In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the… (CVE-2026-98493)

The Linux kernel vulnerability CVE-2026-98493 involves improper bounds checking in the DHCP option construction within the ic_dhcp_init_options() function. Specifically, the hostname (option 12) and vendor-class (option 60) options are appended into a fixed 312-byte buffer without verifying available space, unlike the client-ID option which is properly checked. When large values for hostname and vendor-class are used, the vendor-class memcpy operation can overflow the buffer, causing a field-spanning write. Under configurations with CONFIG_FORTIFY_SOURCE and panic_on_warn=1, this leads to a kernel panic during boot. The vulnerability was resolved by introducing a common helper function that ensures the option, its header, and the END marker fit within the buffer, dropping any option that would overflow.

The vulnerability can cause a kernel panic during system boot if specific kernel hardening options are enabled, potentially leading to denial of service. There is no indication of code execution or privilege escalation from the provided data. The impact is limited to stability and availability under certain configurations.

A fix is available that routes DHCP options through a helper function enforcing buffer size limits, preventing overflow. Systems should apply the vendor's official kernel updates that include this fix. No other mitigation actions are indicated or required.