{"id":"AZL-110756","summary":"CVE-2026-98950 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nflow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()\n\nbpf_flow_dissect() sanitizes the offsets returned by the BPF program\nwith clamp_t(u16, ..., hlen).\n\nIf hlen is bigger than 65535, the upper bound is truncated before\nthe comparison. For instance, with hlen == 65536, both nhoff and\nthoff are forced to zero, even if the program returned sane values.\n\nThis is the same class of bug as the one fixed in commit 99bda1ecbd56\n(\"flow_dissector: avoid u16 truncation of skb-\u003elen when computing\nthoff\"). That fix does not cover the BPF path, because\n__skb_flow_dissect() returns early when a BPF flow dissector\nhandles the packet.\n\nstruct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen\nto U16_MAX before clamping.\n\nFound by sashiko while reviewing the commit above.","modified":"2026-10-25T05:30:37Z","published":"2026-10-23T13:17:16Z","upstream":["CVE-2026-98950"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98950"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110756.json"}}],"schema_version":"1.9.0"}