{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "title": "Summary", "text": "A vulnerability (CVE-2026-98432) has been identified in the networking code of the Linux kernel used by Behnke Station and Behnke ControlCenter. When a TCP connection is established over IPv4, IP options can be freed while the kernel still accesses them (use-after-free). An attacker who can send specially crafted network packets to the device may, in the worst case, read information, corrupt memory or crash the device.\n\nAffected are Behnke Station firmware versions before 6.83 and Behnke ControlCenter versions before 1.0.498277.\n\nAn attack requires that TCP packets with IPv4 options reach the device and that a timing-dependent race condition is won. Many networks already drop such packets. If the devices are not operated directly reachable from the internet, the risk is significantly lower. An attack from the local network remains possible, however. No active exploitation is currently known." } ], "publisher": { "category": "vendor", "name": "Telefonbau Behnke GmbH", "namespace": "https://behnke.support", "contact_details": "https://security.behnke.support" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://behnke.support/.well-known/csaf/white/2026/behnke-sa-2026-0003.json" }, { "category": "external", "summary": "Advisory page", "url": "https://behnke.support/security/advisories/BEHNKE-SA-2026-0003" } ], "title": "Vulnerability in the Linux kernel of Behnke Station and Behnke ControlCenter (CVE-2026-98432)", "tracking": { "current_release_date": "2026-11-06T15:20:00+00:00", "generator": { "engine": { "name": "Behnke Compliance Engine" } }, "id": "BEHNKE-SA-2026-0003", "initial_release_date": "2026-11-04T15:16:00+00:00", "revision_history": [ { "date": "2026-11-04T15:16:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-11-05T09:00:01+00:00", "number": "2", "summary": "Initial version" }, { "date": "2026-11-06T15:20:00+00:00", "number": "3", "summary": "Initial version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "Telefonbau Behnke GmbH", "branches": [ { "category": "product_name", "name": "Behnke ControlCenter", "branches": [ { "category": "product_version", "name": "1.0.491941", "product": { "name": "Behnke ControlCenter 1.0.491941", "product_id": "behnke-control-center-1.0.491941" } }, { "category": "product_version", "name": "1.0.494577", "product": { "name": "Behnke ControlCenter 1.0.494577", "product_id": "behnke-control-center-1.0.494577" } }, { "category": "product_version", "name": "1.0.494723", "product": { "name": "Behnke ControlCenter 1.0.494723", "product_id": "behnke-control-center-1.0.494723" } }, { "category": "product_version", "name": "1.0.497435", "product": { "name": "Behnke ControlCenter 1.0.497435", "product_id": "behnke-control-center-1.0.497435" } }, { "category": "product_version", "name": "1.0.497965", "product": { "name": "Behnke ControlCenter 1.0.497965", "product_id": "behnke-control-center-1.0.497965" } }, { "category": "product_version", "name": "1.0.498277", "product": { "name": "Behnke ControlCenter 1.0.498277", "product_id": "behnke-control-center-1.0.498277" } }, { "category": "product_version", "name": "1.0.498295", "product": { "name": "Behnke ControlCenter 1.0.498295", "product_id": "behnke-control-center-1.0.498295" } } ] }, { "category": "product_name", "name": "Behnke Station", "branches": [ { "category": "product_version", "name": "2.90", "product": { "name": "Behnke Station 2.90", "product_id": "behnke-station-2.90" } }, { "category": "product_version", "name": "3.00", "product": { "name": "Behnke Station 3.00", "product_id": "behnke-station-3.00" } }, { "category": "product_version", "name": "3.63", "product": { "name": "Behnke Station 3.63", "product_id": "behnke-station-3.63" } }, { "category": "product_version", "name": "3.74", "product": { "name": "Behnke Station 3.74", "product_id": "behnke-station-3.74" } }, { "category": "product_version", "name": "4.00", "product": { "name": "Behnke Station 4.00", "product_id": "behnke-station-4.00" } }, { "category": "product_version", "name": "5.15", "product": { "name": "Behnke Station 5.15", "product_id": "behnke-station-5.15" } }, { "category": "product_version", "name": "5.26", "product": { "name": "Behnke Station 5.26", "product_id": "behnke-station-5.26" } }, { "category": "product_version", "name": "5.91", "product": { "name": "Behnke Station 5.91", "product_id": "behnke-station-5.91" } }, { "category": "product_version", "name": "6.12", "product": { "name": "Behnke Station 6.12", "product_id": "behnke-station-6.12" } }, { "category": "product_version", "name": "6.33", "product": { "name": "Behnke Station 