Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98950

flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values. This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() returns early when a BPF flow dissector handles the packet. struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen to U16_MAX before clamping. Found by sashiko while reviewing the commit above.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to < c44c02c930c6583b235a1937c69ff716c4bb4514affected
  • d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to < 3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2aaffected
  • d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to < cc18eb0e9941162c03f03f411ed7f6c339d91fa0affected
  • d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to < 61b43a51a55929ec040bee3ea51af2121b956d05affected
  • d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to < f202578efc738b883cfa04889eb97328914265a7affected

Linux Linux

Default version status: affected

  • 4.20affected
  • 0 to < 4.20unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.2.11 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References