CVE-2026-99112

What it actually does

Out-of-bounds read in cls_flower netlink attribute parsing: nla_next() advances the mask pointer based on key attribute count rather than mask attributes; missing validation on the advanced pointer allows nla_type() and nla_parse_nested_deprecated() to read past the mask payload when residue bytes or non-aligned lengths leave msk_depth != 0, producing KASAN slab-out-of-bounds read in __nla_validate_parse from fl_change().

Why it matters to the business

Systems performing traffic classification with the flower classifier may experience kernel crashes or limited memory disclosure; the issue affects any distribution or appliance using recent Linux kernels with net/sched cls_flower enabled, increasing operational risk for network infrastructure until patched.

How an attack unfolds

An attacker with CAP_NET_ADMIN sends a crafted RTM_NEWTFILTER netlink message containing a flower filter with tunnel-option attributes whose mask carries one valid attribute plus trailing residue bytes; the kernel iterates keys with nla_for_each_attr while the mask cursor skips validation, causing nla_parse_nested_deprecated to dereference attacker-controlled lengths beyond the mask buffer.

How to fix it

Apply the upstream fix that adds nla_ok() validation on the mask pointer returned by nla_next() inside fl_set_enc_opt and sibling helpers; rebuild and deploy kernels containing commit that rejects the filter with -EINVAL when the advanced mask pointer fails validation while msk_depth remains non-zero.

How to confirm the fix worked

Confirm the patch is present by inspecting the cls_flower source for the added nla_ok() guard after nla_next(); test by replaying a malformed mask attribute via tc or netlink and verifying -EINVAL is returned instead of proceeding to nla_parse_nested_deprecated.

Typical attack path

1. Obtain CAP_NET_ADMIN or equivalent on a system exposing netlink route sockets
2. Construct RTM_NEWTFILTER message with cls_flower and tunnel encap options
3. Craft mask nested attributes with valid length plus 1-3 residue bytes or misaligned lengths
4. Send the message via netlink; kernel performs fl_set_enc_opt and fl_set_geneve_opt without exhausting msk_depth check
5. Trigger out-of-bounds read during nla_parse_nested_deprecated inside fl_change

How to detect it

Search kernel logs for KASAN slab-out-of-bounds read originating from __nla_validate_parse called via fl_change; inspect audit logs for unusual RTM_NEWTFILTER messages containing flower classifiers with tunnel encap options; correlate with processes invoking tc or direct netlink route sockets.

What your security team should do

• Prioritize kernel updates on any host or appliance that exposes netlink to untrusted users or containers
• Restrict CAP_NET_ADMIN via seccomp, user namespaces, or container policies where flower classifier is not required
• Monitor for kernel oops or KASAN reports referencing __nla_validate_parse and fl_change
• Audit use of tc flower filters with tunnel options in production configurations