CVE-2026-98095
Description
A flaw was found in the Linux kernel's af_packet network subsystem. When parsing packet headers, user-supplied length values are improperly converted from an unsigned integer to a signed integer. A local user can exploit this vulnerability by submitting an excessively large packet length, causing an unexpected negative error return that triggers an internal kernel assertion and crashes the system, resulting in a Denial of Service (DoS).
Statement
This vulnerability is evaluated as a Low impact flaw because successful exploitation requires local access and the capability to create packet sockets, preventing unauthorized remote attack vectors. In standard Red Hat Enterprise Linux deployments, raw packet socket operations require the CAP_NET_RAW capability, restricting execution to privileged accounts or confined container namespaces. While triggering the invalid header length calculation induces a kernel panic leading to a local denial of service, it does not allow data exposure or code execution.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
