Vulnerability · CVE-2026-98493
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 1…
Published Oct 18, 2026 · catalog updated Oct 18, 2026 · the affected product
Open the advisory
Exploitation likelihood is not on this record for CVE-2026-98493. A missing EPSS score is not a low risk. Compare the affected product with the linked advisory before you change production.
Gaps on this record
- No plain product name is stored. The page cannot tell you which product to check.
- No version range is stored. A customer cannot check an installed version against this record.
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- EPSS is missing. A missing score is not a low risk.
- Severity
- Unknown—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- Awaiting synchronization with FIRST
- Remediation
- Not established
- Affected products
- See sources for product scope
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded. A 64-byte hostname together with the maximum 252-byte dhcpclass= identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available bytes even before the terminating END marker, so the vendor-class memcpy runs past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is reported as a field-spanning write and, when the kernel is booted with panic_on_warn=1, aborts boot with a panic. Route the optional options through a common helper that makes sure the option, its 2-byte header and the END marker all fit and drops an option that would not. Configurations with short options keep sending exactly the same bytes as before.
No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.
How to fix CVE-2026-98493
Recommended remediation
No required-action text, fix commit, or clear fixed-version range is stored yet.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
Exploitation likelihood is not on this record for CVE-2026-98493. A missing EPSS score is not a low risk. Compare the affected product with the linked advisory before you change production.
Which versions are affected?
Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
No weakness class is stored. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 18, 2026 · NIST NVD
Detected
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded. A 64-byte ho
Sources
- NIST NVDVulnerability recordCVE-2026-98493
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer
nvd.nist.gov
References
Freshness
Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.