UDP Length Overflow Vulnerability in Linux Kernel Affecting Network Devices

CVE-2026-98393

What is CVE-2026-98393?

A vulnerability exists in the Linux kernel that may lead to a UDP length overflow when using Path Maximum Transmission Unit (PMTU) discovery with oversized MTUs. This issue arises when the device's MTU is set beyond the maximum allowable size, resulting in malformed packets that could potentially trigger warnings in the kernel. Specifically, when IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE, the overflow occurs due to the miscalculation of the UDP length field. Proper safeguards are necessary to prevent unsafe configurations that could be exploited by malicious actors.

References