CVE-2026-98095
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
syzbot reported BUG() in sock_sendmsg_nosec(). [0]
The problem is that tpacket_parse_header() casts user-provided tpacket_hdr.tp_len, which is u32, to int.
If the length is larger than INT_MAX, the following condition in tpacket_parse_header() passes,
if (unlikely(tp_len > size_max))
and any negative value can be returned to the caller, up to sock_sendmsg_nosec().
The repro set tpacket_hdr.tp_len to 0xfffffdef, which is cast to -EIOCBQUEUED (-529), triggering BUG() in sock_sendmsg_nosec().
*(uint64_t*)0x200000000008 = 0xfffffdef; ... syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000000ul, /*count=*/1ul);
Let's define the local tp_len as u32 in tpacket_parse_header().
[0]:
kernel BUG at net/socket.c:803! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5628 Comm: syz-executor176 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:sock_sendmsg_nosec+0x145/0x180 net/socket.c:803 Code: 06 67 48 0f b9 3a eb 95 e8 e8 3a 22 f8 48 89 df 4c 89 f6 4c 89 e2 4d 89 fb 2e e8 32 a5 5c 16 e9 51 ff ff ff e8 cc 3a 22 f8 90 0b e8 c4 3a 22 f8 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28 RSP: 0018:ffffc90003aefb48 EFLAGS: 00010293 RAX: ffffffff89a578d4 RBX: ffff8880764c67c0 RCX: ffff88807fb23e80 RDX: 0000000000000000 RSI: 00000000fffffdef RDI: 00000000fffffdef RBP: 00000000fffffdef R08: ffffc90003aef747 R09: 1ffff9200075dee8 R10: dffffc0000000000 R11: fffff5200075dee9 R12: 0000000000000001 R13: dffffc0000000000 R14: ffffc90003aefbc0 R15: ffffffff8aac4310 FS: 000055559101b400(0000) GS:ffff888124ce0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000210 CR3: 0000000073dca000 CR4: 00000000003526f0 Call Trace: __sock_sendmsg net/socket.c:815 [inline]
sock_write_iter+0x2de/0x3e0 net/socket.c:1266 new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f173130ecb9 Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd67e44248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f173130ecb9 RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd67e44388 R13: 0000000000000002 R14: 00002000000000c0 R15: 0000000000000002
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's af_packet subsystem contains a critical type conversion vulnerability within the tpacket_parse_header function that allows local users to trigger a kernel panic. This flaw stems from an improper casting of user-supplied data, specifically the tp_len field of the tpacket_hdr structure, which is defined as an unsigned 32-bit integer but was incorrectly cast to a signed integer during processing. When this value exceeds INT_MAX, typically due to maliciously crafted packet headers provided by unprivileged users with access to AF_PACKET sockets, the resulting negative return code propagates up the call stack into sock_sendmsg_nosec. This function expects valid positive error codes or success indicators but encounters an unexpected negative integer that does not correspond to a standard Linux errno value, causing it to hit a BUG() macro assertion and subsequently crash the kernel with an invalid opcode exception.
From a technical perspective, this vulnerability is classified under CWE-190 Integer Overflow or Wraparound because the conversion from u32 to int allows large unsigned values to wrap around into negative signed territory. The specific mechanism involves the comparison logic within tpacket_parse_header where the casted tp_len variable passes an initial size check but results in a return value that violates the assumptions of downstream socket handling routines. In the reported incident, syzbot demonstrated this by setting tp_len to 0xfffffdef, which converts to -529 when interpreted as a signed integer. This specific negative value was passed directly into sock_sendmsg_nosec, triggering the kernel BUG at net/socket.c line 803 and resulting in a Denial of Service condition for all processes on the affected system. The attack vector is local, requiring only file descriptor access to an AF_PACKET socket, which may be available to unprivileged users depending on system configuration and capabilities such as NET_RAW or CAP_NET_ADMIN.
The operational impact of this vulnerability is severe, primarily manifesting as a complete loss of availability due to kernel panic. An attacker can reliably crash the host machine by sending a single write syscall with a carefully constructed buffer containing the malicious header structure. This aligns with ATT&CK technique T1529 System Shutdown or Reboot, where an adversary disrupts service through resource exhaustion or system instability. Unlike remote code execution vulnerabilities that might allow for privilege escalation, this specific flaw is primarily useful for denial of service attacks against virtualized environments or shared hosting infrastructure where kernel stability is paramount. The presence of KASAN (Kernel Address Sanitizer) in the crash log indicates that such issues are often caught during development testing but can slip into production kernels if not properly validated before release.
Mitigation strategies focus on correcting the type definition within the source code to ensure strict adherence to data integrity principles. Developers must define the local tp_len variable as u32 rather than int in tpacket_parse_header to prevent implicit signed conversion errors. Additionally, input validation should be strengthened by explicitly checking that user-provided lengths do not exceed maximum allowable buffer sizes before any arithmetic or logical operations are performed on them. System administrators can mitigate risk temporarily by restricting access to AF_PACKET sockets through mandatory access control policies such as SELinux or AppArmor, limiting the ability of unprivileged users to interact with raw packet interfaces until a patched kernel version is deployed. Regular patching and updating of the Linux kernel are essential to resolve this issue, ensuring that the fix for improper type casting in network subsystems is applied across all affected distributions.