-

CVE-2026-98495

net: arp: terminate device name before lookup

In the Linux kernel, the following vulnerability has been resolved:

net: arp: terminate device name before lookup

The ARP ioctl copies a user-provided struct arpreq into a stack object. Its
arp_dev field may contain IFNAMSIZ bytes without a NUL terminator.

Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where
strcmp() can read past the end of the stack object when a matching
alternative interface name exists.

Terminate the field before the lookup to prevent the out-of-bounds read.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc
Version < ae6d704dbf9542b0a0830ec91a2db4f30307e7d8
Status affected
Version 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc
Version < 47107491b48ceef0a2faa7a010cfa961f211ef9f
Status affected
Version 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc
Version < 7389757d88f54237951d7497d9c4dae7cc6d64be
Status affected
Version 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc
Version < 1b08c5c3ac27c9ff91c5309f4a32b4e91ce2263b
Status affected
Version 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc
Version < 414bbad9928598904313299ac9e037a73f520be1
Status affected
Version 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc
Version < ba664d83638640cf454b65167339cbf20dfd6f10
Status affected
Version 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc
Version < 35e716a70733472ede300540082d64c33bf3b4c9
Status affected
Version 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc
Version < d8b6529e80bcb4fb8177121404cbb3377acaebd2
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.5
Status affected
Version 0
Version < 5.5
Status unaffected
Version <= 5.10.*
Version 5.10.271
Status unaffected
Version <= 5.15.*
Version 5.15.222
Status unaffected
Version <= 6.1.*
Version 6.1.189
Status unaffected
Version <= 6.6.*
Version 6.6.158
Status unaffected
Version <= 6.12.*
Version 6.12.112
Status unaffected
Version <= 6.18.*
Version 6.18.55
Status unaffected
Version <= 7.2.*
Version 7.2.9
Status unaffected
Version <= *
Version 7.3
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.106
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/ae6d704dbf9542b0a0830ec91a2db4f30307e7d8
https://git.kernel.org/stable/c/47107491b48ceef0a2faa7a010cfa961f211ef9f
https://git.kernel.org/stable/c/7389757d88f54237951d7497d9c4dae7cc6d64be
https://git.kernel.org/stable/c/1b08c5c3ac27c9ff91c5309f4a32b4e91ce2263b
https://git.kernel.org/stable/c/414bbad9928598904313299ac9e037a73f520be1
https://git.kernel.org/stable/c/ba664d83638640cf454b65167339cbf20dfd6f10
https://git.kernel.org/stable/c/35e716a70733472ede300540082d64c33bf3b4c9
https://git.kernel.org/stable/c/d8b6529e80bcb4fb8177121404cbb3377acaebd2