CVE-2026-98240

A flaw was found in the Linux kernel's IP tunnel subsystem. When processing network routes with encapsulation options, the subsystem references tunnel options before their length is initialized. A local user with network configuration privileges can exploit this flaw by adding routes with specific tunnel options, triggering a kernel panic and causing a Denial of Service (DoS).

A flaw of low impact was found in the Linux kernel's IP tunnel subsystem. When a route with IP encapsulation (encap ip) options such as geneve_opts is configured, the tunnel options length (options_len) is referenced before it is initialized. On kernels built with GCC 15 or later and CONFIG_FORTIFY_SOURCE enabled, the fortified memcpy() detects a zero-sized destination buffer and triggers a kernel BUG, resulting in a kernel panic and a local denial of service. Triggering the flaw requires local access with network configuration privileges (CAP_NET_ADMIN) to add a route with specific tunnel options through the netlink control plane; it is not directly network reachable, and the impact is limited to availability, with no confidentiality or integrity impact.

Although the Red Hat CVSS:3.1 base score is 5.5 (Moderate), this flaw is rated low impact because the demonstrated effect is a deterministic local denial of service on fortified builds rather than an actual out-of-bounds write, use-after-free, information leak, or privilege escalation.

The vulnerable code is present in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9, rhel-9.10), Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, rhel-10.4), Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 (ose-rhel-coreos-9), which are therefore affected. Other Red Hat Enterprise Linux and OpenShift Container Platform streams are not affected because the vulnerable code is not present in them. Fixes for the affected streams are currently deferred. Because exploitation requires local privileged access and results only in denial of service, the residual risk of deferring the fix is limited to a local privileged user causing a kernel panic on affected systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.