CVE-2026-98495
Published Oct 18, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp_dev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where strcmp() can read past the end of the stack object when a matching alternative interface name exists. Terminate the field before the lookup to prevent the out-of-bounds read.
Is your site exposed to CVE-2026-98495?
Run a free security scan — no signup, results in seconds.
References
Other References
https://git.kernel.org/stable/c/1b08c5c3ac27c9ff91c5309f4a32b4e91ce2263b
https://git.kernel.org/stable/c/35e716a70733472ede300540082d64c33bf3b4c9
https://git.kernel.org/stable/c/414bbad9928598904313299ac9e037a73f520be1
https://git.kernel.org/stable/c/47107491b48ceef0a2faa7a010cfa961f211ef9f
https://git.kernel.org/stable/c/7389757d88f54237951d7497d9c4dae7cc6d64be
https://git.kernel.org/stable/c/ae6d704dbf9542b0a0830ec91a2db4f30307e7d8
https://git.kernel.org/stable/c/ba664d83638640cf454b65167339cbf20dfd6f10
https://git.kernel.org/stable/c/d8b6529e80bcb4fb8177121404cbb3377acaebd2
Frequently Asked Questions
What is CVE-2026-98495? +
In the Linux kernel, the following vulnerability has been resolved:
net: arp: terminate device name before lookup
The ARP ioctl copies a user-provided struct arpreq into a stack object. Its
arp_dev field may contain IFNAMSIZ bytes without a NUL terminator.
Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where
strcmp() can read past the end of the stack object when a matching
alternative interface name exists.
Terminate the field before the lookup to prevent the out-of-bounds read.
How do I check if I'm vulnerable to CVE-2026-98495? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.