{"id":"CVE-2026-98541","kind":"vulnerability","aliases":["CVE-2026-98541"],"related":[],"title":"Linux kernel: FOU direct encapsulation ports leak memory on packet receipt","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT\n\nCommit 7a9bc9e3f423 (\"fou: Don't allow 0 for FOU_ATTR_IPPROTO.\") added\nNLA_POLICY_MIN(NLA_U8, 1) to fou_nl_policy[FOU_ATTR_IPPROTO], which\nrejects an explicitly supplied FOU_ATTR_IPPROTO == 0 attribute with\n-ERANGE.\n\nHowever, FOU_ATTR_IPPROTO is an optional netlink attribute. When a user\nsends FOU_CMD_ADD with FOU_ATTR_TYPE set to FOU_ENCAP_DIRECT and omits\nFOU_ATTR_IPPROTO entirely, nla_policy validation succeeds and\nparse_nl_config() leaves cfg->protocol as 0 (from memset(cfg, 0,\nsizeof(*cfg))). fou_create() then creates a FOU_ENCAP_DIRECT socket with\nfou->protocol == 0.\n\nIn fou_udp_recv(), returning -fou->protocol to udp_queue_rcv_one_skb()\ntriggers IP protocol resubmission when fou->protocol > 0, whereas\nreturning 0 tells the UDP tunnel layer that the skb was consumed without\nfreeing it. When fou->protocol == 0, every packet received on the socket\nreturns 0 from fou_udp_recv() and leaks the sk_buff.\n\nReject FOU_ENCAP_DIRECT when !cfg->protocol in fou_create() so that\ncreating a direct encapsulation port without FOU_ATTR_IPPROTO fails with\n-EINVAL while leaving FOU_CMD_DEL and FOU_CMD_GET (which share\nparse_nl_config()) unaffected.\n\nTested in QEMU against Linux 7.3.0-rc3 by sending a FOU_CMD_ADD Generic\nNetlink request with FOU_ATTR_PORT = 5555 and FOU_ATTR_TYPE =\nFOU_ENCAP_DIRECT while omitting FOU_ATTR_IPPROTO. On the unfixed kernel,\nFOU_CMD_ADD succeeds (err = 0), FOU_CMD_GET reports fou->type = 1 and\nfou->protocol = 0, and sending 4000 UDP packets to 127.0.0.1:5555 leaks\nall 4000 sk_buffs (SUnreclaim in /proc/meminfo grows from 41456 kB to\n59008 kB, +17552 kB); with this patch applied, FOU_CMD_ADD is rejected\nwith -EINVAL (-22).","summary":"Creating a FOU direct encapsulation port without an IP protocol number succeeds, leaving the protocol at 0. Every packet received on that port then returns without freeing its sk_buff, so an attacker sending UDP packets can exhaust kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fou","infrastructure","linux-kernel","network-tunnels","self-hosted"],"not_affected_if":["fou-module-not-loaded","no-fou-direct-ports"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in the upstream commit, which the sources do not list.\n- Run `lsmod | grep fou` to see whether the FOU module is loaded; if it is not, the kernel is not exposed.\n- Check for FOU_ENCAP_DIRECT ports with `ip fou show` (unknown whether this shows the type field on all iproute2 versions).","fix":"- Update the Linux kernel to a release that includes the fix rejecting FOU_ENCAP_DIRECT when FOU_ATTR_IPPROTO is omitted (fixed version numbers: unknown).\n- Until patched, unload the FOU module with `modprobe -r fou` if no FOU ports are in use.","status":"open","published_at":"2026-10-18T16:17:05+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:47+00:00","updated_at":"2026-10-25T05:23:47+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T05:23:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the fix rejecting FOU_ENCAP_DIRECT when FOU_ATTR_IPPROTO is omitted (fixed version numbers: unknown).\n- Until patched, unload the FOU module with `modprobe -r fou` if no FOU ports are in use.","reach":"network","title":"Linux kernel: FOU direct encapsulation ports leak memory on packet receipt","impact":"medium","summary":"Creating a FOU direct encapsulation port without an IP protocol number succeeds, leaving the protocol at 0. Every packet received on that port then returns without freeing its sk_buff, so an attacker sending UDP packets can exhaust kernel memory.