CVE-2026-98288

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmac_tso_xmit() stores the protocol header length returned by stmmac_tso_header_size() in a u8. stmmac_tso_valid_packet() admits headers up to 1023 bytes, so a header longer than 255 bytes wraps modulo 256 (486 becomes 230, 256 becomes 0). A TCP over IPv6 socket carrying a few hundred bytes of sticky destination/hop-by-hop options makes skb_tcp_all_headers() exceed 255 while staying below the 1023-byte limit, so such an skb reaches stmmac_tso_xmit(). Widen proto_hdr_len to unsigned int, which is sufficient since the value is bounded by the hardware limit, and adjust the debug print specifier accordingly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98288

EUVD

EUVD-2026-93216

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9edfa7dab8112a012b349b7937f5444fdc21e8f9
Linux	Linux	9edfa7dab8112a012b349b7937f5444fdc21e8f9
Linux	Linux	4.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a truncation issue in the stmmac network driver. The stmmac_tso_xmit() function stores the protocol header length as an 8-bit unsigned integer (u8), which can only hold values up to 255. However, the stmmac_tso_valid_packet() function allows headers up to 1023 bytes. When a header exceeds 255 bytes, it wraps around modulo 256, causing incorrect calculations. This affects TCP over IPv6 sockets with large destination or hop-by-hop options.

Detection Guidance

This vulnerability affects the Linux kernel's stmmac network driver and is related to TSO header length truncation. Detection requires checking the kernel version and stmmac driver implementation. Use commands like 'uname -a' to check kernel version and 'lsmod | grep stmmac' to verify if the driver is loaded.

Impact Analysis

This vulnerability could lead to network packet corruption or incorrect processing of TCP/IPv6 packets with large headers. It may cause data transmission errors, connectivity issues, or potential denial-of-service conditions if exploited maliciously.

Compliance Impact

This vulnerability affects network packet handling in the Linux kernel but does not directly impact compliance with standards like GDPR or HIPAA. It is a low-level network driver issue that could potentially lead to data transmission errors or corruption, which might indirectly affect data integrity requirements in regulated environments.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the stmmac driver. If immediate patching is not possible, consider disabling TSO (TCP Segmentation Offload) for affected network interfaces using 'ethtool -K <interface> tso off' as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-98288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70