CVE-2026-98495

net: arp: terminate device name before lookup

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: arp: terminate device name before lookup

The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp_dev field may contain IFNAMSIZ bytes without a NUL terminator.

Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where strcmp() can read past the end of the stack object when a matching alternative interface name exists.

Terminate the field before the lookup to prevent the out-of-bounds read.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before ae6d704dbf9542b0a0830ec91a2db4f30307e7d8Affected 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 47107491b48ceef0a2faa7a010cfa961f211ef9fAffected 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 7389757d88f54237951d7497d9c4dae7cc6d64beAffected 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 1b08c5c3ac27c9ff91c5309f4a32b4e91ce2263bAffected 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 414bbad9928598904313299ac9e037a73f520be1Affected 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before ba664d83638640cf454b65167339cbf20dfd6f10Affected 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 35e716a70733472ede300540082d64c33bf3b4c9Affected 36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before d8b6529e80bcb4fb8177121404cbb3377acaebd2Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before ae6d704dbf9542b0a0830ec91a2db4f30307e7d8Affected
36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 47107491b48ceef0a2faa7a010cfa961f211ef9fAffected
36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 7389757d88f54237951d7497d9c4dae7cc6d64beAffected
36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 1b08c5c3ac27c9ff91c5309f4a32b4e91ce2263bAffected
36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 414bbad9928598904313299ac9e037a73f520be1Affected
36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before ba664d83638640cf454b65167339cbf20dfd6f10Affected
36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before 35e716a70733472ede300540082d64c33bf3b4c9Affected
36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc to before d8b6529e80bcb4fb8177121404cbb3377acaebd2Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.