{"id":"CVE-2026-98393","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: Fix UDP length overflow with PMTU discover and big MTU\n\nThis commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a\npossible overflow of UDP length that …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: Fix UDP length overflow with PMTU discover and big MTU\n\nThis commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a\npossible overflow of UDP length that …","severity":"medium","published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T14:17:50.193","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98393","references":[{"url":"https://git.kernel.org/stable/c/81f540827d243b8dad76c1f44e70ea31719f393c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83fedc4741210f75be8ca5b487985a242bf6f18d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b83641e0ab8b20eefcc4cdc5a059f897375291a2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98393.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98393"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98393"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98393"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98393.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ingestedAt":"2026-10-14T15:36:13.977Z","vendor":"Linux","product":"Linux","affected":["Linux >= daba287b299ec7a2c61ae3a714920e90e8396ad5 < 83fedc4741210f75be8ca5b487985a242bf6f18d","Linux >= daba287b299ec7a2c61ae3a714920e90e8396ad5 < 81f540827d243b8dad76c1f44e70ea31719f393c","Linux >= daba287b299ec7a2c61ae3a714920e90e8396ad5 < b83641e0ab8b20eefcc4cdc5a059f897375291a2","Linux 3.13"],"cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-190"],"epss":0.00203,"epssPercentile":0.10201,"slug":"CVE-2026-98393","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: Fix UDP length overflow with PMTU discover and big MTU\n\nThis commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a\npossible overflow of UDP length that triggers a WARN in\nudp_set_len_short when setsockopt IP_MTU_DISCOVER is set to\nIP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an\nunusually large MTU.\n\nSteps to reproduce:\n\n1. Set device MTU bigger than IP_MAX_MTU + 20. cork->base.fragsize will\n   be set to that MTU in ip_setup_cork.\n2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be\n   set to device MTU (cork->fragsize) in __ip_append_data, rather than\n   to IP_MAX_MTU.\n3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of\n   IPv4 header). Device MTU allows it (it's only one byte bigger than\n   IP_MAX_MTU + IPv4 header, and the device MTU is bigger than that).\n4. The UDP length in the built packet is 65536, which overflows the\n   16-bit length field and triggers the WARN in udp_set_len_short.\n\nNote: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward\nalways clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward.\n\nThe Fixes tag points at the first commit where I could reproduce the\noverflow with IPv4 and IP_PMTUDISC_PROBE.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98393.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224115,"id":"CVE-2026-98393","ts":1792324926455,"field":"cvss","old":null,"new":"5.5"},{"seq":224114,"id":"CVE-2026-98393","ts":1792324926455,"field":"severity","old":"none","new":"medium"}]}