CVE-2026-98541

A flaw was found in the Linux kernel's Foo-over-UDP (FOU) networking subsystem. When configuring a direct encapsulation tunnel without specifying the required network protocol attribute, the kernel permits tunnel socket creation with an uninitialized protocol value. Consequently, incoming network packets processed by this socket are never released from memory. An attacker can exploit this flaw by sending network traffic to the affected tunnel port to continuously leak kernel memory, resulting in a Denial of Service (DoS) due to memory exhaustion.

Moderate severity is assigned to this vulnerability because creating the vulnerable direct encapsulation tunnel requires local administrative network capabilities (such as CAP_NET_ADMIN or an unprivileged user namespace), preventing direct unprivileged or remote triggering. In default Red Hat Enterprise Linux deployments, Foo-over-UDP tunnels are not configured or active. Consequently, exploitation is restricted to environments where untrusted users can manage network namespaces or where direct encapsulation FOU tunnels have been explicitly established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.