CVE-2026-99112

A flaw was found in the Linux kernel's Flower classifier (cls_flower). When iterating through nested tunnel option attributes, the kernel fails to properly validate the mask pointer after advancing it to the next attribute. A local attacker with network configuration privileges can exploit this vulnerability by submitting a crafted traffic filter with malformed mask attributes, triggering an out-of-bounds memory read. This issue primarily leads to a Denial of Service (DoS) via a system crash, and may potentially allow the disclosure of kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.