CVE-2026-98952

What it actually does

Out-of-bounds read in Linux kernel PFCP handling: pfcp_session_recv reads the 8-byte SEID after only ensuring the UDP and 4-byte PFCP headers are linear, so short packets or fragmented session headers cause reads past the skb data into whatever follows, with the result stored in tunnel metadata later used by flower.

Why it matters to the business

In network environments processing PFCP traffic (mobile cores, 5G/4G gateways), this can cause kernel memory disclosure or instability; the flaw is recent with low exploit maturity but requires prompt kernel updates to avoid operational risk in high-availability network infrastructure.

How an attack unfolds

An attacker crafts a short UDP PFCP packet with the S flag set and insufficient length so that the SEID lies beyond the linear area or packet end; when processed, pfcp_session_recv reads past valid data, leaking kernel memory contents into tunnel metadata that can be observed or used for further classification abuse.

How to fix it

Apply the upstream kernel patch that replaces the existing pskb_may_pull check with one covering the full SEID (using offsetofend), drops undersized packets, and reloads the header pointer; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Confirm the source change that adds the extended pskb_may_pull before the SEID read and uses offsetofend instead of sizeof(struct pfcphdr_session); test by sending short S-flag PFCP packets and verifying they are dropped without oob access.

Typical attack path

1. Craft UDP packet carrying PFCP header with S flag and truncated length
2. Send packet to a Linux host running vulnerable PFCP encapsulation code
3. Trigger pfcp_encap_recv then pfcp_session_recv to perform out-of-bounds SEID read
4. Observe or abuse the resulting tunnel metadata written by flower classifier

How to detect it

Inspect kernel logs for skb overread warnings or PFCP-related panics; correlate with incoming UDP traffic on PFCP ports (typically 8805) that have the S flag but short total length; review flower classifier metadata for unexpected values originating from packet processing.

What your security team should do

• Prioritize kernel upgrade on all systems that compile or run the PFCP module
• Restrict exposure of PFCP ports to trusted peers only until patched
• Monitor kernel update channels for the official backport
• Review network policies to drop malformed PFCP early at the edge