CVE-2026-98541

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

Commit 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.") added

NLA_POLICY_MIN(NLA_U8, 1) to fou_nl_policy[FOU_ATTR_IPPROTO], which

rejects an explicitly supplied FOU_ATTR_IPPROTO == 0 attribute with

-ERANGE.

However, FOU_ATTR_IPPROTO is an optional netlink attribute. When a user

sends FOU_CMD_ADD with FOU_ATTR_TYPE set to FOU_ENCAP_DIRECT and omits

FOU_ATTR_IPPROTO entirely, nla_policy validation succeeds and

parse_nl_config() leaves cfg->protocol as 0 (from memset(cfg, 0,

sizeof(*cfg))). fou_create() then creates a FOU_ENCAP_DIRECT socket with

fou->protocol == 0.

In fou_udp_recv(), returning -fou->protocol to udp_queue_rcv_one_skb()

triggers IP protocol resubmission when fou->protocol > 0, whereas

returning 0 tells the UDP tunnel layer that the skb was consumed without

freeing it. When fou->protocol == 0, every packet received on the socket

returns 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References