CVE-2026-98952 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
pfcp: make sure the SEID is linear before reading it
pfcp_encap_recv() only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcp_session_recv() then reads the 8 byte SEID that follows, which is not covered by the pskb_may_pull() check.
A short PFCP packet with the S flag set, or one whose session header lies in a fragment, therefore makes pfcp_session_recv() read beyond the end of the packet data, and whatever it finds there is stored in the tunnel metadata that flower later classifies on.
Pull up to the end of the SEID before reading it, and drop packets that are too short to contain it. Reload the header pointer afterwards since pskb_may_pull() may reallocate the skb head.
Use offsetofend() rather than sizeof(struct pfcphdr_session): the structure is not packed, so its size is 16 bytes because of the alignment of the __be64 member, while the header on the wire is only 12 bytes, and valid session messages would be dropped.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability resides within the Packet Forwarding Control Protocol (PFCP) implementation in the Linux kernel, specifically affecting the handling of encapsulated packets received via UDP. PFCP is a critical protocol used for controlling user plane functions in 5G networks and other telecommunications infrastructures, making its robustness essential for network stability and security. The core issue arises from an insufficient bounds check during packet processing, which allows an attacker to trigger out-of-bounds memory reads by crafting maliciously sized PFCP packets. This flaw is located in the pfcp_encap_recv function and the subsequent call to pfcp_session_recv, where the kernel fails to verify that all necessary data fields are present within a linear buffer before accessing them.
The technical root cause involves an incomplete application of pskb_may_pull checks. When processing incoming PFCP packets, the code correctly verifies that the UDP header and the initial four bytes of the PPCP header reside in the linear portion of the socket buffer to prevent fragmentation-related issues during basic parsing. However, when the Session Establishment Request flag is set, indicating specific session management operations, the kernel proceeds to read an eight-byte Session Endpoint Identifier SEID located immediately after the standard header. The existing validation logic does not extend far enough to ensure this additional data is available in a contiguous linear buffer. Consequently, if a packet is truncated or fragmented such that the SEID lies outside the currently accessible memory region, the kernel will attempt to read beyond the allocated packet boundaries.
This out-of-bounds read results in sensitive kernel memory contents being exposed and potentially misinterpreted as valid session metadata. The data retrieved from this invalid memory location is stored into tunnel metadata structures used by the flower classifier for network traffic classification and steering. This means that arbitrary kernel heap or stack content can be injected into flow classification logic, leading to unpredictable behavior within the networking subsystem. While primarily an information disclosure vulnerability allowing potential leakage of internal kernel state, such corruption of packet processing paths could also lead to denial-of-service conditions through malformed flow rules or unexpected crashes if the read data causes subsequent validation failures in downstream components.
From a threat modeling perspective, this flaw aligns with CWE-125 Out-of-bounds Read and is exploitable remotely by sending specially crafted UDP packets containing PFCP headers with the session flag set but insufficient payload length to contain the full SEID field. In terms of ATT&CK mapping, this represents an initial access or defense evasion technique where malformed inputs are used to probe kernel memory boundaries for information gathering or stability disruption. The vulnerability highlights a common class of errors in network protocol parsers where partial validation is performed on header fields without ensuring that all subsequent dependent structures are also safely accessible within the buffer limits.
The resolution involves modifying pfcp_session_recv to explicitly verify that sufficient data exists before attempting to read the eight-byte SEID field. This includes pulling up the packet data to ensure linear access covers the entire session header structure and dropping any packets that do not meet this minimum length requirement. Additionally, the fix addresses a secondary logical error regarding struct size calculations. The original code used sizeof on a non-packed C structure which included padding bytes for alignment purposes resulting in a calculated size of sixteen bytes rather than the actual twelve-byte wire format size. Correcting this to use offsetofend ensures that valid session messages are not incorrectly dropped due to overestimation of required header length, thereby maintaining protocol compliance while enforcing strict bounds checking on all variable-length or offset-dependent fields within PFCP packet processing routines.