Is CVE-2026-98372 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-98372 being exploited in the wild.

How severe is CVE-2026-98372?

Informational severity, published 6 October 2026.

Which products and versions are affected?

Linux Kernel Versions with xfrm iptfs implementation (4.20+).

How is CVE-2026-98372 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-98372?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-98372: Linux kernel stack out-of-bounds read in xfrm iptfs

CVE-2026-98372 · Severity: info · Published 2026-10-06

The Linux kernel's IP-TFS (IP-based Tunnel Fragmentation and Serialization) implementation contains a stack memory read vulnerability. A remote attacker can send a crafted network packet to trigger an out-of-bounds read of kernel stack memory on systems using IPTFS encryption. This could leak sensitive kernel data, though exploitation for remote code execution is unlikely with this specific issue.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-98372 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-98372 being exploited in the wild.
How severe is CVE-2026-98372?: Informational severity, published 6 October 2026.
Which products and versions are affected?: Linux Kernel Versions with xfrm iptfs implementation (4.20+).
Is there a fix for CVE-2026-98372?: No fixed version is recorded yet. Add an up-front bounds check in iptfs_skb_can_add_frags() before calling iptfs_skb_reset_frag_walk(), matching the existing guard in iptfs_skb_add_frags() to reject out-of-range offsets early. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-98372 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-98372?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Add an up-front bounds check in iptfs_skb_can_add_frags() before calling iptfs_skb_reset_frag_walk(), matching the existing guard in iptfs_skb_add_frags() to reject out-of-range offsets early.

Technical details

The vulnerability is a stack out-of-bounds read in the iptfs_skb_reset_frag_walk() function in net/xfrm/xfrm_iptfs.c. An unbounded loop advances through fragment indices without checking against the fragment count limit, allowing reads past a fixed-size on-stack array. The issue is reachable from the network receive path when processing IP-TFS (AGGFRAG) packets with offsets exceeding the total fragment span, triggered via iptfs_reassem_cont() -> iptfs_skb_can_add_frags().

Affected products

Linux Linux kernel Versions with xfrm iptfs implementation (4.20+)

Timeline

2026-10-06: advisory: Vulnerability disclosed and patched in mainline kernel

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.