{"id":"CVE-2026-98853","kind":"vulnerability","aliases":["CVE-2026-98853"],"related":[],"title":"Linux kernel: unbounded IP-in-IP GSO nesting can exhaust the kernel stack","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making\ninet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP\nGSO/TSO later made the path reachable. The IPv6 stackable path was\nintroduced separately and uses the same guard.\n\nCount IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once\nper top-level GSO operation and preserved across GRE/UDP context changes.\nUse the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first\nfive entries pass, and the sixth returns -EINVAL before dispatching\nanother GSO callback.","summary":"The Linux kernel's generic segmentation offload path re-entered the IPv4 and IPv6 segmentation handlers once per nested IP header without a depth limit, so a deeply nested packet can exhaust the kernel stack. The fix caps handler entries at the existing tunnel recursion limit and returns an error beyond it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ip-tunnels","kernel","linux","networking","runtime"],"not_affected_if":["no-ip-in-ip-tunnels"],"how_to_check":null,"fix":"- Update the Linux kernel to a release that includes the upstream commit adding the recursion limit to net/core GSO handling (version unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:01+00:00","updated_at":"2026-10-25T05:13:01+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:13:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit adding the recursion limit to net/core GSO handling (version unknown from the sources).","reach":"network","title":"Linux kernel: unbounded IP-in-IP GSO nesting can exhaust the kernel stack","impact":"medium","summary":"The Linux kernel's generic segmentation offload path re-entered the IPv4 and IPv6 segmentation handlers once per nested IP header without a depth limit, so a deeply nested packet can exhaust the kernel stack. The fix caps handler entries at the existing tunnel recursion limit and returns an error beyond it.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","networking","ip-tunnels"],"confidence":0.4,"needs_auth":"unknown","worst_case":"crafted nested packets can crash the kernel via stack exhaustion","analyst_note":"Sources give no severity, affected kernel versions or fixed version; check the NVD entry and the upstream kernel.org commit for the fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ip-in-ip-tunnels"],"who_is_affected":"Systems running a Linux kernel with IP-in-IP tunnels and GSO/TSO segmentation enabled are the ones where the nested path is reachable, per the description. Hosts with no IP-in-IP tunnel traffic and kernels without the stackable IPv4 and IPv6 GSO path are likely less exposed, but the sources do not spell this out.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000644,"input_tokens":3548,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98853':17A,20A 'across':186C 'anoth':212C 'beyond':79B 'byte':124C 'callback':126C,214C 'cap':66B 'cb':175C 'chain':131C 'chang':189C 'context':188C 'count':165C 'cve':15A,18A 'deep':130C 'deepli':56B 'depth':52B,127C 'dispatch':211C 'einval':209C 'encap':120C 'enter':38B,107C 'entri':68B,171C,203C 'error':78B 'exhaust':11A,60B,133C 'exist':71B,192C 'first':201C 'five':202C 'fix':65B 'follow':85C 'generic':32B 'gre/udp':187C 'gso':8A,91C,103C,109C,113C,139C,169C,174C,182C,213C 'gso/tso':147C 'guard':164C 'handler':44B,67B,170C,199C 'header':49B,119C,123C 'inet':108C,138C 'initi':176C 'introduc':142C,158C 'ip':5A,7A,22B,48B,95C,97C,100C,102C,118C,193C 'ip-in-ip':4A,94C,99C 'ip-tunnel':21B 'ipip':146C 'ipv4':40B,144C,166C 'ipv6':42B,112C,154C,168C 'kernel':2A,13A,24B,30B,62B,83C,135C 'later':148C 'level':121C,181C 'limit':53B,74B,92C,196C 'linux':1A,25B,29B,82C 'made':149C 'make':137C 'nest':9A,47B,57B,117C,145C 'net':90C 'network':26B 'offload':34B 'oper':183C 'packet':58B 'pass':204C 'path':35B,151C,156C 'per':46B,178C 'preserv':185C 're':37B,106C 're-ent':36B,105C 'reachabl':152C 'recurs':73B,93C,195C 'resolv':89C 'return':76B,208C 'runtim':27B 'segment':33B,43B,98C,110C,114C,140C 'separ':159C 'sixth':207C 'skb':173C 'stack':14A,63B,136C 'stackabl':141C,155C 'top':180C 'top-level':179C 'track':122C 'tunnel':23B,72B,194C 'unbound':3A,143C 'use':161C,190C 'vulner':86C 'without':50B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with IP-in-IP tunnels and GSO/TSO segmentation enabled are the ones where the nested path is reachable, per the description. Hosts with no IP-in-IP tunnel traffic and kernels without the stackable IPv4 and IPv6 GSO path are likely less exposed, but the sources do not spell this out.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98853","severity":null,"published_at":"2026-10-18T16:17:39+00:00","modified_at":"2026-10-19T10:19:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}