Live › vulnerability › CVE-2026-98573
Go to dashboardIn skb_checksum_setup_ipv6() the kernel computes a negative pull length when parsing IPv6 extension headers on a packet whose linear area is already large. The negative value becomes a very large copy, which can corrupt memory or crash the kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running a Linux kernel with the unfixed skb_checksum_setup_ipv6() code, where IPv6 traffic with extension headers reaches the checksum setup path (for example through virtio or tunnel paths that call it). Systems on distribution kernels with backported fixes may already be patched; unknown from the sources which versions are affected.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds listed in the NVD record (unknown from the sources)uname -rEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
skb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max argument and passes the result to __pskb_pull_tail() as a signed int. The function does not ensure that max is at least skb_headlen(skb).
This can happen while parsing IPv6 extension headers when an skb already has a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data beyond the linear area, max - skb_headlen(skb) wraps and is converted to a negative delta. __pskb_pull_tail() then passes that negative length to skb_copy_bits(), where it can become a very large copy length.
Pass the requested length itself as the pull bound at the three extension-header call sites, so the delta can no longer go negative.
This page as .md · .json · in your agent: get_signal("CVE-2026-98573")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.