{"id":"CVE-2026-98955","kind":"vulnerability","aliases":["CVE-2026-98955"],"related":[],"title":"Linux kernel: flow dissector truncates packet length, corrupting transport offset","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nflow_dissector: avoid u16 truncation of skb->len when computing thoff\n\n__skb_flow_dissect() computes key_control->thoff using:\n\n  key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);\n\nmin_t(u16, ...) casts both arguments to u16 before comparing them.\nWhenever skb->len (or hlen) modulo 65536 is smaller than nhoff, the\ntruncated length wins and thoff is set to a bogus small value, even\nwhen the dissection succeeded. For example, an IPv4/TCP frame with\nskb->len == 65540 and nhoff == 34 gets thoff == 4, so callers such as\nskb_probe_transport_header() point the transport header inside the\nEthernet header.\n\nSuch skbs are not exotic:\n- At the time of commit d0c081b49137 (\"flow_dissector: properly cap\n  thoff field\"), AF_PACKET with PACKET_VNET_HDR could already build GSO\n  skbs larger than 64KB (MTU checks are skipped for GSO, and\n  alloc_skb_with_frags() accepted up to MAX_SKB_FRAGS (17) order-0\n  pages on top of the linear part).\n- BIG TCP now makes skbs larger than 64KB common.\n- The following patch makes tun_get_user() dissect IFF_TAP frames\n  before eth_type_trans() pulls the Ethernet header, so a GSO frame\n  carrying a 65522..65535 byte L3 packet will be dissected with\n  skb->len in [65536, 65549].\n\nCompare as u32 instead. If the resulting offset cannot be represented\nin the u16 key_control->thoff, cap it to U16_MAX and report the\ndissection as failed rather than silently returning a wrong transport\noffset. thoff is still set on failure, as some callers (such as\neth_get_headlen()) use it regardless of the return value.","summary":"The Linux kernel's flow dissector casts packet length to a 16-bit value, so packets over 64KB can get a wrong transport header offset. The sources do not state a confirmed attacker outcome beyond this memory-offset corruption.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","self-hosted","virtualization"],"not_affected_if":["default-config"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:16+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:50+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:57:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel: flow dissector truncates packet length, corrupting transport offset","impact":"low","summary":"The Linux kernel's flow dissector casts packet length to a 16-bit value, so packets over 64KB can get a wrong transport header offset. The sources do not state a confirmed attacker outcome beyond this memory-offset corruption.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted","virtualization"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the fixed kernel versions and stable backport commits in the NVD entry and the kernel.org stable commit for this flow_dissector change, and confirm the impact on the kernel.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running Linux kernels with the affected flow dissector code, most relevant where GSO frames larger than 64KB reach the kernel through AF_PACKET with PACKET_VNET_HDR or TAP devices. The sources do not give version ranges or a list of deployments that are unaffected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000616,"input_tokens":3879,"output_tokens":457,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0':226C '-2026':12A,15A '-98955':13A,16A '16':36B '17':224C '34':156C '4':159C '64kb':42B,206C,241C '65522':268C '65535':269C '65536':122C,280C '65540':153C '65549':281C 'accept':218C 'af':193C 'alloc':214C 'alreadi':200C 'argument':110C 'attack':57B 'avoid':77C 'beyond':59B 'big':234C 'bit':37B 'bogus':137C 'build':201C 'byte':270C 'caller':161C,326C 'cannot':290C 'cap':190C,299C 'carri':266C 'cast':31B,108C 'check':208C 'commit':185C 'common':242C 'compar':114C,282C 'comput':84C,89C 'confirm':56B 'control':91C,95C,297C 'corrupt':8A,64B 'could':199C 'cve':11A,14A 'd0c081b49137':186C 'dissect':88C,143C,250C,275C,307C 'dissector':4A,30B,76C,188C 'eth':255C,329C 'ethernet':174C,260C 'even':140C 'exampl':146C 'exot':180C 'fail':309C 'failur':323C 'field':192C 'flow':3A,29B,75C,87C,187C 'follow':70C,244C 'frag':217C,223C 'frame':149C,253C,265C 'get':44B,157C,248C,330C 'gso':202C,212C,264C 'hdr':198C 'header':48B,167C,171C,175C,261C 'headlen':331C 'hlen':104C,120C 'host':23B 'iff':251C 'infrastructur':17B 'insid':172C 'instead':285C 'ipv4/tcp':148C 'kernel':2A,20B,27B,68C 'key':90C,94C,296C 'l3':271C 'larger':204C,239C 'len':82C,103C,118C,152C,278C 'length':7A,33B,129C 'linear':232C 'linux':1A,19B,26B,67C 'linux-kernel':18B 'make':237C,246C 'max':221C,303C 'memori':62B 'memory-offset':61B 'min':97C,105C 'modulo':121C 'mtu':207C 'nhoff':100C,126C,155C 'offset':10A,49B,63B,289C,317C 'order':225C 'outcom':58B 'packet':6A,32B,40B,194C,196C,272C 'page':227C 'part':233C 'patch':245C 'point':168C 'probe':165C 'proper':189C 'pull':258C 'rather':310C 'regardless':334C 'report':305C 'repres':292C 'resolv':74C 'result':288C 'return':313C,337C 'self':22B 'self-host':21B 'set':134C,321C 'silent':312C 'skb':81C,86C,101C,102C,117C,151C,164C,215C,222C,277C 'skbs':177C,203C,238C 'skip':210C 'small':138C 'smaller':124C 'sourc':51B 'state':54B 'still':320C 'succeed':144C 'tap':252C 'tcp':235C 'thoff':85C,92C,96C,132C,158C,191C,298C,318C 'time':183C 'top':229C 'tran':257C 'transport':9A,47B,166C,170C,316C 'truncat':5A,79C,128C 'tun':247C 'type':256C 'u16':78C,99C,107C,112C,295C,302C 'u32':284C 'use':93C,332C 'user':249C 'valu':38B,139C,338C 'virtual':24B 'vnet':197C 'vulner':71C 'whenev':116C 'win':130C 'wrong':46B,315C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels with the affected flow dissector code, most relevant where GSO frames larger than 64KB reach the kernel through AF_PACKET with PACKET_VNET_HDR or TAP devices. The sources do not give version ranges or a list of deployments that are unaffected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98955","severity":null,"published_at":"2026-10-23T13:17:16+00:00","modified_at":"2026-10-23T13:17:16+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98955","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98955","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}