Cloudanix VulnDB

CVE-2026-98372

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux network code that handles special IP-TFS packets can let a remote sender crash the system or read a small amount of kernel memory.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Unbounded loop in iptfs_skb_reset_frag_walk() advances fragi past nr_frags and reads past the end of the on-stack frags[MAX_SKB_FRAGS + 1] array when iptfs_skb_can_add_frags() receives an offset at or beyond the total fragment length.

Why it matters to the business

Systems processing IP-TFS traffic may experience kernel crashes or limited memory disclosure, causing denial of service for VPN or IPsec workloads and requiring emergency patching.

How an attack unfolds

An attacker crafts an IP-TFS (AGGFRAG) payload with an offset past the accumulated fragment total and delivers it to an IPTFS security association; the receive path calls iptfs_reassem_cont -> iptfs_skb_can_add_frags -> iptfs_skb_reset_frag_walk without an early bounds check, triggering the out-of-bounds stack read.

How to fix it

Apply the upstream fix that adds the same early guard present in iptfs_skb_add_frags() to iptfs_skb_can_add_frags() so the walk is never entered with an out-of-range offset; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the kernel source contains the added bounds check before iptfs_skb_reset_frag_walk(); recompile, boot the new kernel, and verify that a reproducer packet no longer triggers KASAN stack-out-of-bounds reports.

Typical attack path

  1. Establish or target an IPsec SA configured for IP-TFS mode
  2. Send a single crafted AGGFRAG packet containing an out-of-range offset
  3. Trigger iptfs_input -> iptfs_input_ordered -> iptfs_reassem_cont
  4. Execute the unguarded walk that dereferences past the frags array

How to detect it

Inspect kernel logs for KASAN stack-out-of-bounds reports mentioning iptfs_skb_reset_frag_walk or iptfs_skb_can_add_frags; correlate with xfrm_input and ip_rcv entries showing receipt of ESP or IP-TFS traffic from untrusted peers.

What your security team should do

  • Prioritize patching kernel images that enable CONFIG_XFRM_IPTFS or IP-TFS SAs
  • Monitor upstream stable branches for the commit that adds the guard to iptfs_skb_can_add_frags()
  • Temporarily disable IP-TFS mode on any non-essential IPsec SAs until patched kernels are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() iptfs_skb_reset_frag_walk() advances to the fragment containing @offset with an unbounded loop: while (offset >= walk->past + walk->frags[walk->fragi].len) walk->past += walk->frags[walk->fragi++].len; walk->fragi is advanced and walk->frags[walk->fragi] is dereferenced without ever checking fragi against walk->nr_frags. When the requested offset is at or beyond the total length spanned by the walk's fragments, fragi runs past nr_frags and off the end of the fixed-size on-stack frags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory. The two callers behave differently: iptfs_skb_add_frags() already guards against this with if (!walk->nr_frags || offset >= walk->total + walk->initial_offset) return len; but iptfs_skb_can_add_frags() has no such guard and calls iptfs_skb_reset_frag_walk() unconditionally, so it performs the out-of-range walk. Its own "fragi < walk->nr_frags" bound check runs only afterwards, too late to prevent the read. This is reachable from the receive path: a crafted IP-TFS (AGGFRAG) payload delivered to an IPTFS SA drives iptfs_reassem_cont() -> iptfs_skb_can_add_frags() with an offset past the fragment total, e.g.: BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250 Read of size 4 at addr ffff888008ad7210 by task repro/345 iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392 iptfs_skb_can_add_frags+0x155/0x310 net/xfrm/xfrm_iptfs.c:420 iptfs_reassem_cont+0xcf8/0x1140 net/xfrm/xfrm_iptfs.c:902 iptfs_input_ordered+0x552/0x670 net/xfrm/xfrm_iptfs.c:1280 iptfs_input+0x3d6/0xde0 net/xfrm/xfrm_iptfs.c:1741 xfrm_input+0x282f/0x6140 net/xfrm/xfrm_input.c:700 xfrm4_esp_rcv+0x93/0x120 net/ipv4/xfrm4_protocol.c:104 ip_rcv+0x278/0x2d0 net/ipv4/ip_input.c:612 Give iptfs_skb_can_add_frags() the same up-front guard that iptfs_skb_add_frags() already has, so the walk is never entered with an out-of-range offset. When it triggers, the caller falls back to the existing linearize-and-copy path, which is safe.

Affected packages

Ecosystem Package Introduced Fixed