{"id":"AZL-108650","summary":"CVE-2026-98485 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read\n\nrt_mt6_check() permits rules to be configured with rtinfo-\u003eaddrnr == 0\neven when address matching (IP6T_RT_FST_MASK) is requested.\n\nIn the IP6T_RT_FST_NSTRICT path, rt_mt6() evaluates packet routing\naddresses against rtinfo-\u003eaddrs[i] and terminates backwards at the bottom\nof the loop:\n\n    if (ipv6_addr_equal(ap, &rtinfo-\u003eaddrs[i])) {\n        i++;\n    }\n    if (i == rtinfo-\u003eaddrnr)\n        break;\n\nWhen addrnr is 0, if the first packet address matches rtinfo-\u003eaddrs[0],\ni is incremented to 1. Because i is now strictly greater than addrnr (0),\nthe loop termination condition (i == rtinfo-\u003eaddrnr) is bypassed and will\nnever be satisfied.\n\nIf a crafted IPv6 packet contains matching routing addresses, i will\nadvance past IP6T_RT_HOPS (16). The subsequent call to ipv6_addr_equal()\nreads beyond struct ip6t_rt, triggering UBSAN/KASAN out-of-bounds warnings\nor kernel panics.\n\nFix this by:\n1. Rejecting rules in rt_mt6_check() where IP6T_RT_FST_MASK is set but\n   rtinfo-\u003eaddrnr is zero.\n2. In rt_mt6(), moving the termination condition (i \u003c rtinfo-\u003eaddrnr)\n   into the for-loop header condition and removing the backwards break\n   at the end of the loop body.","modified":"2026-10-19T14:16:31.331825965Z","published":"2026-10-18T16:16:59Z","upstream":["CVE-2026-98485"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98485"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108650.json"}}],"schema_version":"1.9.0"}