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","fou","self-hosted","network-tunnels"],"confidence":0.7,"needs_auth":"yes","worst_case":"Remote UDP packets exhaust kernel memory, causing denial of service.","analyst_note":"Find the fixed kernel versions and stable backports for commit 7a9bc9e3f423 and this fix, starting from the NVD entry CVE-2026-98541.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in the upstream commit, which the sources do not list.\n- Run `lsmod | grep fou` to see whether the FOU module is loaded; if it is not, the kernel is not exposed.\n- Check for FOU_ENCAP_DIRECT ports with `ip fou show` (unknown whether this shows the type field on all iproute2 versions).","needs_analyst":true,"not_affected_if":["fou-module-not-loaded","no-fou-direct-ports"],"who_is_affected":"Systems running a Linux kernel with the FOU (Foo-over-UDP) module loaded, where a privileged user has created a FOU_ENCAP_DIRECT port without an IP protocol. Hosts without FOU in use can skip it. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001248,"input_tokens":4177,"output_tokens":1660,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+17552':363C '-2026':13A,16A '-22':376C '-98541':14A,17A '/proc/meminfo':355C '0':45B,95C,122C,169C,173C,188C,209C,212C,229C,237C,328C,339C '1':106C,335C '127.0.0.1':346C '4000':342C,350C '41456':358C '5555':306C,347C '59008':361C '7.3.0':291C '7a9bc9e3f423':90C 'add':100C,141C,298C,325C,371C 'allow':94C 'appli':368C 'attack':61B 'attr':83C,98C,112C,120C,128C,144C,154C,266C,304C,309C,317C 'attribut':123C,134C 'buff':58B,246C,352C 'cfg':166C,172C,175C,252C 'cmd':140C,274C,278C,297C,324C,330C,370C 'commit':89C 'config':164C,284C 'consum':222C 'creat':29B,177C,179C,256C,259C 'cve':12A,15A 'del':275C 'direct':4A,32B,88C,150C,183C,250C,261C,313C 'einval':270C,375C 'encap':87C,149C,182C,249C,312C 'encapsul':5A,33B,262C 'entir':156C 'erang':125C 'err':327C 'everi':46B,230C 'exhaust':66B 'explicit':117C 'fail':268C 'follow':74C 'fou':3A,18B,31B,79C,82C,86C,91C,97C,108C,111C,119C,127C,139C,143C,148C,153C,176C,181C,186C,190C,194C,207C,227C,239C,248C,255C,265C,273C,277C,296C,303C,308C,311C,316C,323C,329C,333C,337C,369C 'free':55B,224C 'generic':299C 'get':279C,331C 'grow':356C 'host':28B 'howev':126C 'infrastructur':19B 'ip':37B,203C 'ipproto':84C,99C,113C,121C,129C,155C,267C,318C 'kb':359C,362C,364C 'kernel':2A,22B,67B,72C,322C 'layer':217C 'leak':7A,243C,348C 'leav':41B,165C,272C 'linux':1A,21B,71C,290C 'linux-kernel':20B 'memori':8A,68B 'memset':171C 'min':103C 'netlink':133C,300C 'network':24B 'network-tunnel':23B 'nl':109C,163C,283C 'nla':101C,104C,157C 'number':39B 'omit':81C,152C,315C 'one':200C 'option':132C 'packet':10A,47B,64B,231C,344C 'pars':162C,282C 'patch':367C 'polici':102C,110C,158C 'port':6A,34B,51B,263C,305C 'protocol':38B,43B,167C,187C,195C,204C,208C,228C,253C,338C 'qemu':288C 'queue':198C 'rc3':292C 'rcv':199C 'receipt':11A 'receiv':48B,232C 'recv':192C,241C 'reject':80C,115C,247C,373C 'report':332C 'request':301C 'resolv':78C 'resubmiss':205C 'return':53B,193C,211C,236C 'self':27B 'self-host':26B 'send':62B,138C,294C,341C 'set':146C 'share':281C 'sizeof':174C 'sk':57B,245C,351C 'skb':201C,220C 'socket':184C,235C 'succeed':40B,160C,326C 'sunreclaim':353C 'suppli':118C 'tell':213C 'test':286C 'trigger':202C 'tunnel':25B,216C 'type':145C,310C,334C 'u8':105C 'udp':63B,191C,197C,215C,240C,343C 'unaffect':285C 'unfix':321C 'user':137C 'valid':159C 'vulner':75C 'wherea':210C 'without':35B,54B,223C,264C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the FOU (Foo-over-UDP) module loaded, where a privileged user has created a FOU_ENCAP_DIRECT port without an IP protocol. Hosts without FOU in use can skip it. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98541","severity":null,"published_at":"2026-10-18T16:17:05+00:00","modified_at":"2026-10-19T10:19:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}