Out-of-bounds Read Affecting openshift/ose-rhel-coreos-9 package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL8-OPENSHIFTOSERHELCOREOS9-21954636
- published30 Oct 2026
- disclosed28 Oct 2026
Introduced: 28 Oct 2026
NewCVE-2026-99112 (opens in a new tab)How to fix?
There is no fixed version for RHEL:8 openshift/ose-rhel-coreos-9.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openshift/ose-rhel-coreos-9 package and not the openshift/ose-rhel-coreos-9 package as distributed by RHEL.
See How to fix? for RHEL:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_flower: validate mask pointer after nla_next()
fl_set_enc_opt() iterates the key's nested tunnel-option attributes with nla_for_each_attr() while advancing a single mask pointer via nla_next() at the bottom of each loop, so the mask cursor is driven by the number of key attributes rather than by the mask's own attributes. The nla_ok() added by commit c96adff956191 ("cls_flower: call nla_ok() before nla_next()") only validates the mask pointer that was just consumed; the pointer produced by nla_next() is used by the next iteration (fl_set_geneve_opt() and siblings) without any validation.
The mask's nested attributes are validated with NL_VALIDATE_LIBERAL, which merely warns on trailing bytes that do not form a complete attribute. A mask carrying one valid attribute plus 1-3 residue bytes (or a non-aligned attribute length making msk_depth negative) therefore reaches the next iteration with msk_depth != 0, so neither the !msk_depth check in fl_set_enc_opt() nor the !depth check in the per-type helpers fires. nla_type() then reads past the mask payload and nla_parse_nested_deprecated() iterates with an nla_len taken from those bytes, reading well beyond the mask attribute (KASAN: slab-out-of-bounds read in __nla_validate_parse from fl_change()).
Validate the advanced mask pointer as well: when the mask is not legitimately exhausted (msk_depth != 0) and the new pointer fails nla_ok(), reject the filter with -EINVAL. An exactly exhausted mask still skips the check, preserving exact-match behaviour for the remaining key attributes.
References
- https://access.redhat.com/security/cve/CVE-2026-99112
- https://git.kernel.org/stable/c/45e60747a9db2307929260d9aa9c1c6cbb70ee77
- https://git.kernel.org/stable/c/bb187146c7e5c666874784e4f3fc1bc5126e6e92
- https://git.kernel.org/stable/c/fee10655709c5c597e8e9f722f3035d9ea31ff3a
- https://git.kernel.org/stable/c/35354bf67aa0f7bace66ffb614906124ed50d59d
- https://git.kernel.org/stable/c/497944d534ffb1be300365523030c7c6517cbbb6
- https://git.kernel.org/stable/c/a55d84907337580d91c0d54779d9d4b934633158
- https://git.kernel.org/stable/c/a9283d006eef7e3b56f0f279a49bb63f6e5e61df
- https://git.kernel.org/stable/c/cff9bf34afde46c238189cc6f7690b7e35225df1