{"id":"CVE-2026-98532","kind":"vulnerability","aliases":["CVE-2026-98532"],"related":[],"title":"Linux kernel IPv6: out-of-bounds read and write from malformed extension headers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not let ipv6_find_hdr() return an offset past the packet end\n\nipv6_find_hdr() walks the extension header chain, skipping each header by\nthe length that header itself declares.  ipv6_optlen() returns up to 2048,\nand the skip is never checked against skb->len, so the offset stored in\n*offset can point past the end of the packet.\n\nopenvswitch installs that offset as the transport header, and\nupdate_ipv6_checksum() then reads and writes the transport checksum field\nout of bounds:\n\n  BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470\n  Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629\n  CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348\n  Call Trace:\n   inet_proto_csum_replace16+0x445/0x470\n   set_ipv6_addr+0x3dd/0x460\n   do_execute_actions+0x6a3d/0x7c40\n   ovs_execute_actions+0xfd/0x480\n   ovs_packet_cmd_execute+0xc38/0xf20\n   genl_rcv_msg+0x59e/0x870\n   netlink_rcv_skb+0x18b/0x450\n   genl_rcv+0x2d/0x40\n   netlink_unicast+0x6bc/0xa20\n\n  The buggy address belongs to the object at ffff88810b754980\n   which belongs to the cache skbuff_small_head of size 704\n  The buggy address is located 390 bytes inside of\n   freed 704-byte region [ffff88810b754980, ffff88810b754c40)\n\nOther callers use that offset too, so bound it here rather than in one\ncaller.\n\nReject a header whose declared length does not fit in the packet.\nipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this\nadds no new failure mode.","summary":"The IPv6 extension header walker in the Linux kernel could return an offset past the end of a packet when a header declared a length larger than the packet. Open vSwitch then used that offset to read and write the transport checksum out of bounds, which can corrupt kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipv6","kubernetes","linux-kernel","openvswitch","package","self-hosted"],"not_affected_if":["openvswitch-not-loaded"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed by your distribution's security tracker for CVE-2026-98532\n- Check whether the openvswitch module is loaded with `lsmod | grep openvswitch`","fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98532 (exact version unknown from these sources)\n- Reboot after the kernel update so the fixed code is running","status":"open","published_at":"2026-10-18T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:52+00:00","updated_at":"2026-10-25T05:23:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:23:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98532 (exact version unknown from these sources)\n- Reboot after the kernel update so the fixed code is running","reach":"network","title":"Linux kernel IPv6: out-of-bounds read and write from malformed extension headers","impact":"high","summary":"The IPv6 extension header walker in the Linux kernel could return an offset past the end of a packet when a header declared a length larger than the packet. Open vSwitch then used that offset to read and write the transport checksum out of bounds, which can corrupt kernel memory.","category":"package","nicknames":[],"who_cares":["linux-kernel","openvswitch","ipv6","self-hosted","kubernetes"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory read and written out of bounds, possibly causing crash or escalation","analyst_note":"Find the affected kernel version range and fixed stable commit in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-98532) and distribution trackers.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed by your distribution's security tracker for CVE-2026-98532\n- Check whether the openvswitch module is loaded with `lsmod | grep openvswitch`","needs_analyst":true,"not_affected_if":["openvswitch-not-loaded"],"who_is_affected":"Systems running a Linux kernel with IPv6 extension header handling and Open vSwitch in the datapath, where IPv6 traffic with crafted extension headers reaches OVS actions that rewrite IPv6 addresses. Hosts that do not load openvswitch and do not use IPv6 extension header paths in the affected code are less exposed. The sources do not state which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":3919,"output_tokens":673,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':187C,223C,228C,233C,238C,244C,249C,254C,258C,262C '-2026':16A,19A '-98532':17A,20A '1000':204C '2':192C '2048':128C '348':216C '390':289C '4':202C '629':206C '7.3.0':214C '704':283C,294C 'action':232C,237C 'add':339C 'addr':194C,227C 'address':266C,286C 'alreadi':329C 'belong':267C,274C 'bound':7A,75B,174C,306C 'bug':175C 'buggi':265C,285C 'byte':290C,295C 'cach':277C 'call':217C 'caller':300C,313C 'chain':112C,336C 'check':134C 'checksum':72B,163C,170C 'cmd':242C 'comm':207C 'corrupt':78B 'could':40B 'cpu':201C 'csum':185C,221C 'cve':15A,18A 'declar':53B,122C,318C 'ebadmsg':332C 'end':46B,104C,148C 'execut':231C,236C,243C 'extens':13A,33B,110C 'fail':330C 'failur':342C 'ffff88810b754980':272C,297C 'ffff88810b754b06':195C 'ffff88810b754c40':298C 'field':171C 'find':96C,106C,327C 'fit':322C 'follow':86C 'free':181C 'freed':293C 'g':212C 'genl':246C,256C 'hdr':97C,107C,328C 'head':280C 'header':14A,34B,52B,111C,115C,120C,159C,316C 'host':30B 'inet':183C,219C 'insid':291C 'instal':153C 'ipv6':3A,21B,32B,91C,95C,105C,123C,162C,199C,209C,226C,326C 'kasan':176C 'kernel':2A,25B,39B,79B,84C 'kubernet':22B 'larger':56B 'len':137C 'length':55B,118C,319C 'let':94C 'linux':1A,24B,38B,83C 'linux-kernel':23B 'locat':288C 'malform':12A,335C 'memori':80B 'mode':343C 'msg':248C 'n':213C 'netlink':251C,260C 'never':133C 'new':341C 'object':270C 'offset':43B,65B,100C,140C,143C,155C,303C 'one':312C 'oob':210C 'oob/629':200C 'open':60B 'openvswitch':26B,152C 'optlen':124C 'out-of-bound':4A 'ov':198C,208C,235C,240C 'packag':27B 'packet':49B,59B,103C,151C,241C,325C 'past':44B,101C,146C 'pid':205C 'point':145C 'proto':184C,220C 'rather':309C 'rc3':215C 'rcv':247C,252C,257C 'read':8A,67B,165C,189C 'region':296C 'reject':314C 'replace16':186C,222C 'resolv':90C 'return':41B,98C,125C 'self':29B 'self-host':28B 'set':225C 'size':191C,282C 'skb':136C,253C 'skbuff':278C 'skip':113C,131C 'slab':178C 'slab-use-after-fre':177C 'small':279C 'store':141C 'taint':211C 'task':197C 'trace':218C 'transport':71B,158C,169C 'uid':203C 'unicast':261C 'updat':161C 'use':63B,179C,301C 'vswitch':61B 'vulner':87C 'walk':108C 'walker':35B 'whose':317C 'write':10A,69B,167C 'x18b/0x450':255C 'x2d/0x40':259C 'x3dd/0x460':229C 'x445/0x470':188C,224C 'x59e/0x870':250C 'x6a3d/0x7c40':234C 'x6bc/0xa20':263C 'xc38/0xf20':245C 'xfd/0x480':239C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with IPv6 extension header handling and Open vSwitch in the datapath, where IPv6 traffic with crafted extension headers reaches OVS actions that rewrite IPv6 addresses. Hosts that do not load openvswitch and do not use IPv6 extension header paths in the affected code are less exposed. The sources do not state which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98532","severity":null,"published_at":"2026-10-18T16:17:04+00:00","modified_at":"2026-10-19T10:19:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}