{"id":"CVE-2026-98493","kind":"vulnerability","aliases":["CVE-2026-98493"],"related":[],"title":"Linux kernel: DHCP option overflow in ipconfig can crash boot","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipconfig: bound DHCP option construction\n\nic_dhcp_init_options() appends the hostname (option 12), vendor-class\n(option 60) and client-ID (option 61) options into the fixed 312-byte\nbootp_pkt.exten[] buffer.  Only the client-ID branch checked the\nremaining space; the hostname and vendor-class writes were unbounded.\n\nA 64-byte hostname together with the maximum 252-byte dhcpclass=\nidentifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available\nbytes even before the terminating END marker, so the vendor-class memcpy\nruns past the end of exten[].  With CONFIG_FORTIFY_SOURCE this is\nreported as a field-spanning write and, when the kernel is booted with\npanic_on_warn=1, aborts boot with a panic.\n\nRoute the optional options through a common helper that makes sure the\noption, its 2-byte header and the END marker all fit and drops an option\nthat would not.  Configurations with short options keep sending exactly\nthe same bytes as before.","summary":"The Linux kernel's ipconfig code writes the hostname and vendor-class DHCP options into a fixed 312-byte buffer without checking bounds. With a long hostname and a long dhcpclass= boot parameter, the write runs past the buffer, which the kernel reports as a fortified write and, with panic_on_warn=1, aborts boot.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","network-boot","self-hosted"],"not_affected_if":["default-config","no-kernel-ip-autoconfig"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:00+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:41+00:00","updated_at":"2026-10-25T05:25:41+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:25:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: DHCP option overflow in ipconfig can crash boot","impact":"low","summary":"The Linux kernel's ipconfig code writes the hostname and vendor-class DHCP options into a fixed 312-byte buffer without checking bounds. With a long hostname and a long dhcpclass= boot parameter, the write runs past the buffer, which the kernel reports as a fortified write and, with panic_on_warn=1, aborts boot.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","network-boot","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"boot aborts with a kernel panic on affected configurations","analyst_note":"Check the kernel fix commit and stable backport versions in the NVD entry; confirm whether a remote DHCP server can supply the overflowing option data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config","no-kernel-ip-autoconfig"],"who_is_affected":"Only machines that boot with IP autoconfiguration through DHCP in the kernel (ip= on the kernel command line, or CONFIG_IP_PNP) and that set a long hostname or a dhcpclass= value; the sources do not say whether an attacker can influence those values remotely. Systems that do not use kernel-level DHCP at boot are not affected by this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000625,"input_tokens":3596,"output_tokens":531,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98493':13A,16A '1':80B,211C '12':107C '18':159C '2':160C,162C,231C '252':154C,163C '312':45B,123C,167C '338':164C '60':112C '61':118C '64':147C,161C 'abort':81B,212C 'append':103C 'avail':168C 'boot':10A,23B,59B,82B,206C,213C 'bootp_pkt.exten':125C 'bound':50B,95C 'branch':132C 'buffer':47B,66B,126C 'byte':46B,124C,148C,155C,169C,232C,256C 'check':49B,133C 'class':39B,110C,142C,180C 'client':115C,130C 'client-id':114C,129C 'code':32B 'common':223C 'config':189C 'configur':247C 'construct':98C 'crash':9A 'cve':11A,14A 'dhcp':3A,40B,96C,100C 'dhcpclass':58B,156C 'drop':241C 'end':174C,185C,236C 'even':170C 'exact':253C 'exten':187C 'field':198C 'field-span':197C 'fit':239C 'fix':44B,122C 'follow':88C 'fortifi':73B,190C 'header':233C 'helper':224C 'host':26B 'hostnam':35B,54B,105C,138C,149C 'ic':99C 'id':116C,131C 'identifi':157C 'infrastructur':17B 'init':101C 'ipconfig':7A,31B,94C 'keep':251C 'kernel':2A,20B,29B,69B,86C,204C 'linux':1A,19B,28B,85C 'linux-kernel':18B 'long':53B,57B 'make':226C 'marker':175C,237C 'maximum':153C 'memcpi':181C 'need':158C 'net':93C 'network':22B 'network-boot':21B 'option':4A,41B,97C,102C,106C,111C,117C,119C,219C,220C,229C,243C,250C 'overflow':5A 'panic':77B,208C,216C 'paramet':60B 'past':64B,183C 'remain':135C 'report':70B,194C 'resolv':92C 'rout':217C 'run':63B,182C 'self':25B 'self-host':24B 'send':252C 'short':249C 'sourc':191C 'space':136C 'span':199C 'sure':227C 'termin':173C 'togeth':150C 'unbound':145C 'vendor':38B,109C,141C,179C 'vendor-class':37B,108C,140C,178C 'vulner':89C 'warn':79B,210C 'without':48B 'would':245C 'write':33B,62B,74B,143C,200C","nicknames":[],"mitigations":[],"who_affected":"Only machines that boot with IP autoconfiguration through DHCP in the kernel (ip= on the kernel command line, or CONFIG_IP_PNP) and that set a long hostname or a dhcpclass= value; the sources do not say whether an attacker can influence those values remotely. Systems that do not use kernel-level DHCP at boot are not affected by this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98493","severity":null,"published_at":"2026-10-18T16:17:00+00:00","modified_at":"2026-10-21T13:21:31+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}