CVE-2026-98950
Received
Received - Intake
Integer Overflow in Linux Kernel BPF Flow Dissector
Vulnerability report for CVE-2026-98950, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-23
Last updated on: 2026-10-23
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
bpf_flow_dissect() sanitizes the offsets returned by the BPF program
with clamp_t(u16, ..., hlen).
If hlen is bigger than 65535, the upper bound is truncated before
the comparison. For instance, with hlen == 65536, both nhoff and
thoff are forced to zero, even if the program returned sane values.
This is the same class of bug as the one fixed in commit 99bda1ecbd56
("flow_dissector: avoid u16 truncation of skb->len when computing
thoff"). That fix does not cover the BPF path, because
__skb_flow_dissect() returns early when a BPF flow dissector
handles the packet.
struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen
to U16_MAX before clamping.
Found by sashiko while reviewing the commit above.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 |
| Linux | Linux | d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 |
| Linux | Linux | d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 |
| Linux | Linux | d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 |
| Linux | Linux | d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 |
| Linux | Linux | 4.20 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
