{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97420 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97420 is a memory corruption vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97420 and fix it if it is affected.\n\nWhat it is: CVE-2026-97420 is a memory corruption vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97420 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97420/ (Markdown: https://insights.sbomify.com/CVE-2026-97420/index.md)","id":"CVE-2026-97420","markdown":"https://insights.sbomify.com/CVE-2026-97420/index.md","name":"CVE-2026-97420","record":{"aliases":["AZL-103875","BELL-CVE-2026-97420","DEBIAN-CVE-2026-97420","GHSA-xwmh-p524-56rv","UBUNTU-CVE-2026-97420"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"high_privilege","summary":"A missing NUL terminator in BPF sysctl replacement allows out-of-bounds reads, potentially causing kernel crashes or information leaks for privileged local attackers.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: NUL-terminate replaced sysctl value\n\nWhen writing to sysctls, proc_sys_call_handler() guarantees that the\nbuffer passed to proc handlers is NUL-terminated. If\nbpf_sysctl_set_new_value() replaces the pending sysctl value, it can\nhand a replacement buffer directly to proc handlers. However, the\nhelper currently copies only buf_len bytes into that buffer without\nappending a NUL terminator, leaving downstream parsers vulnerable to\nout-of-bounds access.\n\nFix this by appending a '\\0' after the replaced value to restore the\nexpected sysctl semantics. Since the helper already rejects buf_len\ngreater than PAGE_SIZE - 1, there is always room for the extra byte.\n\nReproduced in a QEMU x86_64 guest booted with KASAN while exercising\nthe sysctl replacement path with a cgroup/sysctl BPF program. The\nreproducer targets `/proc/sys/net/core/flow_limit_cpu_bitmap`, fills\nthe original user write buffer with non-zero bytes, and overrides the\nsysctl value so the replacement buffer lacks a terminating NUL. Under\nthat setup, the pre-fix kernel reported:\n\n  BUG: KASAN: slab-out-of-bounds in strnchrnul+0x72/0x90\n  Read of size 1 at addr ffff88800de57000 by task repro_patch3/66\n  CPU: 0 UID: 0 PID: 66 Comm: repro_patch3 Not tainted 7.1.0-rc3-00269-g8370ca1f87cc #6 PREEMPT(lazy)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x68/0xa0\n   print_report+0xcb/0x5e0\n   ? __virt_addr_valid+0x21d/0x3f0\n   ? strnchrnul+0x72/0x90\n   ? strnchrnul+0x72/0x90\n   kasan_report+0xca/0x100\n   ? strnchrnul+0x72/0x90\n   strnchrnul+0x72/0x90\n   bitmap_parse+0x37/0x2e0\n   flow_limit_cpu_sysctl+0xc6/0x840\n   ? __pfx_flow_limit_cpu_sysctl+0x10/0x10\n   ? __kvmalloc_node_noprof+0x5ba/0x870\n   proc_sys_call_handler+0x31d/0x480\n   ? __pfx_proc_sys_call_handler+0x10/0x10\n   ? selinux_file_permission+0x39f/0x500\n   ? lock_is_held_type+0x9e/0x120\n   vfs_write+0x98e/0x1000\n   ...\n   \u003c/TASK\u003e\n  The buggy address is located 0 bytes to the right of\n  allocated 4096-byte region [ffff88800de56000, ffff88800de57000)\nWith this fix applied, rerunning the same sysctl-targeted path yields\nno corresponding KASAN reports.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bpf: NUL-terminate replaced sysctl value","id":"CVE-2026-97420","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()","id":"CVE-2026-97421"},"packages":[],"prev":{"headline":"hsr: broadcast netlink notifications in the device's net namespace","id":"CVE-2026-97419"},"products":["Linux"],"published":"2026-09-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-03","vendors":["Linux"]},"summary":"A missing NUL terminator in BPF sysctl replacement allows out-of-bounds reads, potentially causing kernel crashes or information leaks for privileged local attackers.","url":"https://insights.sbomify.com/CVE-2026-97420/"}