CVE-2026-98377: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98377 is a kernel memory disclosure vulnerability in the Linux kernel's VLAN tag insertion subsystem, specifically in the __vlan_insert_inner_tag() function and its wrappers. The flaw allows a local attacker with access to a TUN device to leak uninitialized kernel heap memory into transmitted network packets. It affects the Linux kernel from version 2.6.12 through multiple stable branches, with fixes available in versions 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5. It carries a CVSS v3.1 base score of 7.0 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds read (CWE-125) in __vlan_insert_inner_tag(), which guarantees head room via skb_cow_head() but never validates that mac_len bytes of MAC header are actually present before rewriting the first 16 bytes of packet data (a 12-byte memmove plus two 2-byte stores). An IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a one-byte AF_PACKET/SOCK_RAW frame. When subsequent VLAN push operations (via clsact "action vlan push" or bpf_skb_vlan_push()) are applied, the socket buffer head is allocated from skbuff_small_head without __GFP_ZERO, causing uninitialized slab bytes beyond skb->tail to be dragged into the frame and transmitted. After three pushes, the original one-byte frame is transmitted as 13 bytes containing 11 bytes of uninitialized slab data, which can include kernel linear-map addresses (Github Advisory).

Successful exploitation results in kernel heap memory disclosure, exposing sensitive data such as kernel linear-map addresses in transmitted network packets. This primarily impacts confidentiality, as uninitialized slab memory — potentially containing pointer values, cryptographic material, or other sensitive kernel data — is leaked to the network. While integrity and availability impacts are rated High in the CVSS score, the primary real-world risk is information disclosure that could be leveraged to defeat kernel ASLR and facilitate further privilege escalation attacks (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires local access with low privileges (access to a TUN device) and high attack complexity, limiting its immediate exploitability. The EPSS score is approximately 0.156% (4th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Gain local access: Obtain a low-privileged local account on a Linux system running a vulnerable kernel version (2.6.12 through pre-fix versions of 6.12.x, 6.18.x, or 7.2.x).
2. Access a TUN device: Open or create an IFF_TUN network device, which has hard_header_len == 0, allowing packet_snd() to accept minimal-length frames.
3. Craft a one-byte frame: Using an AF_PACKET/SOCK_RAW socket, send a single-byte frame through the TUN device. The first VLAN push sets only a hardware acceleration (hwaccel) tag without triggering the vulnerable code path.
4. Trigger additional VLAN pushes: Apply two or more additional VLAN tag push operations via clsact TC action ("action vlan push") or bpf_skb_vlan_push(). Each push enters __vlan_insert_inner_tag() with skb->len still at 1, causing uninitialized slab bytes to be incorporated into the frame.
5. Capture transmitted packets: Monitor the network interface to capture the transmitted packet. After three pushes, the one-byte frame is transmitted as 13 bytes, with 11 bytes of uninitialized kernel heap data (potentially including kernel linear-map addresses) visible in the payload.
6. Analyze leaked memory: Parse the captured bytes to extract kernel address information, which can be used to defeat KASLR and inform further exploitation (Github Advisory).

• Network: Outbound packets from a host that are 13 bytes in length with unexpected VLAN tags and non-zero payload bytes that do not correspond to any sent data; packets with VLAN EtherType (0x8100/0x88a8) on frames shorter than a valid Ethernet frame.
• Process: Unusual processes opening AF_PACKET/SOCK_RAW sockets combined with TUN device access; unexpected use of bpf_skb_vlan_push() or TC clsact VLAN push actions by non-administrative users.
• Logs: Kernel audit logs showing low-privileged users creating or accessing TUN devices (/dev/net/tun) followed by raw socket creation; tc command invocations adding clsact qdiscs and VLAN push actions to TUN interfaces by non-root users.

Apply the upstream kernel patches that add MAC header presence validation before __vlan_insert_inner_tag() rewrites packet data. Fixed versions include Linux kernel 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5, corresponding to upstream commits 40a5cc4b, f42562dd, 59af43cc, and ab888242 (Github Advisory). As a workaround, restrict unprivileged access to TUN devices (e.g., via CAP_NET_ADMIN enforcement or removing world-accessible permissions on /dev/net/tun) and audit the use of BPF programs and TC actions that perform VLAN push operations. Red Hat has tracked this issue under Red Hat Bugzilla and users of RHEL-based distributions should monitor for vendor-specific kernel updates.

The vulnerability was announced via the Linux kernel CVE mailing list and subsequently tracked by Red Hat, Microsoft, and GitHub Advisory Database shortly after disclosure in October 2026. Coverage appeared in BleepingComputer's summary of Microsoft's October 2026 Patch Tuesday, which addressed over 1,400 flaws. No significant independent researcher commentary or social media discussion specific to this CVE has been identified beyond standard vulnerability database aggregation.