CVE-2026-98495

A flaw was found in the Linux kernel. A local user can trigger a Denial of Service (DoS) or potentially expose sensitive memory due to an out-of-bounds read flaw in the Address Resolution Protocol (ARP) networking interface. By supplying a network device request containing a device name that lacks proper null termination, the kernel can read past the end of allocated stack memory during interface name lookups. This issue can cause a system crash or lead to unintended information disclosure.

This vulnerability is rated as having Moderate impact because it requires local access to issue networking ioctls, limiting exploitation to authenticated local users who can induce a kernel crash. Although Address Resolution Protocol (ARP) handling is enabled across standard Red Hat Enterprise Linux installations, the inability to trigger this issue remotely bounds the blast radius to a localized denial of service. The flaw cannot be leveraged directly for remote code execution or arbitrary privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.