CVE-2026-92695
Description
A flaw was found in FastNetMon. When packet capture is enabled, the packet parser fails to properly validate the length of captured network frames before reading header data. A remote attacker can exploit this flaw by sending specially crafted packets with manipulated header lengths, triggering an out-of-bounds read. This issue can cause process termination, resulting in a Denial of Service (DoS), or potentially lead to unauthorized memory reading.
Statement
This vulnerability is rated as having an Important impact because an unauthenticated remote attacker can crash the monitoring process with malformed network traffic, requiring no privileges or user interaction. FastNetMon is not included or supported in Red Hat Enterprise Linux or other Red Hat products, so default platform installations are not exposed. In environments where this component is deployed independently, exploitation results in a denial of service that interrupts network anomaly monitoring and automated attack mitigation.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate captured frame lengths against packethdr->caplen before parsing IP and transport headers in FastNetMon's pcap plugin parser: upgrade to the fixed Fastnetmon builds, which replace legacy packet parsing with a bounds-checked parser that enforces link-layer and frame length validation against captured packet length and safely skips invalid frames, closing all 2 injection vectors (truncated network frames, manipulated IPv4 header lengths). Until patched, this is a concern on Linux hosts running FastNetMon with packet capture enabled via the pcap plugin, so Disable packet capture by setting pcap = off or restrict untrusted network traffic from reaching interfaces monitored by FastNetMon. As a compensating measure, Run SELinux in enforcing mode to confine the FastNetMon process and restrict broader system access, Deploy an EDR agent to detect abnormal process termination and crash behavior triggered by out-of-bounds read exploits, and Configure Falco or eBPF runtime security to detect abnormal termination signals and crash events in the FastNetMon daemon. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing captured frame length validation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1001 EDR Agent (Endpoint Detection & Response) (medium)
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
