{"id":"CVE-2026-99112","kind":"vulnerability","aliases":["CVE-2026-99112"],"related":[],"title":"Linux kernel: flower tunnel-option mask parsing reads past its buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_flower: validate mask pointer after nla_next()\n\nfl_set_enc_opt() iterates the key's nested tunnel-option attributes\nwith nla_for_each_attr() while advancing a single mask pointer via\nnla_next() at the bottom of each loop, so the mask cursor is driven\nby the number of key attributes rather than by the mask's own\nattributes.  The nla_ok() added by commit c96adff956191 (\"cls_flower:\ncall nla_ok() before nla_next()\") only validates the mask pointer\nthat was just consumed; the pointer produced by nla_next() is used by\nthe next iteration (fl_set_geneve_opt() and siblings) without any\nvalidation.\n\nThe mask's nested attributes are validated with NL_VALIDATE_LIBERAL,\nwhich merely warns on trailing bytes that do not form a complete\nattribute.  A mask carrying one valid attribute plus 1-3 residue\nbytes (or a non-aligned attribute length making msk_depth negative)\ntherefore reaches the next iteration with msk_depth != 0, so neither\nthe !msk_depth check in fl_set_enc_opt() nor the !depth check in the\nper-type helpers fires.  nla_type() then reads past the mask payload\nand nla_parse_nested_deprecated() iterates with an nla_len taken\nfrom those bytes, reading well beyond the mask attribute (KASAN:\nslab-out-of-bounds read in __nla_validate_parse from fl_change()).\n\nValidate the advanced mask pointer as well: when the mask is not\nlegitimately exhausted (msk_depth != 0) and the new pointer fails\nnla_ok(), reject the filter with -EINVAL.  An exactly exhausted mask\nstill skips the check, preserving exact-match behaviour for the\nremaining key attributes.","summary":"A malformed tc flower filter with tunnel-option mask data that is not a complete netlink attribute makes the kernel read beyond the mask payload while parsing it. The sources describe this as an out-of-bounds read, and the fix rejects such filters with -EINVAL.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cls-flower","linux-kernel","net-sched","runtime"],"not_affected_if":["kernel-without-cls-flower"],"how_to_check":"- Run `uname -r` and compare with the fixed kernel version in the upstream commit, which the sources do not name.\n- unknown","fix":"- Install a Linux kernel build that includes the fix for CVE-2026-99112, once your distribution publishes it.\n- unknown","status":"open","published_at":"2026-10-28T11:17:30+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:43+00:00","updated_at":"2026-10-28T11:37:43+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:37:43Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that includes the fix for CVE-2026-99112, once your distribution publishes it.\n- unknown","reach":"local","title":"Linux kernel: flower tunnel-option mask parsing reads past its buffer","impact":"medium","summary":"A malformed tc flower filter with tunnel-option mask data that is not a complete netlink attribute makes the kernel read beyond the mask payload while parsing it. The sources describe this as an out-of-bounds read, and the fix rejects such filters with -EINVAL.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","net-sched","cls-flower"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel reads out of bounds; possible crash or memory disclosure","analyst_note":"Confirm the fixed kernel versions and whether unprivileged users can reach cls_flower via user namespaces, using the NVD entry linked in the sources.","how_to_check":"- Run `uname -r` and compare with the fixed kernel version in the upstream commit, which the sources do not name.\n- unknown","needs_analyst":true,"not_affected_if":["kernel-without-cls-flower"],"who_is_affected":"Systems that load the cls_flower traffic classifier and accept tc filter changes, which in practice means hosts where users or containers with CAP_NET_ADMIN can configure tc. The sources do not say whether unprivileged users can reach the flaw. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00066,"input_tokens":3840,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-3':226C '-99112':15A,18A '0':248C,329C '1':225C 'add':152C 'advanc':115C,315C 'align':233C 'attr':113C 'attribut':46B,108C,140C,148C,198C,217C,223C,234C,298C,359C 'behaviour':354C 'beyond':51B,295C 'bottom':125C 'bound':67B,304C 'buffer':12A 'byte':210C,228C,292C 'c96adff956191':155C 'call':158C 'carri':220C 'chang':312C 'check':254C,263C,349C 'cls':20B,88C,156C 'cls-flower':19B 'commit':154C 'complet':44B,216C 'consum':172C 'cursor':132C 'cve':13A,16A 'data':39B 'deprec':283C 'depth':238C,247C,253C,262C,328C 'describ':60B 'driven':134C 'einval':76B,341C 'enc':98C,258C 'exact':343C,352C 'exact-match':351C 'exhaust':326C,344C 'fail':334C 'filter':33B,74B,339C 'fire':270C 'fix':71B 'fl':96C,185C,256C,311C 'flower':3A,21B,32B,89C,157C 'follow':82C 'form':214C 'genev':187C 'helper':269C 'iter':100C,184C,244C,284C 'kasan':299C 'kernel':2A,24B,49B,80C 'key':102C,139C,358C 'legitim':325C 'len':288C 'length':235C 'liber':204C 'linux':1A,23B,79C 'linux-kernel':22B 'loop':128C 'make':47B,236C 'malform':30B 'mask':7A,38B,53B,91C,118C,131C,145C,167C,195C,219C,277C,297C,316C,322C,345C 'match':353C 'mere':206C 'msk':237C,246C,252C,327C 'negat':239C 'neither':250C 'nest':104C,197C,282C 'net':26B 'net-sch':25B 'net/sched':87C 'netlink':45B 'new':332C 'next':95C,122C,163C,178C,183C,243C 'nl':202C 'nla':94C,110C,121C,150C,159C,162C,177C,271C,280C,287C,307C,335C 'non':232C 'non-align':231C 'number':137C 'ok':151C,160C,336C 'one':221C 'opt':99C,188C,259C 'option':6A,37B,107C 'out-of-bound':64B 'pars':8A,56B,281C,309C 'past':10A,275C 'payload':54B,278C 'per':267C 'per-typ':266C 'plus':224C 'pointer':92C,119C,168C,174C,317C,333C 'preserv':350C 'produc':175C 'rather':141C 'reach':241C 'read':9A,50B,68B,274C,293C,305C 'reject':72B,337C 'remain':357C 'residu':227C 'resolv':86C 'runtim':28B 'sched':27B 'set':97C,186C,257C 'sibl':190C 'singl':117C 'skip':347C 'slab':301C 'slab-out-of-bound':300C 'sourc':59B 'still':346C 'taken':289C 'tc':31B 'therefor':240C 'trail':209C 'tunnel':5A,36B,106C 'tunnel-opt':4A,35B,105C 'type':268C,272C 'use':180C 'valid':90C,165C,193C,200C,203C,222C,308C,313C 'via':120C 'vulner':83C 'warn':207C 'well':294C,319C 'without':191C","nicknames":[],"mitigations":[],"who_affected":"Systems that load the cls_flower traffic classifier and accept tc filter changes, which in practice means hosts where users or containers with CAP_NET_ADMIN can configure tc. The sources do not say whether unprivileged users can reach the flaw. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99112","severity":null,"published_at":"2026-10-28T11:17:30+00:00","modified_at":"2026-10-28T11:17:30+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}