{"id":"CVE-2026-98621","kind":"vulnerability","aliases":["CVE-2026-98621"],"related":[],"title":"Linux kernel: GUE REMCSUM offsets can write past a buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gue: reject invalid REMCSUM offsets\n\nThe REMCSUM option carries an absolute checksum start and checksum field\noffset. gue_remcsum() passes them to skb_remcsum_process(), whose\npartial path stores offset - start in the u16 skb->csum_offset variable.\nIf offset is less than start, this underflows.\n\nA forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM\ndriver which trusts the metadata, leading skb_copy_and_csum_dev() to write\ntwo bytes about 64 KiB beyond the destination buffer.\n\nReject reversed tuples in validate_gue_flags(), after the existing length\nvalidation, so all GUE parsers enforce the ordering in one place.","summary":"The Linux kernel's GUE tunnel parser accepted REMCSUM option offsets in reversed order, which underflows a 16-bit checksum offset. A forwarded packet can then make a hardware checksum driver write two bytes about 64 KiB past its destination buffer.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gue-tunnels","kernel","linux","networking","package"],"not_affected_if":["default-config","no-gue-tunnels"],"how_to_check":"- Run `uname -r` and compare with the first fixed kernel in your distribution's advisory\n- Check whether GUE tunnels (Foo-over-UDP with the REMCSUM option) are configured with `ip link show type gue`","fix":"- Update the kernel to a release that includes the upstream fix (\"reject invalid REMCSUM offsets\"), using the version your distribution publishes\n- Reboot into the patched kernel","status":"open","published_at":"2026-10-18T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:15+00:00","updated_at":"2026-10-25T05:21:15+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:21:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update the kernel to a release that includes the upstream fix (\"reject invalid REMCSUM offsets\"), using the version your distribution publishes\n- Reboot into the patched kernel","reach":"network","title":"Linux kernel: GUE REMCSUM offsets can write past a buffer","impact":"high","summary":"The Linux kernel's GUE tunnel parser accepted REMCSUM option offsets in reversed order, which underflows a 16-bit checksum offset. A forwarded packet can then make a hardware checksum driver write two bytes about 64 KiB past its destination buffer.","category":"package","nicknames":[],"who_cares":["linux","kernel","networking","gue-tunnels"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption from a crafted packet, possibly code execution","analyst_note":"Find the fixed kernel versions per stable branch and whether the write is reachable without a GUE tunnel configured, using the upstream commit and the NVD entry.","how_to_check":"- Run `uname -r` and compare with the first fixed kernel in your distribution's advisory\n- Check whether GUE tunnels (Foo-over-UDP with the REMCSUM option) are configured with `ip link show type gue`","needs_analyst":true,"not_affected_if":["no-gue-tunnels","default-config"],"who_is_affected":"Hosts and routers that terminate or forward GUE (Generic UDP Encapsulation) traffic with the REMCSUM option on a Linux kernel carrying the unpatched code. Systems that do not use GUE tunnels are unlikely to process such packets. unknown whether the sources list affected kernel version ranges.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":3494,"output_tokens":627,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98621':13A,16A '16':41B '64':59B,152C 'absolut':86C 'accept':31B 'beyond':154C 'bit':42B 'buffer':10A,64B,157C 'byte':57B,150C 'carri':84C 'checksum':43B,53B,87C,90C,127C 'copi':143C 'csum':111C,135C,145C 'cve':11A,14A 'destin':63B,156C 'dev':146C 'driver':54B,136C 'enforc':174C 'exist':167C 'f':133C 'field':91C 'flag':164C 'follow':70C 'forward':46B,123C 'gue':3A,18B,28B,76C,93C,163C,172C 'gue-tunnel':17B 'hardwar':52B 'hw':134C 'invalid':78C 'kernel':2A,20B,26B,68C 'kib':60B,153C 'lead':141C 'length':168C 'less':117C 'linux':1A,21B,25B,67C 'make':50B 'metadata':140C 'net':75C 'netif':132C 'network':22B 'offset':5A,34B,44B,80C,92C,105C,112C,115C 'one':178C 'option':33B,83C 'order':37B,176C 'packag':23B 'packet':47B,124C 'parser':30B,173C 'partial':102C,128C 'pass':95C 'past':8A,61B 'path':103C 'place':179C 'process':100C 'reach':130C 'reject':77C,158C 'remcsum':4A,32B,79C,82C,94C,99C 'resolv':74C 'retain':126C 'revers':36B,159C 'skb':98C,110C,142C 'start':88C,106C,119C 'store':104C 'trust':138C 'tunnel':19B,29B 'tupl':160C 'two':56B,149C 'u16':109C 'underflow':39B,121C 'valid':162C,169C 'variabl':113C 'vulner':71C 'whose':101C 'write':7A,55B,148C","nicknames":[],"mitigations":[],"who_affected":"Hosts and routers that terminate or forward GUE (Generic UDP Encapsulation) traffic with the REMCSUM option on a Linux kernel carrying the unpatched code. Systems that do not use GUE tunnels are unlikely to process such packets. unknown whether the sources list affected kernel version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98621","severity":null,"published_at":"2026-10-18T16:17:14+00:00","modified_at":"2026-10-19T10:19:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}