CVE-2026-98952 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches as necessary. Additionally, operators of Linux-based systems, platform administrators, vulnerability management teams, and security teams should be aware of the potential impacts and take appropriate measures to mitigate the vulnerability.

Why it matters

The vulnerability in the Linux kernel's pfcp implementation can allow an attacker to cause a denial of service or potentially execute arbitrary code, compromising system integrity and confidentiality.

• Denial of service due to buffer overflow
• Potential execution of arbitrary code
• Elevation of privileges through sensitive data access
• Compromise of system integrity

Technical summary

The vulnerability exists in the pfcp_encap_recv() function, which does not properly validate the length of the SEID (Session Endpoint Identifier) field in certain situations. This can lead to a buffer overflow and potentially allow an attacker to read or write sensitive data. The issue arises when the S flag is set, and pfcp_session_recv() reads the 8-byte SEID that follows, which is not covered by the pskb_may_pull() check. A short PFCP packet with the S flag set, or one whose session header lies in a fragment, therefore makes pfcp_session_recv() read beyond the end of the packet data, and whatever it finds there is stored in the tunnel metadata that flower later classifies on. To address this, it is necessary

Defensive priority

High

Recommended defensive actions

• Review and apply the available patches to ensure the pfcp implementation is properly validating the SEID field length.
• Monitor network traffic for potential exploitation attempts.
• Implement additional security controls to prevent or detect potential attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was introduced in the Linux kernel and affects versions prior to the fixed versions. The fixed versions are not explicitly stated in the source corpus, but it is mentioned that the vulnerability was resolved in commits 3192a5e398c64d48aad64a09e29643e327369bc4, b18a6496495495e2dc27e525aa3315a0c59b9513, 2fb6d05f706d79bbdc88835be2f4f45ab56dd819, and 23609bce9e1de525d1d0e73fc68c6e7971d0b49e.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.