{"id":"CVE-2026-98570","kind":"vulnerability","aliases":["CVE-2026-98570"],"related":[],"title":"Linux kernel IPv6 tunnels: out-of-bounds write when forwarding through VLAN","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: keep room for the mac header in dst_dev_overhead()\n\nThe seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as\nthe length they are about to push plus dst_dev_overhead(), then push the\nnew headers and rebuild the mac header below them with\nskb_mac_header_rebuild().  That rebuild needs skb->mac_len of headroom,\nbut dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device,\n16 bytes for plain Ethernet.\n\nWhere the mac header is longer than that, as it is on ingress through a\nVLAN device with reorder_hdr off, the rebuild runs out of room:\nskb_set_mac_header(skb, -skb->mac_len) computes a negative offset,\nstores it unchecked in the u16 skb->mac_header, and the memmove that\nfollows writes skb->mac_len bytes about 64 KB past skb->head.\nForwarding plain ping6 traffic through such a device reproduces it on\nall five seg6 encapsulation modes and on the rpl and ioam6 inline paths;\nskb->mac_header comes back as 65534 on a 704-byte head.\n\nReturn the larger of the two.  The helper already returns skb->mac_len\nwhen it has no dst, so this only makes the other branch agree, and it\ncovers every caller rather than each call site in turn.","summary":"In the Linux kernel, the seg6, ioam6 and rpl lightweight tunnels can write about 64 KB past a packet buffer when traffic is forwarded through a VLAN device with reorder_hdr off. The memory corruption can crash the kernel or potentially be used for code execution.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipv6","linux-kernel","other","routers","segment-routing","vlan"],"not_affected_if":["no-seg6-ioam6-rpl","no-vlan-forwarding"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit fixing dst_dev_overhead() in net/ipv6, as the sources do not name a version","status":"open","published_at":"2026-10-18T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:14+00:00","updated_at":"2026-10-25T05:23:14+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:23:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit fixing dst_dev_overhead() in net/ipv6, as the sources do not name a version","reach":"network","title":"Linux kernel IPv6 tunnels: out-of-bounds write when forwarding through VLAN","impact":"high","summary":"In the Linux kernel, the seg6, ioam6 and rpl lightweight tunnels can write about 64 KB past a packet buffer when traffic is forwarded through a VLAN device with reorder_hdr off. The memory corruption can crash the kernel or potentially be used for code execution.","category":"other","nicknames":[],"who_cares":["linux-kernel","routers","ipv6","vlan","segment-routing"],"confidence":0.6,"needs_auth":"no","worst_case":"kernel memory corruption, possible crash or code execution","analyst_note":"Sources give no severity, affected kernel versions or fixed version; check the NVD entry and the kernel stable commit for the fixed release.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-seg6-ioam6-rpl","no-vlan-forwarding"],"who_is_affected":"Hosts running the Linux kernel that use IPv6 segment routing (seg6), ioam6 or RPL lightweight tunnels and forward traffic through VLAN devices with reorder_hdr disabled. Systems without these encapsulation features enabled, or without VLAN forwarding on this path, are not reached by the reported trigger.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3694,"output_tokens":562,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98570':16A,19A '16':159C '64':44B,223C '65534':258C '704':261C 'agre':289C 'alreadi':272C 'back':256C 'bound':8A 'branch':288C 'buffer':49B 'byte':160C,221C,262C 'call':298C 'caller':294C 'code':74B 'come':255C 'comput':199C 'corrupt':64B 'cover':292C 'cow':107C 'crash':66B 'cve':14A,17A 'dev':96C,120C,149C 'devic':57B,158C,180C,235C 'dst':95C,119C,148C,281C 'egress':157C 'encapsul':242C 'ethernet':163C 'everi':293C 'execut':75B 'five':240C 'follow':81C,216C 'forward':11A,53B,228C 'hdr':60B,183C 'head':108C,227C,263C 'header':93C,126C,131C,137C,167C,194C,211C,254C 'headroom':146C 'helper':271C 'ingress':176C 'inlin':250C 'ioam6':36B,100C,249C 'ipv6':3A,20B,87C 'kb':45B,224C 'keep':88C 'kernel':2A,23B,33B,68B,79C 'larger':266C 'leav':151C 'len':144C,198C,220C,276C 'length':112C 'lightweight':39B 'linux':1A,22B,32B,78C 'linux-kernel':21B 'll':152C 'longer':169C 'lwtunnel':103C 'mac':92C,130C,136C,143C,166C,193C,197C,210C,219C,253C,275C 'make':285C 'memmov':214C 'memori':63B 'mode':243C 'need':141C 'negat':201C 'net':86C 'new':125C 'offset':202C 'out-of-bound':5A 'overhead':97C,121C,150C 'packet':48B 'past':46B,225C 'path':251C 'ping6':230C 'plain':162C,229C 'plus':118C 'potenti':70B 'push':117C,123C 'rather':295C 'rebuild':128C,138C,140C,186C 'reorder':59B,182C 'reproduc':236C 'request':109C 'reserv':153C 'resolv':85C 'return':264C,273C 'room':89C,190C 'rout':28B 'router':25B 'rpl':38B,102C,247C 'run':187C 'seg6':35B,99C,241C 'segment':27B 'segment-rout':26B 'set':192C 'site':299C 'size':104C 'skb':106C,135C,142C,191C,195C,196C,209C,218C,226C,252C,274C 'space':154C 'store':203C 'traffic':51B,231C 'tunnel':4A,40B 'turn':301C 'two':269C 'u16':208C 'uncheck':205C 'use':72B 'vlan':13A,29B,56B,179C 'vulner':82C 'write':9A,42B,217C","nicknames":[],"mitigations":[],"who_affected":"Hosts running the Linux kernel that use IPv6 segment routing (seg6), ioam6 or RPL lightweight tunnels and forward traffic through VLAN devices with reorder_hdr disabled. Systems without these encapsulation features enabled, or without VLAN forwarding on this path, are not reached by the reported trigger.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98570","severity":null,"published_at":"2026-10-18T16:17:09+00:00","modified_at":"2026-10-19T10:19:15+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}