CVE-2026-97420: Software Security Vulnerability Vulnerability

UNKNOWN

Advisory Identifier: GHSA-xwmh-p524-56rv

Published 2026-09-24

Advisory Summary

CVE-2026-97420 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-97420 at a Glance

CVE Identifier CVE-2026-97420

GHSA Identifier GHSA-xwmh-p524-56rv

Severity N/A

CVSS v3.1 Base Score N/A

CWE Classification General Security Weakness

Affected Product Software

Package Ecosystem Maven

Published Date 2026-09-24

Last Updated 2026-10-03

How to Fix CVE-2026-97420

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-97420, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, proc_sys_call_handler() guarantees that the buffer passed to proc handlers is NUL-terminated. If bpf_sysctl_set_new_value() replaces the pending sysctl value, it can hand a replacement buffer directly to proc handlers. However, the helper currently copies only buf_len bytes into that buffer without appending a NUL terminator, leaving downstream parsers vulnerable to out-of-bounds access. Fix this by appending a '\0' after the replaced value to restore the expected sysctl semantics. Since the helper already rejects buf_len greater than PAGE_SIZE - 1, there is always room for the extra byte. Reproduced in a QEMU x86_64 guest booted with KASAN while exercising the sysctl replacement path with a cgroup/sysctl BPF program. The reproducer targets `/proc/sys/net/core/flow_limit_cpu_bitmap`, fills the original user write buffer with non-zero bytes, and overrides the sysctl value so the replacement buffer lacks a terminating NUL. Under that setup, the pre-fix kernel reported: BUG: KASAN: slab-out-of-bounds in strnchrnul+0x72/0x90 Read of size 1 at addr ffff88800de57000 by task repro_patch3/66 CPU: 0 UID: 0 PID: 66 Comm: repro_patch3 Not tainted 7.1.0-rc3-00269-g8370ca1f87cc #6 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcb/0x5e0 ? __virt_addr_valid+0x21d/0x3f0 ? strnchrnul+0x72/0x90 ? strnchrnul+0x72/0x90 kasan_report+0xca/0x100 ? strnchrnul+0x72/0x90 strnchrnul+0x72/0x90 bitmap_parse+0x37/0x2e0 flow_limit_cpu_sysctl+0xc6/0x840 ? __pfx_flow_limit_cpu_sysctl+0x10/0x10 ? __kvmalloc_node_noprof+0x5ba/0x870 proc_sys_call_handler+0x31d/0x480 ? __pfx_proc_sys_call_handler+0x10/0x10 ? selinux_file_permission+0x39f/0x500 ? lock_is_held_type+0x9e/0x120 vfs_write+0x98e/0x1000 ... </TASK> The buggy address is located 0 bytes to the right of allocated 4096-byte region [ffff88800de56000, ffff88800de57000) With this fix applied, rerunning the same sysctl-targeted path yields no corresponding KASAN reports.

References

NVD — CVE-2026-97420 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-97420

git.kernel.org/stable/c/31377675c3... WEB

https://git.kernel.org/stable/c/31377675c3d75603d957c08e338a9ac27e9f6cd5

git.kernel.org/stable/c/36d3e9f62d... WEB

https://git.kernel.org/stable/c/36d3e9f62dc2beb9299d3bb6f589cb9e07f773fe

git.kernel.org/stable/c/3b2814dd84... WEB

https://git.kernel.org/stable/c/3b2814dd842a565fcf9cc370156e1ba9eae16239

git.kernel.org/stable/c/76c14b10f5... WEB

https://git.kernel.org/stable/c/76c14b10f50eb0afcc76e244562fa2d8c661e224

git.kernel.org/stable/c/a66e3b5bac... WEB

https://git.kernel.org/stable/c/a66e3b5bacf38d6ab29fa05a9754f7a114485605

git.kernel.org/stable/c/bfcee1f79a... WEB

https://git.kernel.org/stable/c/bfcee1f79aaefa90679ad47690107fb7682724ec

git.kernel.org/stable/c/c73e4a04ee... WEB

https://git.kernel.org/stable/c/c73e4a04eedc677fe91a736d7a5db45100adba5e

Frequently Asked Questions

What is CVE-2026-97420?

