PT-2026-114372 · Linux · Linux
CVE-2026-98393
·
Published
2026-10-14
·
Updated
2026-10-14
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
This commit bounds cork->base.fragsize to IP MAX MTU to avoid a
possible overflow of UDP length that triggers a WARN in
udp set len short when setsockopt IP MTU DISCOVER is set to
IP PMTUDISC PROBE, and a large packet is sent over a netdev with an
unusually large MTU.
Steps to reproduce:
- Set device MTU bigger than IP MAX MTU + 20. cork->base.fragsize will be set to that MTU in ip setup cork.
- Set IP MTU DISCOVER to IP PMTUDISC PROBE. It lets maxnonfragsize be set to device MTU (cork->fragsize) in ip append data, rather than to IP MAX MTU.
- Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of IPv4 header). Device MTU allows it (it's only one byte bigger than IP MAX MTU + IPv4 header, and the device MTU is bigger than that).
- The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp set len short.
Note: IP PMTUDISC DO with IPv4 is safe, because ip dst mtu maybe forward
always clamps at IP MAX MTU, unlike ip6 dst mtu maybe forward.
The Fixes tag points at the first commit where I could reproduce the
overflow with IPv4 and IP PMTUDISC PROBE.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux