Description
In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: Fix UDP length overflow with PMTU discover and big MTU

This commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a
possible overflow of UDP length that triggers a WARN in
udp_set_len_short when setsockopt IP_MTU_DISCOVER is set to
IP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an
unusually large MTU.

Steps to reproduce:

1. Set device MTU bigger than IP_MAX_MTU + 20. cork->base.fragsize will
be set to that MTU in ip_setup_cork.
2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be
set to device MTU (cork->fragsize) in __ip_append_data, rather than
to IP_MAX_MTU.
3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of
IPv4 header). Device MTU allows it (it's only one byte bigger than
IP_MAX_MTU + IPv4 header, and the device MTU is bigger than that).
4. The UDP length in the built packet is 65536, which overflows the
16-bit length field and triggers the WARN in udp_set_len_short.

Note: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward
always clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward.

The Fixes tag points at the first commit where I could reproduce the
overflow with IPv4 and IP_PMTUDISC_PROBE.
Published: 2026-10-14
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel warning with no direct confidentiality, integrity, or availability compromise.
Action: Patch
AI Analysis

Impact

The vulnerability involves an integer overflow in the IPv4 UDP construction path when a host uses IP_MTU_DISCOVER set to IP_PMTUDISC_PROBE to send a packet whose total size exceeds IP_MAX_MTU plus the IPv4 header. The overflow can produce a 16‑bit UDP length field value of 65536, triggering a warning in udp_set_len_short.

Affected Systems

All Linux kernel builds older than the commit that clamps cork->base.fragsize to IP_MAX_MTU are vulnerable. This includes kernels distributed by major vendors that ship the unpatched code. The issue is in the core networking stack, making vendor identity irrelevant to the code path.

Risk and Exploitability

With a CVSS base score of 5.5, the EPSS score is below 1 %, and the vulnerability is not in the CISA KEV catalog. No public exploit is known. The flaw can be invoked by an attacker who can send crafted UDP packets over an interface with a large MTU and with IP_MTU_DISCOVER set to IP_PMTUDISC_PROBE. The impact is limited to a kernel warning and no demonstrated change in confidentiality or integrity.

Generated by OpenCVE AI on October 16, 2026 at 23:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a release that includes the patch that clamps cork->base.fragsize to IP_MAX_MTU.
  • If the kernel cannot be upgraded immediately, configure network interfaces so that MTU values do not exceed IP_MAX_MTU, or disable IP_MTU_DISCOVER or set it to IP_PMTUDISC_DO for facilities that require PMTU.
  • During remediation, monitor kernel logs for the "WARN: udp_set_len_short" pattern and consider temporarily dropping or limiting large outbound UDP packets to avoid warning spam or instability.

Generated by OpenCVE AI on October 16, 2026 at 23:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Fri, 16 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190

Wed, 14 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce: 1. Set device MTU bigger than IP_MAX_MTU + 20. cork->base.fragsize will be set to that MTU in ip_setup_cork. 2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be set to device MTU (cork->fragsize) in __ip_append_data, rather than to IP_MAX_MTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of IPv4 header). Device MTU allows it (it's only one byte bigger than IP_MAX_MTU + IPv4 header, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp_set_len_short. Note: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward always clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward. The Fixes tag points at the first commit where I could reproduce the overflow with IPv4 and IP_PMTUDISC_PROBE.
Title net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:18:46.601Z

Reserved: 2026-09-25T10:25:14.346Z

Link: CVE-2026-98393

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T14:17:50.193

Modified: 2026-10-19T10:18:42.607

Link: CVE-2026-98393

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-14T00:00:00Z

Links: CVE-2026-98393 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T17:30:13Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound