leading to denial of service.

Affected Products

Linux kernel (upstream, multiple stable branches)
Distributions shipping the FOU (Foo-over-UDP) tunnel module
Systems with CONFIG_NET_FOU enabled

Discovery Timeline

2026-10-18 - CVE-2026-98541 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98541

Vulnerability Analysis

The vulnerability is a kernel memory leak (resource exhaustion) in the FOU netlink configuration path. Commit 7a9bc9e3f423 added NLA_POLICY_MIN(NLA_U8, 1) to fou_nl_policy[FOU_ATTR_IPPROTO] to reject an explicitly supplied value of zero. However, because FOU_ATTR_IPPROTO is an optional attribute, omitting it entirely bypasses the policy check. The configuration structure is zero-initialized via memset(), so cfg->protocol silently remains 0 and fou_create() proceeds to allocate a FOU_ENCAP_DIRECT socket in an invalid state.

In fou_udp_recv(), the return value -fou->protocol normally signals the UDP tunnel layer to resubmit the skb for IP protocol processing. When fou->protocol == 0, the function returns 0, which indicates to udp_queue_rcv_one_skb() that the skb was consumed. The skb is neither freed nor processed further, leaking kernel memory on every received packet.

Root Cause

The netlink attribute policy only validates values that are actually present. Because FOU_ATTR_IPPROTO is optional and cfg is pre-zeroed, the invariant protocol > 0 for FOU_ENCAP_DIRECT sockets is never enforced in fou_create(). This is an input validation gap bridging netlink parsing and the FOU socket state machine.

Attack Vector

An attacker with the ability to issue Generic Netlink requests to the FOU subsystem (typically requiring CAP_NET_ADMIN) sends a FOU_CMD_ADD message with FOU_ATTR_PORT set and FOU_ATTR_TYPE = FOU_ENCAP_DIRECT, omitting FOU_ATTR_IPPROTO. The command succeeds and creates a listening UDP socket. Any UDP traffic directed at that port causes per-packet sk_buff leaks. In the reporter's QEMU test, 4000 packets leaked all 4000 skbs, with SUnreclaim growing by roughly 17 MB.

No verified exploitation code is published. See the upstream fix for technical details in the referenced kernel commits.

Detection Methods for CVE-2026-98541

Indicators of Compromise

Steady, unexplained growth of SUnreclaim in /proc/meminfo on hosts with FOU enabled.
Presence of FOU sockets with type = 1 (direct) and protocol = 0 when queried via FOU_CMD_GET.
Unusual Generic Netlink FOU_CMD_ADD activity originating from non-administrative workloads.

Detection Strategies

Audit kernel netlink operations with auditd rules targeting the NETLINK_GENERIC family and FOU family name.
Enumerate active FOU encapsulation ports with ip fou show and flag entries missing an ipproto value.
Monitor slab allocator statistics (slabtop, /proc/slabinfo) for sustained skbuff_head_cache or skbuff_fclone_cache growth without corresponding socket activity.

Monitoring Recommendations

Alert on sustained kernel slab growth that does not correlate with workload scaling.
Baseline the loaded state of the fou module and alert on unexpected modprobe fou events.
Correlate container or namespace lifecycle events with FOU socket creation to spot anomalous configuration.

How to Mitigate CVE-2026-98541

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry to all affected stable branches.
If patching is deferred, unload the fou module (modprobe -r fou) on systems that do not require Foo-over-UDP tunneling.
Restrict CAP_NET_ADMIN to trusted workloads and audit any container or namespace that holds it.

Patch Information

The fix rejects FOU_ENCAP_DIRECT creation when !cfg->protocol in fou_create(), returning -EINVAL. FOU_CMD_DEL and FOU_CMD_GET, which share parse_nl_config(), are left unaffected. The patch has been merged across multiple stable branches: Kernel Commit 3bcc1624, Kernel Commit 46b1ffb7, Kernel Commit 520cf06b, Kernel Commit 7f4ba56f, Kernel Commit 8b43f407, Kernel Commit b1229b21, Kernel Commit d22609f3, and Kernel Commit fd20220f.

Workarounds

Blacklist the fou module on hosts that do not use Foo-over-UDP: add blacklist fou to /etc/modprobe.d/.
Drop ingress UDP traffic to any FOU listening port that reports protocol = 0 until the kernel is patched.
Enforce user namespace restrictions so untrusted workloads cannot acquire CAP_NET_ADMIN on the host network namespace.

bash

# Verify FOU state and remove misconfigured entries
ip fou show
ip fou del port 5555
modprobe -r fou
echo 'blacklist fou' > /etc/modprobe.d/disable-fou.conf