CVE-2026-98955
Received
Received - Intake
Flow dissector u16 truncation flaw in Linux kernel
Vulnerability report for CVE-2026-98955, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-23
Last updated on: 2026-10-23
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
flow_dissector: avoid u16 truncation of skb->len when computing thoff
__skb_flow_dissect() computes key_control->thoff using:
key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
min_t(u16, ...) casts both arguments to u16 before comparing them.
Whenever skb->len (or hlen) modulo 65536 is smaller than nhoff, the
truncated length wins and thoff is set to a bogus small value, even
when the dissection succeeded. For example, an IPv4/TCP frame with
skb->len == 65540 and nhoff == 34 gets thoff == 4, so callers such as
skb_probe_transport_header() point the transport header inside the
Ethernet header.
Such skbs are not exotic:
- At the time of commit d0c081b49137 ("flow_dissector: properly cap
thoff field"), AF_PACKET with PACKET_VNET_HDR could already build GSO
skbs larger than 64KB (MTU checks are skipped for GSO, and
alloc_skb_with_frags() accepted up to MAX_SKB_FRAGS (17) order-0
pages on top of the linear part).
- BIG TCP now makes skbs larger than 64KB common.
- The following patch makes tun_get_user() dissect IFF_TAP frames
before eth_type_trans() pulls the Ethernet header, so a GSO frame
carrying a 65522..65535 byte L3 packet will be dissected with
skb->len in [65536, 65549].
Compare as u32 instead. If the resulting offset cannot be represented
in the u16 key_control->thoff, cap it to U16_MAX and report the
dissection as failed rather than silently returning a wrong transport
offset. thoff is still set on failure, as some callers (such as
eth_get_headlen()) use it regardless of the return value.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | d0c081b49137cd3200f2023c0875723be66e7ce5 |
| Linux | Linux | d0c081b49137cd3200f2023c0875723be66e7ce5 |
| Linux | Linux | d0c081b49137cd3200f2023c0875723be66e7ce5 |
| Linux | Linux | d0c081b49137cd3200f2023c0875723be66e7ce5 |
| Linux | Linux | d0c081b49137cd3200f2023c0875723be66e7ce5 |
| Linux | Linux | d35cd5e279881ec36ff8cd82a2d9caebc0cce3fc |
| Linux | Linux | eecfa2eeefe3caef4c8d6b2284f6066c76ab26a1 |
| Linux | Linux | 80f327285cab6ab8e10c3ea03278add5dd99fb02 |
| Linux | Linux | 4.4.114 |
| Linux | Linux | 4.9.79 |
| Linux | Linux | 4.14.16 |
| Linux | Linux | 4.15 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
