In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a… (CVE-2026-98495)

The Linux kernel's ARP ioctl copies a user-supplied struct arpreq into a stack object. The arp_dev field in this struct may contain IFNAMSIZ bytes without a terminating NUL character. When this field is passed to dev_get_by_name_rcu() or __dev_get_by_name(), the strcmp() function may read past the end of the stack object if a matching alternative interface name exists. The vulnerability was fixed by terminating the arp_dev field before performing the lookup, preventing the out-of-bounds read.

This vulnerability allows an out-of-bounds read in kernel memory during ARP ioctl processing. While the exact impact is not detailed, out-of-bounds reads can lead to information disclosure or kernel instability. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to terminate the arp_dev field before lookup, preventing the out-of-bounds read. Users should apply the official kernel update containing this fix once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.