Cloudanix VulnDB

CVE-2026-98495

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel could let an attacker read extra memory when network interface names are handled, potentially leaking sensitive information or causing crashes.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read occurs when the ARP ioctl copies a user-provided arpreq struct into a stack buffer whose arp_dev field lacks a NUL terminator, allowing strcmp inside dev_get_by_name_rcu or __dev_get_by_name to read past the object when a matching interface name exists.

Why it matters to the business

May expose kernel memory contents or trigger crashes on Linux systems, risking data leakage and reduced availability for network-dependent workloads.

How an attack unfolds

An attacker supplies a crafted arpreq structure via the ARP ioctl with a device name spanning IFNAMSIZ bytes and no terminator; the kernel passes this directly to name-lookup functions whose strcmp reads beyond the stack allocation when alternative interface names are present.

How to fix it

Apply the upstream kernel patch that explicitly terminates the arp_dev field before any name lookup; rebuild and deploy updated kernels to affected systems.

How to confirm the fix worked

Confirm the fix by inspecting the relevant net/arp.c code for explicit NUL termination of arp_dev prior to dev_get_by_name calls, or verify the running kernel version includes the commit titled 'net: arp: terminate device name before lookup'.

Typical attack path

  1. Allocate a stack-sized arpreq with a non-NUL-terminated arp_dev field of IFNAMSIZ bytes
  2. Invoke the SIOCGARP/SIOCSARP ioctl from user space
  3. Trigger strcmp-based lookup in dev_get_by_name_rcu or __dev_get_by_name
  4. Read kernel memory past the intended buffer boundary

How to detect it

Review kernel logs and audit trails for oops or warning messages referencing ARP device name lookup or strcmp overreads; correlate with processes issuing unusual ARP ioctls.

What your security team should do

  • Prioritize kernel updates on all Linux hosts within the next maintenance window
  • Harden ioctl filtering where possible to restrict ARP operations to privileged contexts
  • Include kernel oops and stack traces in centralized logging for rapid anomaly review

The record

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp_dev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where strcmp() can read past the end of the stack object when a matching alternative interface name exists. Terminate the field before the lookup to prevent the out-of-bounds read.

Affected packages

Ecosystem Package Introduced Fixed