---
id: CVE-2026-98493
title: 'net: ipconfig: bound DHCP option construction'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: ipconfig: bound DHCP option construction

  ic_dhcp_init_options() appends the hostname (option 12), vendor-class
  (option 60) and client-ID (option 61) options into …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 130c0f47fdf9c533deb1136cad5136f6cb7020f0 <
    abcba6f080c63e403037ecdffde43170d242376a
  - >-
    Linux >= 130c0f47fdf9c533deb1136cad5136f6cb7020f0 <
    24e79508b237dd2a69bc6fb6ac5cf7f126178307
  - >-
    Linux >= 130c0f47fdf9c533deb1136cad5136f6cb7020f0 <
    cbaad2922bd5d4d303055ae9afecc8999e6b40c9
  - >-
    Linux >= 130c0f47fdf9c533deb1136cad5136f6cb7020f0 <
    e47a1958e12abc3a17b5231a4f21c8f1bf662e08
  - Linux 2.6.36
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:16:22.301Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98493'
references:
  - url: 'https://git.kernel.org/stable/c/abcba6f080c63e403037ecdffde43170d242376a'
  - url: 'https://git.kernel.org/stable/c/24e79508b237dd2a69bc6fb6ac5cf7f126178307'
  - url: 'https://git.kernel.org/stable/c/cbaad2922bd5d4d303055ae9afecc8999e6b40c9'
  - url: 'https://git.kernel.org/stable/c/e47a1958e12abc3a17b5231a4f21c8f1bf662e08'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.292Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: ipconfig: bound DHCP option construction

ic_dhcp_init_options() appends the hostname (option 12), vendor-class
(option 60) and client-ID (option 61) options into the fixed 312-byte
bootp_pkt.exten[] buffer.  Only the client-ID branch checked the
remaining space; the hostname and vendor-class writes were unbounded.

A 64-byte hostname together with the maximum 252-byte dhcpclass=
identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available
bytes even before the terminating END marker, so the vendor-class memcpy
runs past the end of exten[].  With CONFIG_FORTIFY_SOURCE this is
reported as a field-spanning write and, when the kernel is booted with
panic_on_warn=1, aborts boot with a panic.

Route the optional options through a common helper that makes sure the
option, its 2-byte header and the END marker all fit and drops an option
that would not.  Configurations with short options keep sending exactly
the same bytes as before.

## Affected

- `Linux >= 130c0f47fdf9c533deb1136cad5136f6cb7020f0 < abcba6f080c63e403037ecdffde43170d242376a`
- `Linux >= 130c0f47fdf9c533deb1136cad5136f6cb7020f0 < 24e79508b237dd2a69bc6fb6ac5cf7f126178307`
- `Linux >= 130c0f47fdf9c533deb1136cad5136f6cb7020f0 < cbaad2922bd5d4d303055ae9afecc8999e6b40c9`
- `Linux >= 130c0f47fdf9c533deb1136cad5136f6cb7020f0 < e47a1958e12abc3a17b5231a4f21c8f1bf662e08`
- `Linux 2.6.36`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.