CVE-2026-98372
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()
iptfs_skb_reset_frag_walk() advances to the fragment containing @offset with an unbounded loop:
while (offset >= walk->past + walk->frags[walk->fragi].len)
walk->past += walk->frags[walk->fragi++].len;
walk->fragi is advanced and walk->frags[walk->fragi] is dereferenced
without ever checking fragi against walk->nr_frags. When the requested offset is at or beyond the total length spanned by the walk's fragments, fragi runs past nr_frags and off the end of the fixed-size on-stack frags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory.
The two callers behave differently: iptfs_skb_add_frags() already guards against this with
if (!walk->nr_frags || offset >= walk->total + walk->initial_offset) return len;
but iptfs_skb_can_add_frags() has no such guard and calls iptfs_skb_reset_frag_walk() unconditionally, so it performs the out-of-range walk. Its own "fragi nr_frags" bound check runs only afterwards, too late to prevent the read.
This is reachable from the receive path: a crafted IP-TFS (AGGFRAG) payload delivered to an IPTFS SA drives iptfs_reassem_cont() -> iptfs_skb_can_add_frags() with an offset past the fragment total, e.g.:
BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250 Read of size 4 at addr ffff888008ad7210 by task repro/345 iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392 iptfs_skb_can_add_frags+0x155/0x310 net/xfrm/xfrm_iptfs.c:420 iptfs_reassem_cont+0xcf8/0x1140 net/xfrm/xfrm_iptfs.c:902 iptfs_input_ordered+0x552/0x670 net/xfrm/xfrm_iptfs.c:1280 iptfs_input+0x3d6/0xde0 net/xfrm/xfrm_iptfs.c:1741 xfrm_input+0x282f/0x6140 net/xfrm/xfrm_input.c:700 xfrm4_esp_rcv+0x93/0x120 net/ipv4/xfrm4_protocol.c:104 ip_rcv+0x278/0x2d0 net/ipv4/ip_input.c:612
Give iptfs_skb_can_add_frags() the same up-front guard that iptfs_skb_add_frags() already has, so the walk is never entered with an out-of-range offset. When it triggers, the caller falls back to the existing linearize-and-copy path, which is safe.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel contains a critical stack-based out-of-bounds read vulnerability within the IP-TFS implementation located in net/xfrm/xfrm_iptfs.c. Specifically, the function iptfs_skb_reset_frag_walk() exhibits an unbounded loop that advances through packet fragments based on an offset parameter without validating whether the fragment index remains within valid bounds. The code iterates by incrementing a fragi counter and accessing walk->frags[walk->fragi] to accumulate lengths until the current position surpasses the requested offset. However, there is no check ensuring that fragi does not exceed nr_frags, which represents the total number of fragments in the scatter-gather list. Consequently, if an attacker supplies a crafted IP-TFS payload with an offset equal to or greater than the total length spanned by all available fragments, the loop continues indefinitely until it reads past the end of the fixed-size on-stack array frags[MAX_SKB_FRAGS + 1]. This results in reading arbitrary stack memory, which can lead to information disclosure or potentially destabilize kernel execution depending on what data resides at those out-of-bounds addresses.
This vulnerability is reachable via the network receive path when processing AGGFRAG payloads destined for an IPTFS Security Association. The exploit chain begins with a malicious packet triggering iptfs_input(), which calls into xfrm_input() and eventually reaches iptfs_reassem_cont(). From there, control flows to iptfs_skb_can_add_frags(), which unconditionally invokes the vulnerable reset function before performing any bounds checking on its own fragi variable. In contrast, another caller of this routine, iptfs_skb_add_frags(), correctly implements an early guard clause that checks if nr_frags is zero or if the offset exceeds the total length plus initial offset, thereby preventing entry into the dangerous loop. The absence of such a check in iptfs_skb_can_add_frags() creates a distinct attack surface where malformed inputs can trigger the out-of-bounds read immediately upon processing.
The operational impact of this flaw includes potential kernel information disclosure through KASAN stack-out-of-bounds reports or silent corruption if the accessed memory overlaps with sensitive structures. Although the immediate symptom is an invalid memory access, repeated exploitation could aid in further attacks by leaking cryptographic keys or other kernel secrets stored on the stack. The vulnerability aligns with CWE-125 Out-of-bounds Read and falls under MITRE ATT&CK technique T1083 File and Directory Discovery if used for reconnaissance, though its primary classification is a memory safety violation within network processing logic.
To mitigate this issue, developers must apply a patch that adds the same up-front validation guard to iptfs_skb_can_add_frags() as exists in iptfs_skb_add_frags(). This involves checking whether nr_frags is non-zero and ensuring the requested offset does not exceed the sum of total length and initial offset before entering the fragment walk loop. If these conditions are not met, the function should return a value that triggers a fallback to the linearize-and-copy path, which processes data safely without relying on complex scatter-gather iteration logic. This fix ensures that malformed packets do not cause out-of-bounds memory access while maintaining compatibility with existing network stack behaviors and preserving performance for valid traffic flows.