Live › vulnerability › CVE-2026-98493
Go to dashboardThe Linux kernel's ipconfig code writes the hostname and vendor-class DHCP options into a fixed 312-byte buffer without checking bounds. With a long hostname and a long dhcpclass= boot parameter, the write runs past the buffer, which the kernel reports as a fortified write and, with panic_on_warn=1, aborts boot.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only machines that boot with IP autoconfiguration through DHCP in the kernel (ip= on the kernel command line, or CONFIG_IP_PNP) and that set a long hostname or a dhcpclass= value; the sources do not say whether an attacker can influence those values remotely. Systems that do not use kernel-level DHCP at boot are not affected by this path.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: ipconfig: bound DHCP option construction
ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded.
A 64-byte hostname together with the maximum 252-byte dhcpclass= identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available bytes even before the terminating END marker, so the vendor-class memcpy runs past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is reported as a field-spanning write and, when the kernel is booted with panic_on_warn=1, aborts boot with a panic.
Route the optional options through a common helper that makes sure the option, its 2-byte header and the END marker all fit and drops an option that would not. Configurations with short options keep sending exactly the same bytes as before.
This page as .md · .json · in your agent: get_signal("CVE-2026-98493")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.