6.33", "product_id": "behnke-station-6.33" } }, { "category": "product_version", "name": "6.56", "product": { "name": "Behnke Station 6.56", "product_id": "behnke-station-6.56" } }, { "category": "product_version", "name": "6.80", "product": { "name": "Behnke Station 6.80", "product_id": "behnke-station-6.80" } }, { "category": "product_version", "name": "6.81", "product": { "name": "Behnke Station 6.81", "product_id": "behnke-station-6.81" } }, { "category": "product_version", "name": "6.83", "product": { "name": "Behnke Station 6.83", "product_id": "behnke-station-6.83" } } ] } ] } ] }, "vulnerabilities": [ { "title": "CVE-2026-98432 – Use-after-free in the Linux kernel IPv4 TCP handshake", "ids": [ { "system_name": "Behnke vulnerability register", "text": "VUL-2026-0003" } ], "notes": [ { "category": "description", "title": "Description", "text": "In the Linux kernel, IPv4 options are handed from the request socket to the child socket during the TCP handshake without being copied, and are later freed without waiting for an RCU grace period. A retransmitted SYN can then access the already freed memory while the SYNACK is being built (use-after-free). A similar race exists when request sockets are migrated. Possible consequences are information disclosure, out-of-bounds memory writes and kernel crashes. According to the CVE record, IPv6 is not affected.\n\nKernels from version 4.4 onwards are affected unless they contain the fix. The issue is fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. The fix frees the options with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor().\n\nBehnke Station P1 (linux-qcom, DB4): affected. The last kernel CVE review on 2026-08-18 was performed against kernel 6.18.37.\nBehnke Station P2 (linux-imx, DB11): presumably affected. The kernel version is still being determined.\nBehnke ControlCenter: affected.\nBT IPs: not affected.\n\nThe affected code is part of the IPv4 TCP core (CONFIG_INET) and cannot be disabled through configuration. The issue can be reached through any open TCP service on the device, for example the web interface or SIP over TCP. The image contains no firewall rule that drops IPv4 packets with IP options.\n\nExploitation requires that TCP packets with IPv4 options reach the device and that a race condition is won. Many networks drop such packets. The products are usually not operated directly reachable from the internet, which lowers the risk. An attack from the local network remains possible. There is no indication of active exploitation, so there is no reporting obligation under Art. 14 CRA. The CVSS 3.1 rating in the CVE record (9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) overstates the risk for the deployment context.\n\nUntil the update is available, the devices should only be operated in segregated networks. IPv4 packets with IP options should also be dropped at the firewall.\n\nA kernel update to a fixed version or a backport of the fix is planned for P1 and P2 (Holo assignment 2026-11-04-kernel-cve-2026-98432-patch-p1-p2, holo-source/holo-space-holo#289). Afterwards the kernel CVE review will be updated and a security advisory with the fixed firmware version will be published. An update for the ControlCenter is also planned." } ], "product_status": { "fixed": [ "behnke-station-6.83", "behnke-control-center-1.0.498277" ], "known_affected": [ "behnke-station-6.56", "behnke-control-center-1.0.494577", "behnke-control-center-1.0.494723", "behnke-control-center-1.0.497435", "behnke-station-3.00", "behnke-station-4.00", "behnke-station-6.81", "behnke-station-3.74", "behnke-station-5.91", "behnke-control-center-1.0.497965", "behnke-station-3.63", "behnke-control-center-1.0.491941", "behnke-station-2.90", "behnke-station-5.15", "behnke-station-6.33", "behnke-station-5.26", "behnke-station-6.80", "behnke-station-6.12" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update Behnke Station to firmware version 6.83 or later and Behnke ControlCenter to version 1.0.498277 or later.\n\nIf an immediate update is not possible:\n- Operate the devices only in segregated networks that are not directly reachable from the internet.\n- Configure your firewall to drop IPv4 packets with IP options addressed to the devices.", "product_ids": [ "behnke-station-6.56", "behnke-control-center-1.0.494577", "behnke-control-center-1.0.494723", "behnke-control-center-1.0.497435", "behnke-station-3.00", "behnke-station-4.00", "behnke-station-6.81", "behnke-station-3.74", "behnke-station-5.91", "behnke-control-center-1.0.497965", "behnke-station-3.63", "behnke-control-center-1.0.491941", "behnke-station-2.90", "behnke-station-5.15", "behnke-station-6.33", "behnke-station-5.26", "behnke-station-6.80", "behnke-station-6.12" ] } ] } ] }