{"id":"CVE-2026-98852","kind":"vulnerability","aliases":["CVE-2026-98852"],"related":[],"title":"Linux kernel: IPv6 tunneled packets with extension headers dropped by checksum path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: extend IPv6 exthdr detection of tunneled packets\n\nCommit c4336a07eb6b (\"net: correctly handle tunneled traffic on IPV6_CSUM\nGSO fallback\") split skb_gso_has_extension_hdr() into mutually exclusive\nbranches on skb->encapsulation. This did not yet address all paths:\n\n1. With skb->encapsulation set, the outer header is not checked. IPv6\n   tunnels such as ip6_gre and ip6_tunnel add an outer Destination\n   Options header by default (encap_limit). Their GSO packets skip\n   software GSO, then skb_csum_hwoffload_help() sees the outer extension\n   header and calls skb_checksum_help() on the GSO skb, which warns and\n   drops it.\n\n2. Tunnels over IPv6 without an outer transport header, such as\n   ip6_tunnel, leave skb->transport_header at the inner transport\n   header. skb_network_header_len() then spans the outer IPv6, tunnel\n   and inner IP headers, a false positive.\n\n3. UDP tunnels without an inner network header, such as SCTP-in-UDP or\n   PSP, have no inner IPv6 header to check. Decide on the outer header\n   alone.\n\n4. Directly dereferencing inner_ip_hdr(skb)->version without\n   skb_header_pointer() is unsafe.\n\nInstead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and, if\nset, on the inner IPv6 header. Read the headers with skb_header_pointer().\nKeep the skb_network_header_len() check when !skb->encapsulation to also\ncatch encapsulated packets without skb->encapsulation (e.g., virtio).\n\nUse the same helper in skb_csum_hwoffload_help(). Its open coded test\nhas the false positive of (2) and ignores the inner header.\n\nBackground: checksum offload of tunneled packets invariants:\n\nNon-GSO skb:\n- If the inner packet is CHECKSUM_PARTIAL, Local Checksum Offload computes\n  the outer checksum in software and the device offloads only the inner L4\n  checksum.\n- If the inner packet is CHECKSUM_NONE (e.g., SCTP-in-UDP, ESP-in-UDP,\n  Remote Checksum Offload), the device offloads the outer UDP or GRE\n  checksum instead.\n\nGSO skb:\n- A device with NETIF_F_GSO_UDP_TUNNEL_CSUM or NETIF_F_GSO_GRE_CSUM\n  computes both inner and outer checksums per segment.\n  The outer checksum is seeded with only the pseudo-header checksum.\n\nA NETIF_F_IPV6_CSUM device must parse through the outer headers to\nreach the inner ones.","summary":"The Linux kernel fails to check IPv6 extension headers on the outer and inner headers of tunneled packets during checksum offload. Affected GSO packets trigger a kernel warning and are dropped, which is a denial-of-service effect; the sources do not describe code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ipv6","kernel","linux","networking","tunnels"],"not_affected_if":["no-ipv6-tunnels"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:01+00:00","updated_at":"2026-10-25T05:13:01+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:13:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Linux kernel: IPv6 tunneled packets with extension headers dropped by checksum path","impact":"low","summary":"The Linux kernel fails to check IPv6 extension headers on the outer and inner headers of tunneled packets during checksum offload. Affected GSO packets trigger a kernel warning and are dropped, which is a denial-of-service effect; the sources do not describe code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","ipv6","tunnels","networking"],"confidence":0.5,"needs_auth":"unknown","worst_case":"tunneled packets are dropped and the kernel logs a warning","analyst_note":"Find the fixed kernel versions and stable backport commits in the NVD entry and kernel.org stable trees; the sources give no version data.