CVE-2026-98240 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ip_tunnel: initialize `options_len` before referencing options
The following command triggers a kernel panic:
ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneve_opts 4660:66:11223344 dev d0
memcpy: detected buffer overflow: 4 byte write of buffer size 0 kernel BUG at lib/string_helpers.c:1044! ... ip_tun_parse_opts.part.0.cold+0x10/0x10 ip_tun_build_state+0x116/0x2a0
On kernels built with GCC 15+ and `CONFIG_FORTIFY_SOURCE`, the fortified `memcpy()` got 0 sized destination with request of 4 bytes length:
static int ip_tun_parse_opts_geneve(...) {
... attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA];
data_len = nla_len(attr); /* == 4 */
struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len; memcpy(opt->opt_data, nla_data(attr), data_len); /* ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */
Fixed by initializing the counter before the options are referenced. Matching what `tunnel_key_opts_set()` already does.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel vulnerability identified in the net: ip_tunnel subsystem involves a critical initialization error within the Geneve tunneling option parsing logic, specifically affecting kernels compiled with GCC version 15 or later and fortified source protections enabled via CONFIG_FORTIFY_SOURCE. The root cause lies in the function ip_tun_parse_opts_geneve, where the variable options_len is utilized as an offset to calculate the destination address for a memory copy operation before it has been properly initialized. This sequence error results in memcpy being invoked with a zero-sized destination buffer while attempting to write four bytes of data derived from network attribute length fields. The fortified implementation of memcpy detects this invalid access pattern, triggering a kernel BUG at lib/string_helpers.c and causing an immediate denial of service through a system panic or crash.
From a technical perspective, the flaw represents a classic use-before-initialization defect that manifests under specific compiler configurations designed to detect buffer overflows and memory safety violations. When a user constructs a Geneve tunnel using iproute2 commands with encapsulation options, such as specifying geneve_opts alongside an IP identifier and device, the kernel attempts to parse these nested attributes. The code calculates the destination pointer by adding the current value of opts_len to the base address of the tunnel info options. Because opts_len remains at its default uninitialized or zero state during this calculation phase, the write operation targets a memory location that is either unmapped or protected, leading to an immediate fault. This behavior highlights how modern compiler hardening features can expose latent logical errors in kernel networking code that might otherwise go unnoticed on less strict builds.
The operational impact of this vulnerability is severe for systems relying on Geneve tunneling capabilities within the Linux network stack. An attacker who possesses local access or control over network configuration commands, such as through iproute2 utilities, can trigger a remote denial of service by causing the kernel to panic. This disrupts all network services running on the affected host and requires a full system reboot to restore functionality. In cloud environments or container orchestration platforms where dynamic tunnel creation is common, this could be exploited to destabilize critical infrastructure components that manage overlay networks. The vulnerability does not appear to allow for arbitrary code execution directly due to the nature of the crash, but it effectively neutralizes the availability of any services dependent on the compromised kernel instance.
Mitigation strategies primarily involve applying vendor-specific patches that update the ip_tunnel module to ensure options_len is initialized prior to its use in pointer arithmetic and memory operations. Administrators should verify their systems are running patched versions of the Linux kernel where this initialization order has been corrected to match the logic used in tunnel_key_opts_set. In environments where immediate patching is not feasible, restricting access to network configuration tools like iproute2 can reduce the attack surface by preventing unauthorized users from constructing malformed Geneve tunnels that trigger the faulty code path. Additionally, monitoring for kernel panic logs related to string_helpers.c or memcpy violations can aid in detecting exploitation attempts of this vulnerability before widespread system instability occurs.
This issue aligns with CWE-457, which describes an use-of-uninitialized-variable weakness, and falls under the broader category of improper input validation within network protocol handlers. In terms of adversarial tactics, it relates to ATT&CK technique T1089 Disabling or Modifying Security Tools if viewed through the lens of causing system instability that hinders security monitoring capabilities, although its primary classification remains a denial-of-service vector via local privilege escalation potential depending on context. The fix emphasizes the importance of consistent initialization practices across similar kernel functions to prevent subtle logic errors from escalating into critical stability issues under fortified compilation modes.