CVE-2026-98241

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCP_NEW_SYN_RECV request_sock while the output path itself is driven by the full listener. If rerouting selects an IPv6 XFRM tunnel route with a lower MTU, the local PMTU/error handling path can reach these callbacks with that mini-socket still attached to the skb. The callbacks then miscast the request socket as a full inet/IPv6 socket and can read beyond the request_sock allocation when they access inet_sock or ipv6_pinfo state. Resolve the owner with skb_to_full_sk() in both callbacks and bail out when no full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error logic, which already reasons about full sockets with skb_to_full_sk().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98241

EUVD

EUVD-2026-93169

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	dd767856a36e00b631d65ebc4bb81b19915532d6
Linux	Linux	dd767856a36e00b631d65ebc4bb81b19915532d6
Linux	Linux	dd767856a36e00b631d65ebc4bb81b19915532d6
Linux	Linux	dd767856a36e00b631d65ebc4bb81b19915532d6
Linux	Linux	dd767856a36e00b631d65ebc4bb81b19915532d6
Linux	Linux	dd767856a36e00b631d65ebc4bb81b19915532d6
Linux	Linux	dd767856a36e00b631d65ebc4bb81b19915532d6
Linux	Linux	dd767856a36e00b631d65ebc4bb81b19915532d6
Linux	Linux	3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of IPv6 packets in error paths. Functions xfrm6_local_rxpmtu() and xfrm6_local_error() mistakenly assume that an skb->sk pointer always refers to a full IPv6 socket, which is not always true. TCP SYN-ACK packets can be associated with a TCP_NEW_SYN_RECV request_sock instead of a full socket. When rerouting selects an IPv6 XFRM tunnel with a lower MTU, these functions may access memory beyond the request_sock allocation, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv6 XFRM implementation and requires kernel-level inspection. Detection involves checking kernel logs for crashes or errors related to IPv6 XFRM tunnels and PMTU handling. Use commands like dmesg | grep -i xfrm or journalctl -k | grep -i xfrm to look for related errors. If the kernel is vulnerable, you may see kernel oops or panics during IPv6 XFRM tunnel operations.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. Systems using IPv6 with XFRM tunnels and PMTU/error handling may experience kernel panics or unexpected behavior. Attackers could trigger the flaw by manipulating network routing to exploit the miscast socket access.

Compliance Impact

This vulnerability affects network packet handling in the Linux kernel but does not directly impact compliance with GDPR or HIPAA. It involves IPv6 routing and socket management, which are unrelated to data protection or privacy requirements.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor kernel security advisories and apply updates promptly.

Hi! I’m here to help you understand CVE-2026-98241. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70