CVE-2026-98377
Description
A flaw was found in the Linux kernel's VLAN (Virtual Local Area Network) networking component. A local user can exploit this vulnerability by transmitting crafted, undersized network frames that trigger multiple VLAN tag insertions without verifying the presence of a Media Access Control (MAC) header. As a result, uninitialized kernel memory is appended to the packet and sent over the network, leading to information disclosure.
Statement
A kernel information disclosure occurs because __vlan_insert_inner_tag() can rewrite an ETH_HLEN MAC header without first ensuring that mac_len bytes are present in the skb. With an IFF_TUN device whose hard_header_len is zero, a local process can submit a one byte AF_PACKET SOCK_RAW frame and apply additional VLAN push operations. The helper then moves bytes located beyond skb tail into the transmitted frame, exposing uninitialized slab data and potentially kernel address material. For the CVSS the PR:L value is used because triggering requires a local process with access to a raw packet socket and normally CAP_NET_RAW, while TUN or traffic control configuration may also require delegated CAP_NET_ADMIN. The issue is not remotely triggered by received network traffic, although disclosed bytes can be transmitted onto the adjacent layer two network. Impact is a kernel confidentiality breach and possible KASLR weakening. No out of bounds write, kernel crash, or direct privilege escalation primitive is demonstrated.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