CVE-2026-97420 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.

Which Software versions are affected?

Affected versions include releases prior to current release patches.

What version fixes CVE-2026-97420?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

What CWE is associated with CVE-2026-97420?

CVE-2026-97420 is classified under General Security Weakness.

How can I check Maven dependencies for CVE-2026-97420?

Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xwmh-p524-56rv",
  "modified" : "2026-10-03T12:31:12Z",
  "published" : "2026-09-24T18:31:32Z",
  "aliases" : [ "CVE-2026-97420" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: NUL-terminate replaced sysctl value\n\nWhen writing to sysctls, proc_sys_call_handler() guarantees that the\nbuffer passed to proc handlers is NUL-terminated. If\nbpf_sysctl_set_new_value() replaces the pending sysctl value, it can\nhand a replacement buffer directly to proc handlers. However, the\nhelper currently copies only buf_len bytes into that buffer without\nappending a NUL terminator, leaving downstream parsers vulnerable to\nout-of-bounds access.\n\nFix this by appending a '\\0' after the replaced value to restore the\nexpected sysctl semantics. Since the helper already rejects buf_len\ngreater than PAGE_SIZE - 1, there is always room for the extra byte.\n\nReproduced in a QEMU x86_64 guest booted with KASAN while exercising\nthe sysctl replacement path with a cgroup/sysctl BPF program. The\nreproducer targets `/proc/sys/net/core/flow_limit_cpu_bitmap`, fills\nthe original user write buffer with non-zero bytes, and overrides the\nsysctl value so the replacement buffer lacks a terminating NUL. Under\nthat setup, the pre-fix kernel reported:\n\n  BUG: KASAN: slab-out-of-bounds in strnchrnul+0x72/0x90\n  Read of size 1 at addr ffff88800de57000 by task repro_patch3/66\n  CPU: 0 UID: 0 PID: 66 Comm: repro_patch3 Not tainted 7.1.0-rc3-00269-g8370ca1f87cc #6 PREEMPT(lazy)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x68/0xa0\n   print_report+0xcb/0x5e0\n   ? __virt_addr_valid+0x21d/0x3f0\n   ? strnchrnul+0x72/0x90\n   ? strnchrnul+0x72/0x90\n   kasan_report+0xca/0x100\n   ? strnchrnul+0x72/0x90\n   strnchrnul+0x72/0x90\n   bitmap_parse+0x37/0x2e0\n   flow_limit_cpu_sysctl+0xc6/0x840\n   ? __pfx_flow_limit_cpu_sysctl+0x10/0x10\n   ? __kvmalloc_node_noprof+0x5ba/0x870\n   proc_sys_call_handler+0x31d/0x480\n   ? __pfx_proc_sys_call_handler+0x10/0x10\n   ? selinux_file_permission+0x39f/0x500\n   ? lock_is_held_type+0x9e/0x120\n   vfs_write+0x98e/0x1000\n   ...\n   </TASK>\n  The buggy address is located 0 bytes to the right of\n  allocated 4096-byte region [ffff88800de56000, ffff88800de57000)\nWith this fix applied, rerunning the same sysctl-targeted path yields\nno corresponding KASAN reports.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-97420"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/31377675c3d75603d957c08e338a9ac27e9f6cd5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/36d3e9f62dc2beb9299d3bb6f589cb9e07f773fe"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3b2814dd842a565fcf9cc370156e1ba9eae16239"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/76c14b10f50eb0afcc76e244562fa2d8c661e224"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a66e3b5bacf38d6ab29fa05a9754f7a114485605"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bfcee1f79aaefa90679ad47690107fb7682724ec"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c73e4a04eedc677fe91a736d7a5db45100adba5e"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-24T17:17:19Z"
  }
}

Advisory Metadata

Source ID: GHSA-xwmh-p524-56rv
Schema Version: 1.4.0
Published: 2026-09-24 18:31
Last Modified: 2026-10-03 12:31
Database Record File: advisories/unreviewed/2026/09/GHSA-xwmh-p524-56rv/GHSA-xwmh-p524-56rv.json