{"id":"CVE-2026-98573","kind":"vulnerability","aliases":["CVE-2026-98573"],"related":[],"title":"Linux kernel: IPv6 extension header parsing can underflow a copy length","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\n\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int.  The\nfunction does not ensure that max is at least skb_headlen(skb).\n\nThis can happen while parsing IPv6 extension headers when an skb already\nhas a linear area larger than MAX_IPV6_HDR_LEN.  Once the parser needs data\nbeyond the linear area, max - skb_headlen(skb) wraps and is converted to a\nnegative delta.  __pskb_pull_tail() then passes that negative length to\nskb_copy_bits(), where it can become a very large copy length.\n\nPass the requested length itself as the pull bound at the three\nextension-header call sites, so the delta can no longer go negative.","summary":"In skb_checksum_setup_ipv6() the kernel computes a negative pull length when parsing IPv6 extension headers on a packet whose linear area is already large. The negative value becomes a very large copy, which can corrupt memory or crash the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipv6","linux-kernel","networking","runtime","self-hosted"],"not_affected_if":["patched-kernel"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the NVD record (unknown from the sources)\n- Check whether the running kernel includes the commit that passes the requested length as the pull bound in skb_checksum_setup_ipv6() (unknown from the sources)","fix":"- Update the Linux kernel to a release that includes the upstream fix for skb_checksum_setup_ipv6() (exact version unknown from the sources)\n- Reboot into the patched kernel and confirm with `uname -r`","status":"open","published_at":"2026-10-18T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:10+00:00","updated_at":"2026-10-25T05:23:10+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:23:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for skb_checksum_setup_ipv6() (exact version unknown from the sources)\n- Reboot into the patched kernel and confirm with `uname -r`","reach":"network","title":"Linux kernel: IPv6 extension header parsing can underflow a copy length","impact":"high","summary":"In skb_checksum_setup_ipv6() the kernel computes a negative pull length when parsing IPv6 extension headers on a packet whose linear area is already large. The negative value becomes a very large copy, which can corrupt memory or crash the kernel.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted","networking","ipv6"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption or crash from a bad copy length","analyst_note":"Find the affected and fixed kernel version ranges and the reachable input path in the NVD record and the upstream kernel commit.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the NVD record (unknown from the sources)\n- Check whether the running kernel includes the commit that passes the requested length as the pull bound in skb_checksum_setup_ipv6() (unknown from the sources)","needs_analyst":true,"not_affected_if":["patched-kernel"],"who_is_affected":"Hosts running a Linux kernel with the unfixed skb_checksum_setup_ipv6() code, where IPv6 traffic with extension headers reaches the checksum setup path (for example through virtio or tunnel paths that call it). Systems on distribution kernels with backported fixes may already be patched; unknown from the sources which versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000672,"input_tokens":3530,"output_tokens":637,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98573':14A,17A 'alreadi':51B,140C 'area':49B,144C,159C 'argument':103C 'becom':56B,187C 'beyond':156C 'bit':183C 'bound':84C,201C 'call':208C 'checksum':29B,88C 'comput':34B 'convert':167C 'copi':10A,60B,182C,191C 'corrupt':63B 'crash':66B 'cve':12A,15A 'data':155C 'delta':171C,212C 'ensur':120C 'extens':4A,42B,135C,206C 'extension-head':205C 'fix':81C 'follow':74C 'function':117C 'go':216C 'happen':131C 'hdr':149C 'header':5A,43B,136C,207C 'headlen':97C,127C,162C 'host':26B 'int':115C 'ipv6':3A,18B,31B,41B,90C,134C,148C 'kernel':2A,21B,33B,68B,72C 'larg':52B,59B,190C 'larger':145C 'least':125C 'len':150C 'length':11A,38B,179C,192C,196C 'linear':48B,143C,158C 'linux':1A,20B,71C 'linux-kernel':19B 'longer':215C 'max':102C,122C,147C,160C 'mayb':92C 'memori':64B 'need':154C 'negat':36B,54B,170C,178C,217C 'net':79C 'network':22B 'packet':46B 'pars':6A,40B,133C 'parser':153C 'pass':105C,176C,193C 'pskb':109C,172C 'pull':37B,83C,93C,110C,173C,200C 'pull-bound':82C 'request':195C 'resolv':78C 'result':107C 'runtim':23B 'self':25B 'self-host':24B 'setup':30B,89C 'sign':114C 'site':209C 'skb':28B,87C,91C,96C,98C,126C,128C,139C,161C,163C,181C 'skbuff':80C 'subtract':95C 'tail':94C,111C,174C 'three':204C 'underflow':8A,85C 'unsign':101C 'valu':55B 'vulner':75C 'whose':47B 'wrap':164C","nicknames":[],"mitigations":[],"who_affected":"Hosts running a Linux kernel with the unfixed skb_checksum_setup_ipv6() code, where IPv6 traffic with extension headers reaches the checksum setup path (for example through virtio or tunnel paths that call it). Systems on distribution kernels with backported fixes may already be patched; unknown from the sources which versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98573","severity":null,"published_at":"2026-10-18T16:17:09+00:00","modified_at":"2026-10-19T10:19:15+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}