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-ipv6-tunnels"],"who_is_affected":"Hosts running an affected Linux kernel that send or forward IPv6 tunnel traffic (ip6_gre, ip6_tunnel, UDP tunnels such as SCTP-in-UDP or PSP) on devices using IPv6 checksum GSO fallback. The sources do not list affected kernel versions. Systems without IPv6 tunnels are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000674,"input_tokens":4177,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98852':15A,18A '1':121C '2':181C,327C '3':220C '4':249C 'add':141C 'address':118C 'affect':46B 'alon':248C 'also':300C 'background':333C 'branch':110C 'c4336a07eb6b':90C 'call':168C 'catch':301C 'check':30B,131C,242C,264C,295C 'checksum':11A,44B,170C,334C,349C,352C,357C,368C,374C,386C,396C,420C,425C,434C 'code':69B,320C 'commit':89C 'comput':354C,415C 'correct':92C 'csum':98C,159C,315C,408C,414C,439C 'cve':13A,16A 'decid':243C 'default':148C 'denial':60B 'denial-of-servic':59B 'dereferenc':251C 'describ':68B 'destin':144C 'detect':85C 'devic':362C,389C,401C,440C 'direct':250C 'drop':9A,55B,179C 'e.g':307C,376C 'effect':63B 'encap':149C 'encapsul':113C,124C,298C,302C,306C 'esp':382C 'esp-in-udp':381C 'exclus':109C 'execut':70B 'ext':266C 'extend':82C 'extens':7A,32B,105C,165C 'exthdr':84C 'f':404C,411C,437C 'fail':28B 'fallback':100C 'fals':218C,324C 'follow':76C 'gre':137C,395C,413C 'gso':47B,99C,103C,152C,156C,174C,342C,398C,405C,412C 'handl':93C 'hdr':106C,254C,267C 'header':8A,33B,39B,128C,146C,166C,189C,197C,202C,205C,216C,227C,240C,247C,259C,273C,281C,284C,287C,293C,332C,433C,446C 'help':161C,171C,317C 'helper':312C 'hwoffload':160C,316C 'ignor':329C 'infrastructur':19B 'inner':38B,200C,214C,225C,238C,252C,279C,331C,346C,366C,371C,417C,450C 'instead':263C,397C 'invari':339C 'ip':215C,253C 'ip6':136C,139C,192C 'ipv6':3A,20B,31B,83C,97C,132C,184C,211C,239C,265C,272C,280C,438C 'keep':289C 'kernel':2A,21B,27B,51B,74C 'l4':367C 'leav':194C 'len':206C,294C 'limit':150C 'linux':1A,22B,26B,73C 'local':351C 'must':441C 'mutual':108C 'net':81C,91C 'netif':403C,410C,436C 'network':23B,204C,226C,292C 'nexthdr':268C 'non':341C 'non-gso':340C 'none':375C 'offload':45B,335C,353C,363C,387C,390C 'one':451C 'open':319C 'option':145C 'outer':36B,127C,143C,164C,187C,210C,246C,271C,356C,392C,419C,424C,445C 'packet':5A,42B,48B,88C,153C,303C,338C,347C,372C 'pars':442C 'partial':350C 'path':12A,120C 'per':421C 'pointer':260C,288C 'posit':219C,325C 'pseudo':432C 'pseudo-head':431C 'psp':235C 'reach':448C 'read':282C 'remot':385C 'resolv':80C 'sctp':231C,378C 'sctp-in-udp':230C,377C 'see':162C 'seed':427C 'segment':422C 'servic':62B 'set':125C,276C 'skb':102C,112C,123C,158C,169C,175C,195C,203C,255C,258C,286C,291C,297C,305C,314C,343C,399C 'skip':154C 'softwar':155C,359C 'sourc':65B 'span':208C 'split':101C 'test':321C 'traffic':95C 'transport':188C,196C,201C 'trigger':49B 'tunnel':4A,24B,41B,87C,94C,133C,140C,182C,193C,212C,222C,337C,407C 'udp':221C,233C,380C,384C,393C,406C 'unsaf':262C 'use':309C 'version':256C 'virtio':308C 'vulner':77C 'warn':52B,177C 'without':185C,223C,257C,304C 'yet':117C","nicknames":[],"mitigations":[],"who_affected":"Hosts running an affected Linux kernel that send or forward IPv6 tunnel traffic (ip6_gre, ip6_tunnel, UDP tunnels such as SCTP-in-UDP or PSP) on devices using IPv6 checksum GSO fallback. The sources do not list affected kernel versions. Systems without IPv6 tunnels are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98852","severity":null,"published_at":"2026-10-18T16:17:39+00:00","modified_at":"2026-10-21T13:21:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}