CVE-2026-98393

A flaw of low impact was found in the Linux kernel IPv4 networking stack. It affects the kernel and kernel-rt packages across Red Hat Enterprise Linux 7, 8, 9, and 10 update streams, as well as the kernel components shipped in Red Hat OpenShift Container Platform (RHEL CoreOS) and Red Hat In-Vehicle OS. A local user can trigger an integer overflow in the UDP transmit path by setting the IP_MTU_DISCOVER socket option to IP_PMTUDISC_PROBE and sending a large UDP payload over a network device configured with an unusually large MTU (greater than IP_MAX_MTU + 20). The computed UDP length can then reach 65536, overflowing the 16-bit UDP length field and triggering a kernel WARN in udp_set_len_short, potentially causing a local denial of service; systems configured with panic_on_warn may panic as a result of the warning. Confidentiality and integrity are not affected, and no privilege escalation primitive is supported by the affected code path. Red Hat rates this flaw as low severity because exploitation requires local access combined with an uncommon network device configuration, and the demonstrated impact is a kernel warning and failure of the oversized packet to be delivered. Because of the low severity and the unusual configuration required to trigger the issue, the fix is currently deferred for the affected Red Hat products; the residual risk is a local denial of service limited to systems that use oversized device MTUs together with IP_PMTUDISC_PROBE. IPv4 with IP_PMTUDISC_DO is not affected because the path MTU is always clamped at IP_MAX_MTU in that mode. Red Hat Enterprise Linux 6 is out of support and is not scheduled to receive a fix.