{ "cveId": "CVE-2026-98393", "url": "https://patchblox.com/security/cve/CVE-2026-98393", "summary": "CVE-2026-98393 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-98393, released October 16, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "net: ipv4: Fix UDP length overflow with PMTU discover and big MTU", "description": "In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-\u003Ebase.fragsize to IP_MAX_MTU to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce: 1. Set device MTU bigger than IP_MAX_MTU \u002B 20. cork-\u003Ebase.fragsize will be set to that MTU in ip_setup_cork. 2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be set to device MTU (cork-\u003Efragsize) in __ip_append_data, rather than to IP_MAX_MTU. 3. Send 65528 bytes of payload (\u002B8 bytes of UDP header, \u002B20 bytes of IPv4 header). Device MTU allows it (it\u0027s only one byte bigger than IP_MAX_MTU \u002B IPv4 header, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp_set_len_short. Note: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward always clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward. The Fixes tag points at the first commit where I could reproduce the overflow with IPv4 and IP_PMTUDISC_PROBE.", "published": "2026-10-12T09:00:00Z", "severity": "Low", "cvss": 1.9, "epss": 0.00203, "epssPercentile": 0.10353, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98393", "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.54-121.166", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.2.7-1", "fix": "DEBIAN-CVE-2026-98393", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98393", "released": "2026-10-16T15:52:00Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T19:12:23Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }