CVE-2026-98095

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the af packet module where the tpacket parse header() function incorrectly casts the user-provided tpacket hdr.tp len variable, which is a u32 (unsigned 32-bit integer), to an int (signed integer). If a user provides a length value larger than INT MAX, the check if (unlikely(tp len > size max)) can be bypassed, allowing a negative value to be returned to the caller, such as sock sendmsg nosec(). This can trigger a kernel BUG in the sock sendmsg nosec() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.