CVE-2018-14641

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-09-18 · updated 2026-06-17
Weakness: CWE-456

Description

A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service.

Affected products

Linux kernel: 4.19-rc1, 4.19-rc2, 4.19-rc3

References

https://access.redhat.com/errata/RHSA-2018:2948
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14641
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d407b071dc369c26a38398326ee2be53651cfe4
https://seclists.org/oss-sec/2018/q3/248
https://access.redhat.com/errata/RHSA-2018:2948
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14641
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d407b071dc369c26a38398326ee2be53651cfe4
https://seclists.org/oss-sec/2018/q3/248

Get alerted when CVE-2018-14641 or the next vulnerability affects your stack