CVE-2026-99112 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_flower: validate mask pointer after nla_next()
fl_set_enc_opt() iterates the key's nested tunnel-option attributes with nla_for_each_attr() while advancing a single mask pointer via nla_next() at the bottom of each loop, so the mask cursor is driven by the number of key attributes rather than by the mask's own attributes. The nla_ok() added by commit c96adff956191 ("cls_flower: call nla_ok() before nla_next()") only validates the mask pointer that was just consumed; the pointer produced by nla_next() is used by the next iteration (fl_set_geneve_opt() and siblings) without any validation.
The mask's nested attributes are validated with NL_VALIDATE_LIBERAL, which merely warns on trailing bytes that do not form a complete attribute. A mask carrying one valid attribute plus 1-3 residue bytes (or a non-aligned attribute length making msk_depth negative) therefore reaches the next iteration with msk_depth != 0, so neither the !msk_depth check in fl_set_enc_opt() nor the !depth check in the per-type helpers fires. nla_type() then reads past the mask payload and nla_parse_nested_deprecated() iterates with an nla_len taken from those bytes, reading well beyond the mask attribute (KASAN: slab-out-of-bounds read in __nla_validate_parse from fl_change()).
Validate the advanced mask pointer as well: when the mask is not legitimately exhausted (msk_depth != 0) and the new pointer fails nla_ok(), reject the filter with -EINVAL. An exactly exhausted mask still skips the check, preserving exact-match behaviour for the remaining key attributes.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in the Linux kernel's network scheduler flower classifier involves a critical input validation flaw within the handling of nested tunnel-option attributes. Specifically, the function fl_set_enc_opt() processes key attributes using nla_for_each_attr while simultaneously advancing a mask pointer via nla_next(). This design creates a synchronization issue where the cursor for the mask is driven by the count of key attributes rather than being independently validated against the actual structure and length of the mask data itself. Although previous patches introduced checks to validate the mask pointer before calling nla_next(), these validations only confirmed the state of the pointer that was just consumed, leaving the newly advanced pointer unchecked in subsequent iterations. This oversight allows malformed or truncated mask attributes to bypass critical boundary checks, leading to out-of-bounds memory access when the kernel attempts to parse nested attributes from invalid data regions.
The technical root cause lies in how the validation logic interacts with attribute parsing routines that use NL_VALIDATE_LIBERAL mode. In this mode, trailing bytes that do not form a complete attribute generate only warnings rather than errors. Consequently, if a mask contains one valid attribute followed by residual bytes or an unaligned length causing msk_depth to become negative, the loop continues without triggering the expected termination conditions such as !msk_depth in fl_set_enc_opt() or depth checks in per-type helpers like fl_set_geneve_opt(). As a result, nla_type() proceeds to read memory beyond the allocated mask payload. This leads to slab-out-of-bounds reads within __nla_validate_parse during filter changes, exposing the system to potential information disclosure or stability issues depending on what data resides at those out-of-bound addresses.
From an operational perspective, this vulnerability allows a local user with appropriate network namespace privileges to craft malicious netlink messages that trigger kernel memory corruption. The impact includes denial of service through kernel panics caused by invalid memory accesses and potentially sensitive information leakage if the read operations expose internal kernel structures or stack contents. This aligns with CWE-125, Out-of-bounds Read, as the application reads data beyond the intended buffer boundary due to insufficient validation of input lengths and pointers. Furthermore, this flaw can be leveraged in attacks categorized under MITRE ATT&CK technique T1083, File and Directory Discovery, if an attacker uses the information leak to map kernel memory layouts for further exploitation steps such as bypassing KASLR or targeting specific kernel objects.
To mitigate this vulnerability, it is essential that developers validate the advanced mask pointer after every call to nla_next(). The fix involves checking whether the new pointer satisfies nla_ok() conditions before proceeding with attribute parsing. If the mask is not legitimately exhausted and the next pointer fails validation, the filter should be rejected immediately with an EINVAL error code. This ensures that only well-formed masks are processed, preventing out-of-bounds reads while preserving exact-match behavior for correctly structured inputs. System administrators should apply kernel updates containing this patch to close the gap in input validation logic within the flower classifier module and maintain strict adherence to attribute length constraints during netlink message processing.