CVE-2026-98097

CVE-2026-98097

published September 25, 2026

CVSS
—
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

tipc: Dont send random pad bytes in RESET/ACTIVATE messages

The interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer.

Replace the strcpy(data, l->if_name) with memcpy() so that the

pad bytes are actually written (l->if_name[] is zero padded)

rather than sending random bytes from the skb to the remote system.

Replace two other strcpy() with strscpy().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Published
2026-09-25T15:17Z
References (5)
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 25 SEP 10:24Z
    tipc: Dont send random pad bytes in RESET/ACTIVATE messages
    cvelistv5