{
  "cveId": "CVE-2026-98372",
  "url": "https://patchblox.com/security/cve/CVE-2026-98372",
  "summary": "CVE-2026-98372 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98372 (version 7.2.8-1), released October 6, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()  iptfs_skb_reset_frag_walk() advances to the fragment containing @offset with an unbounded loop:  \twhile (offset \u003E= walk-\u003Epast \u002B walk-\u003Efrags[walk-\u003Efragi].len) \t\twalk-\u003Epast \u002B= walk-\u003Efrags[walk-\u003Efragi\u002B\u002B].len;  walk-\u003Efragi is advanced and walk-\u003Efrags[walk-\u003Efragi] is dereferenced without ever checking fragi against walk-\u003Enr_frags. When the requested offset is at or beyond the total length spanned by the walk\u0027s fragments, fragi runs past nr_frags and off the end of the fixed-size on-stack frags[MAX_SKB_FRAGS \u002B 1] array, reading out-of-bounds stack memory.  The two callers behave differently: iptfs_skb_add_frags() already guards against this with  \tif (!walk-\u003Enr_frags || \t    offset \u003E= walk-\u003Etotal \u002B walk-\u003Einitial_offset) \t\treturn len;  but iptfs_skb_can_add_frags() has no such guard and calls iptfs_skb_reset_frag_walk() unconditionally, so it performs the out-of-range walk. Its own \u0022fragi \u003C walk-\u003Enr_frags\u0022 bound check runs only afterwards, too late to prevent the read.  This is reachable from the receive path: a crafted IP-TFS (AGGFRAG) payload delivered to an IPTFS SA drives iptfs_reassem_cont() -\u003E iptfs_skb_can_add_frags() with an offset past the fragment total, e.g.:    BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk\u002B0x235/0x250   Read of size 4 at addr ffff888008ad7210 by task repro/345    iptfs_skb_reset_frag_walk\u002B0x235/0x250 net/xfrm/xfrm_iptfs.c:392    iptfs_skb_can_add_frags\u002B0x155/0x310  net/xfrm/xfrm_iptfs.c:420    iptfs_reassem_cont\u002B0xcf8/0x1140      net/xfrm/xfrm_iptfs.c:902    iptfs_input_ordered\u002B0x552/0x670      net/xfrm/xfrm_iptfs.c:1280    iptfs_input\u002B0x3d6/0xde0              net/xfrm/xfrm_iptfs.c:1741    xfrm_input\u002B0x282f/0x6140             net/xfrm/xfrm_input.c:700    xfrm4_esp_rcv\u002B0x93/0x120             net/ipv4/xfrm4_protocol.c:104    ip_rcv\u002B0x278/0x2d0                   net/ipv4/ip_input.c:612  Give iptfs_skb_can_add_frags() the same up-front guard that iptfs_skb_add_frags() already has, so the walk is never entered with an out-of-range offset. When it triggers, the caller falls back to the existing linearize-and-copy path, which is safe.",
  "published": "2026-10-06T09:18:31Z",
  "severity": "",
  "epss": 0.00155,
  "epssPercentile": 0.04623,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98372",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.8-1",
      "fix": "DEBIAN-CVE-2026-98372",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98372",
      "released": "2026-10-06T21:56:27Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}