CVE-2026-98852

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-98852

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98852.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-98852

Downstream

Published

2026-10-18T15:50:55Z

Modified

2026-10-19T02:47:16Z

Summary

net: extend IPv6 exthdr detection of tunneled packets

Details

In the Linux kernel, the following vulnerability has been resolved:

net: extend IPv6 exthdr detection of tunneled packets

Commit c4336a07eb6b ("net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback") split skb_gso_has_extension_hdr() into mutually exclusive branches on skb->encapsulation. This did not yet address all paths:

With skb->encapsulation set, the outer header is not checked. IPv6 tunnels such as ip6_gre and ip6_tunnel add an outer Destination Options header by default (encap_limit). Their GSO packets skip software GSO, then skb_csum_hwoffload_help() sees the outer extension header and calls skb_checksum_help() on the GSO skb, which warns and drops it.
Tunnels over IPv6 without an outer transport header, such as ip6_tunnel, leave skb->transport_header at the inner transport header. skb_network_header_len() then spans the outer IPv6, tunnel and inner IP headers, a false positive.
UDP tunnels without an inner network header, such as SCTP-in-UDP or PSP, have no inner IPv6 header to check. Decide on the outer header alone.
Directly dereferencing inner_ip_hdr(skb)->version without skb_header_pointer() is unsafe.

Instead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and, if set, on the inner IPv6 header. Read the headers with skb_header_pointer(). Keep the skb_network_header_len() check when !skb->encapsulation to also catch encapsulated packets without skb->encapsulation (e.g., virtio).

Use the same helper in skb_csum_hwoffload_help(). Its open coded test has the false positive of (2) and ignores the inner header.

Background: checksum offload of tunneled packets invariants:

Non-GSO skb:

If the inner packet is CHECKSUM_PARTIAL, Local Checksum Offload computes the outer checksum in software and the device offloads only the inner L4 checksum.
If the inner packet is CHECKSUM_NONE (e.g., SCTP-in-UDP, ESP-in-UDP, Remote Checksum Offload), the device offloads the outer UDP or GRE checksum instead.

GSO skb:

A device with NETIF_F_GSO_UDP_TUNNEL_CSUM or NETIF_F_GSO_GRE_CSUM computes both inner and outer checksums per segment. The outer checksum is seeded with only the pseudo-header checksum.

A NETIF_F_IPV6_CSUM device must parse through the outer headers to reach the inner ones.

Database specific

{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98852.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

33670f780e0120c3dacda188c512bbffe0b6044c

Fixed

44ba9dc568c878b699d05e7cf699572dc9df4b59

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

a98b78116a27e2a57b696b569b2cb431c95cf9b6

Fixed

aa480f05aed7a9eee87d4a6fc90647fe9679c670

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

c4336a07eb6b2526dc2b62928b5104b41a7f81f5

Fixed

cabacdf98e09eb74599c4d97d7bd7fd659598fb7

Fixed

5f0764cb1c81a9712bce605d38efe6d844a70b29

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.12.81

Fixed

6.12.113

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.18.22

Fixed

6.18.56

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.1.168

Fixed

6.2

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.6.134

Fixed

6.7

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.19.12

Fixed

6.20

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

2094a7cf91b71367b649f991aacc7b579f793d0b

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

ed71cf465c75f5688b07a35d373cd1d6b589c8ea

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

732fdeb2987c94b439d51f5cb9addddc2fc48c42

Affected versions

v6.*

v6.1.168

v6.1.169

v6.1.170

v6.1.171

v6.1.172

v6.1.173

v6.1.174

v6.1.175

v6.1.176

v6.1.177

v6.1.178

v6.1.179

v6.1.180

v6.1.181

v6.1.182

v6.1.183

v6.1.184

v6.1.185

v6.1.186

v6.1.187

v6.1.188

v6.1.189

v6.1.190

v6.12.100

v6.12.101

v6.12.102

v6.12.103

v6.12.104

v6.12.105

v6.12.106

v6.12.107

v6.12.108

v6.12.109

v6.12.110

v6.12.111

v6.12.112

v6.12.81

v6.12.82

v6.12.83

v6.12.84

v6.12.85

v6.12.86

v6.12.87

v6.12.88

v6.12.89

v6.12.90

v6.12.91

v6.12.92

v6.12.93

v6.12.94

v6.12.95

v6.12.96

v6.12.97

v6.12.98

v6.12.99

v6.18.22

v6.18.23

v6.18.24

v6.18.25

v6.18.26

v6.18.27

v6.18.28

v6.18.29

v6.18.30

v6.18.31

v6.18.32

v6.18.33

v6.18.34

v6.18.35

v6.18.36

v6.18.37

v6.18.38

v6.18.39

v6.18.40

v6.18.41

v6.18.42

v6.18.43

v6.18.44

v6.18.45

v6.18.46

v6.18.47

v6.18.48

v6.18.49

v6.18.50

v6.18.51

v6.18.52

v6.18.53

v6.18.54

v6.18.55

v6.19.12

v6.19.13

v6.19.14

v6.6.134

v6.6.135

v6.6.136

v6.6.137

v6.6.138

v6.6.139

v6.6.140

v6.6.141

v6.6.142

v6.6.143

v6.6.144

v6.6.145

v6.6.146

v6.6.147

v6.6.148

v6.6.149

v6.6.150

v6.6.151

v6.6.152

v6.6.153

v6.6.154

v6.6.155

v6.6.156

v6.6.157

v6.6.158

v6.6.159

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98852.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.12.113

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.56

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.2.10

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98852.json"