CVE-2026-98495

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-98495
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98495.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-98495
Downstream
Published
2026-10-18T15:16:24Z
Modified
2026-10-19T02:46:26Z
Summary
net: arp: terminate device name before lookup
Details

In the Linux kernel, the following vulnerability has been resolved:

net: arp: terminate device name before lookup

The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp_dev field may contain IFNAMSIZ bytes without a NUL terminator.

Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where strcmp() can read past the end of the stack object when a matching alternative interface name exists.

Terminate the field before the lookup to prevent the out-of-bounds read.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98495.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc
Fixed
ae6d704dbf9542b0a0830ec91a2db4f30307e7d8
Fixed
47107491b48ceef0a2faa7a010cfa961f211ef9f
Fixed
7389757d88f54237951d7497d9c4dae7cc6d64be
Fixed
1b08c5c3ac27c9ff91c5309f4a32b4e91ce2263b
Fixed
414bbad9928598904313299ac9e037a73f520be1
Fixed
ba664d83638640cf454b65167339cbf20dfd6f10
Fixed
35e716a70733472ede300540082d64c33bf3b4c9
Fixed
d8b6529e80bcb4fb8177121404cbb3377acaebd2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98495.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.271
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.112
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.55
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98495.json"