CVE-2026-98532
Received Received - Intake

Out-of-Bounds Read in Linux Kernel IPv6 Header Parsing

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr() return an offset past the packet end ipv6_find_hdr() walks the extension header chain, skipping each header by the length that header itself declares. ipv6_optlen() returns up to 2048, and the skip is never checked against skb->len, so the offset stored in *offset can point past the end of the packet. openvswitch installs that offset as the transport header, and update_ipv6_checksum() then reads and writes the transport checksum field out of bounds: BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470 Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629 CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348 Call Trace: inet_proto_csum_replace16+0x445/0x470 set_ipv6_addr+0x3dd/0x460 do_execute_actions+0x6a3d/0x7c40 ovs_execute_actions+0xfd/0x480 ovs_packet_cmd_execute+0xc38/0xf20 genl_rcv_msg+0x59e/0x870 netlink_rcv_skb+0x18b/0x450 genl_rcv+0x2d/0x40 netlink_unicast+0x6bc/0xa20 The buggy address belongs to the object at ffff88810b754980 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 390 bytes inside of freed 704-byte region [ffff88810b754980, ffff88810b754c40) Other callers use that offset too, so bound it here rather than in one caller. Reject a header whose declared length does not fit in the packet. ipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this adds no new failure mode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98532
EUVD
EUVD-2026-103577

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux f8f626754ebeca613cf1af2e6f890cfde0e74d5b
Linux Linux f8f626754ebeca613cf1af2e6f890cfde0e74d5b
Linux Linux f8f626754ebeca613cf1af2e6f890cfde0e74d5b
Linux Linux f8f626754ebeca613cf1af2e6f890cfde0e74d5b
Linux Linux f8f626754ebeca613cf1af2e6f890cfde0e74d5b
Linux Linux f8f626754ebeca613cf1af2e6f890cfde0e74d5b
Linux Linux f8f626754ebeca613cf1af2e6f890cfde0e74d5b
Linux Linux f8f626754ebeca613cf1af2e6f890cfde0e74d5b
Linux Linux 3.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ipv6_find_hdr() function, which processes IPv6 extension headers. The function can return an offset that exceeds the packet's actual length, leading to out-of-bounds memory access. This occurs because the function does not validate if the declared header length fits within the packet. Attackers can exploit this to trigger memory corruption, potentially causing crashes or arbitrary code execution.

Detection Guidance

This vulnerability involves IPv6 packet parsing in the Linux kernel. Detection requires checking for malformed IPv6 packets or kernel logs indicating slab-use-after-free errors related to IPv6 checksum handling. Monitor kernel logs for KASAN reports or errors involving ipv6_find_hdr() or update_ipv6_checksum().

Impact Analysis

This vulnerability can impact systems using the Linux kernel, particularly those running Open vSwitch (OVS) with IPv6 traffic. Exploitation may lead to kernel memory corruption, resulting in system crashes, denial-of-service conditions, or unauthorized code execution. Systems processing IPv6 packets with malformed extension headers are most at risk.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If immediate patching is not possible, restrict IPv6 traffic handling or disable Open vSwitch (OVS) IPv6 features until patched. Monitor network traffic for malformed IPv6 packets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98532. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart