In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcp_encap_recv() only… (CVE-2026-98952)

The Linux kernel PFCP packet processing functions had a vulnerability where pfcp_session_recv() could read beyond the end of packet data if the SEID field was not fully linearized. Specifically, pfcp_encap_recv() ensured only the UDP and 4-byte PFCP headers were linear, but when the S flag was set, the subsequent 8-byte SEID was read without a pskb_may_pull() check. This could lead to reading uninitialized or out-of-bounds memory, affecting tunnel metadata classification. The patch pulls the SEID fully into the linear area before reading and drops packets too short to contain it. Additionally, the fix corrects header size calculations using offsetofend() instead of sizeof() due to structure alignment differences.

This vulnerability could cause the kernel to read beyond the valid packet data boundaries when processing PFCP packets with the S flag set, potentially leading to incorrect tunnel metadata classification. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to ensure the SEID field is fully linearized before reading. Users should apply the official kernel updates containing this patch. Since this is a kernel-level fix, upgrading to the patched kernel version is the recommended mitigation.