Live › vulnerability › CVE-2026-98852
Go to dashboardThe Linux kernel fails to check IPv6 extension headers on the outer and inner headers of tunneled packets during checksum offload. Affected GSO packets trigger a kernel warning and are dropped, which is a denial-of-service effect; the sources do not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running an affected Linux kernel that send or forward IPv6 tunnel traffic (ip6_gre, ip6_tunnel, UDP tunnels such as SCTP-in-UDP or PSP) on devices using IPv6 checksum GSO fallback. The sources do not list affected kernel versions. Systems without IPv6 tunnels are unlikely to be exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: extend IPv6 exthdr detection of tunneled packets
Commit c4336a07eb6b ("net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback") split skb_gso_has_extension_hdr() into mutually exclusive branches on skb->encapsulation. This did not yet address all paths:
With skb->encapsulation set, the outer header is not checked. IPv6 tunnels such as ip6_gre and ip6_tunnel add an outer Destination Options header by default (encap_limit). Their GSO packets skip software GSO, then skb_csum_hwoffload_help() sees the outer extension header and calls skb_checksum_help() on the GSO skb, which warns and drops it.
Tunnels over IPv6 without an outer transport header, such as ip6_tunnel, leave skb->transport_header at the inner transport header. skb_network_header_len() then spans the outer IPv6, tunnel and inner IP headers, a false positive.
UDP tunnels without an inner network header, such as SCTP-in-UDP or PSP, have no inner IPv6 header to check. Decide on the outer header alone.
Directly dereferencing inner_ip_hdr(skb)->version without skb_header_pointer() is unsafe.
Instead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and, if set, on the inner IPv6 header. Read the headers with skb_header_pointer(). Keep the skb_network_header_len() check when !skb->encapsulation to also catch encapsulated packets without skb->encapsulation (e.g., virtio).
Use the same helper in skb_csum_hwoffload_help(). Its open coded test has the false positive of (2) and ignores the inner header.
Background: checksum offload of tunneled packets invariants:
Non-GSO skb:
GSO skb:
A NETIF_F_IPV6_CSUM device must parse through the outer headers to reach the inner ones.
This page as .md · .json · in your agent: get_signal("CVE-2026-98852")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.