# CVE-2026-98372: xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()

CVE-2026-98372 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98372 (version 7.2.8-1), released October 6, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98372
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 6, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98372

## Description

In the Linux kernel, the following vulnerability has been resolved:  xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()  iptfs_skb_reset_frag_walk() advances to the fragment containing @offset with an unbounded loop:  	while (offset >= walk->past + walk->frags[walk->fragi].len) 		walk->past += walk->frags[walk->fragi++].len;  walk->fragi is advanced and walk->frags[walk->fragi] is dereferenced without ever checking fragi against walk->nr_frags. When the requested offset is at or beyond the total length spanned by the walk's fragments, fragi runs past nr_frags and off the end of the fixed-size on-stack frags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory.  The two callers behave differently: iptfs_skb_add_frags() already guards against this with  	if (!walk->nr_frags || 	    offset >= walk->total + walk->initial_offset) 		return len;  but iptfs_skb_can_add_frags() has no such guard and calls iptfs_skb_reset_frag_walk() unconditionally, so it performs the out-of-range walk. Its own "fragi < walk->nr_frags" bound check runs only afterwards, too late to prevent the read.  This is reachable from the receive path: a crafted IP-TFS (AGGFRAG) payload delivered to an IPTFS SA drives iptfs_reassem_cont() -> iptfs_skb_can_add_frags() with an offset past the fragment total, e.g.:    BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250   Read of size 4 at addr ffff888008ad7210 by task repro/345    iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392    iptfs_skb_can_add_frags+0x155/0x310  net/xfrm/xfrm_iptfs.c:420    iptfs_reassem_cont+0xcf8/0x1140      net/xfrm/xfrm_iptfs.c:902    iptfs_input_ordered+0x552/0x670      net/xfrm/xfrm_iptfs.c:1280    iptfs_input+0x3d6/0xde0              net/xfrm/xfrm_iptfs.c:1741    xfrm_input+0x282f/0x6140             net/xfrm/xfrm_input.c:700    xfrm4_esp_rcv+0x93/0x120             net/ipv4/xfrm4_protocol.c:104    ip_rcv+0x278/0x2d0                   net/ipv4/ip_input.c:612  Give iptfs_skb_can_add_frags() the same up-front guard that iptfs_skb_add_frags() already has, so the walk is never entered with an out-of-range offset. When it triggers, the caller falls back to the existing linearize-and-copy path, which is safe.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.8-1 | [DEBIAN-CVE-2026-98372](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98372.md) | Oct 6, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.