CVE-2026-92693
Description
A flaw was found in FastNetMon. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) or potentially disclose memory contents. By sending a crafted network packet record containing a truncated IPv6 fragment header, an attacker triggers an out-of-bounds memory read because the packet parser fails to verify that the required header bytes are present.
Statement
This vulnerability is rated as an Important severity because an unauthenticated remote attacker can trigger a denial of service by transmitting crafted network packets, leading to an out-of-bounds memory read and service crash without requiring authentication or user interaction. FastNetMon is not shipped or supported in Red Hat Enterprise Linux or any other Red Hat product lines, meaning default installations are unaffected. For standalone deployments on Red Hat platforms, exposure is restricted to systems actively processing sampled packet telemetry from untrusted networks.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce buffer length validation before dereferencing IPv6 fragment extension headers in FastNetMon raw packet parsing: upgrade to the fixed Fastnetmon builds, which verify that the remaining packet buffer is at least the size of an ipv6_extension_header_fragment_t struct before dereferencing and return parser_code_t::memory_violation if truncated, closing all 2 injection vectors (crafted sFlow v5 RAW_PACKET_HEADER records with truncated IPv6 fragment headers, truncated IPv6 fragment packets ingested via raw network capture interfaces). Until patched, this is a concern on FastNetMon sensor instances actively processing raw traffic captures or sFlow telemetry from untrusted networks, so restrict network and UDP ingress access so only trusted sources and exporters can transmit sFlow telemetry or network traffic to FastNetMon sensors. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds memory read defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
