UBUNTU-CVE-2026-98393: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork->base.fragsize to IPMAXMTU to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockopt IPMTUDISCOVER is set to IPPMTUDISCPROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce: 1. Set device MTU bigger than IPMAXMTU + 20. cork->base.fragsize will be set to that MTU in ipsetupcork. 2. Set IPMTUDISCOVER to IPPMTUDISCPROBE. It lets maxnonfragsize be set to device MTU (cork->fragsize) in ipappenddata, rather than to IPMAXMTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of IPv4 header). Device MTU allows it (it's only one byte bigger than IPMAXMTU + IPv4 header, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udpsetlenshort. Note: IPPMTUDISCDO with IPv4 is safe, because ipdstmtumaybeforward always clamps at IPMAXMTU, unlike ip6dstmtumaybeforward. The Fixes tag points at the first commit where I could reproduce the overflow with IPv4 and IPPMTUDISCPROBE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Exposure requires an IPv4 UDP sender using PMTU discovery probe mode on an interface whose MTU is greater than IP_MAX_MTU + 20. Ordinary interfaces with normal MTU values do not meet the described condition.
What must an attacker or local process do to trigger it?
A process needs permission to use the affected network configuration and send UDP traffic. It must set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE and send 65,528 bytes of UDP payload through a device with an unusually large MTU.
Are other IPv4 PMTU discovery modes affected?
The provided data identifies IP_PMTUDISC_PROBE as affected. IP_PMTUDISC_DO with IPv4 is described as safe because its MTU calculation is clamped to IP_MAX_MTU.
What can be done before applying the fix?
Avoid configuring network devices with MTUs greater than IP_MAX_MTU + 20, and prevent affected workloads from using IP_PMTUDISC_PROBE. Keeping the MTU at or below that threshold prevents the described overflow condition.
How can an administrator recognize a possible trigger?
The described symptom is a WARN in udp_set_len_short after a UDP packet is built with a length of 65,536, overflowing the 16-bit UDP length field. Review systems with unusually large interface MTUs and applications that set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE.