CVE-2026-98097: tipc: Dont send random pad bytes in RESET/ACTIVATE messages
In the Linux kernel, the following vulnerability has been resolved:
tipc: Dont send random pad bytes in RESET/ACTIVATE messages
The interface name is passed in a fixed length (TIPCMAXIFNAME) buffer. Replace the strcpy(data, l->ifname) with memcpy() so that the pad bytes are actually written (l->ifname[] is zero padded) rather than sending random bytes from the skb to the remote system.
Replace two other strcpy() with strscpy().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel TIPC RESET/ACTIVATE message handling, replace strcpy(data, l->if_name) with memcpy() so the zero-padded TIPC_MAX_IF_NAME buffer is fully written, and replace the two other strcpy() calls with strscpy().
Event History
Frequently Asked Questions
Who can observe the unintended data?
Remote systems that receive TIPC RESET or ACTIVATE messages can receive random bytes from the skb in the padding area of the fixed-length interface-name buffer.
What does the fix change?
The fix copies the zero-padded l->if_name buffer with memcpy() so all bytes in the fixed-length field are written rather than leaving random skb bytes to be sent. It also replaces two other strcpy() calls with strscpy().