CVE-2026-98095

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().

syzbot reported BUG() in sock_sendmsg_nosec(). [0]

The problem is that tpacket_parse_header() casts user-provided

tpacket_hdr.tp_len, which is u32, to int.

If the length is larger than INT_MAX, the following condition

in tpacket_parse_header() passes,

if (unlikely(tp_len > size_max))

and any negative value can be returned to the caller, up to

sock_sendmsg_nosec().

The repro set tpacket_hdr.tp_len to 0xfffffdef, which is cast

to -EIOCBQUEUED (-529), triggering BUG() in sock_sendmsg_nosec().

*(uint64_t*)0x200000000008 = 0xfffffdef;

...

syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000000ul, /*count=*/1ul);

Let's define the local tp_len as u32 in tpacket_parse_header().

[0]:

kernel BUG at net/socket.c:803!

Oops: invalid opcode: 0000 [#1] SMP KASAN PTI

CPU: 0 UID: 0 PID: 5628 Comm: syz-executor176 Not tainted syzkaller #0 PREEMP

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References