CVE-2026-97984
Received Received - Intake

Buffer Overflow in Linux Kernel IPv6 UDP PMTUD

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork->base.fragsize to IP6_MAX_MTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce (included in the new selftest): 1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be set to that MTU in ip6_setup_cork. 2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It lets maxnonfragsize be set to device MTU (cork->fragsize) in __ip6_append_data, rather than to IP6_MAX_MTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of IPv6 header). Device MTU allows it (it's only one byte bigger than IP6_MAX_MTU, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp_set_len_short. To avoid breaking sending UDP jumbograms over raw IPv6 sockets, limit the change to UDP sockets only. The original overflow bug with IPv6 and IPV6_PMTUDISC_DO seems to predate git history (verified reproduction on 2.6.21), was fixed later, and then reappeared in commit 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward"), which is chosen as the Fixes tag here. The overflow with IPV6_PMTUDISC_PROBE reproduces since its introduction in commit 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97984
EUVD
EUVD-2026-86638

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an overflow in UDP packet length when Path MTU Discovery (PMTUD) is enabled with large MTU values. It occurs because the UDP length field can exceed its 16-bit limit, triggering a warning in the kernel. The issue is fixed by limiting the fragment size to IP6_MAX_MTU for UDP sockets.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv6 UDP implementation and may not have direct detection commands. It manifests when IPV6_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE with a large MTU device. Check kernel logs for warnings like 'udp_set_len_short' or verify if your system uses a kernel version affected by commit 427faee167bc.

Impact Analysis

This vulnerability could cause kernel warnings or crashes when sending large UDP packets over IPv6 with PMTUD enabled and unusually large MTU settings. It may disrupt network services relying on UDP communication.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. Avoid setting IPV6_MTU_DISCOVER to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE on systems with unusually large MTU devices. Monitor kernel logs for related warnings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart