Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98852— net: extend IPv6 exthdr detection of tunneled packets

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： 网络子系统：扩展对隧道化数据包 IPv6 扩展头的检测 提交 c4336a07eb6b（"net: 在 IPV6_CSUM GSO 回退时正确处理隧道化流量”）将 函数拆分为基于 的互斥分支。然而，该修改尚未覆盖所有路径： 1. 当 被设置时，外层头部未被检查。像 和 这样的 IPv6 隧道默认会添加外层目标选项头（encap_limit）。其 GSO 数据包会跳过软件 GSO 处理，随后 检测到外层扩展头，并调用 处理该 GSO 数据包，导致警告并丢弃该包。 2. 某

AI Predicted 5.5 Difficulty: Hard

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 33670f780e0120c3dacda188c512bbffe0b6044c< 44ba9dc568c878b699d05e7cf699572dc9df4b59 affected
a98b78116a27e2a57b696b569b2cb431c95cf9b6< aa480f05aed7a9eee87d4a6fc90647fe9679c670 affected
c4336a07eb6b2526dc2b62928b5104b41a7f81f5< cabacdf98e09eb74599c4d97d7bd7fd659598fb7 affected
c4336a07eb6b2526dc2b62928b5104b41a7f81f5< 5f0764cb1c81a9712bce605d38efe6d844a70b29 affected
2094a7cf91b71367b649f991aacc7b579f793d0b affected
ed71cf465c75f5688b07a35d373cd1d6b589c8ea affected
732fdeb2987c94b439d51f5cb9addddc2fc48c42 affected
6.12.81< 6.12.113 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98852

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: extend IPv6 exthdr detection of tunneled packets
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b ("net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback") split skb_gso_has_extension_hdr() into mutually exclusive branches on skb->encapsulation. This did not yet address all paths: 1. With skb->encapsulation set, the outer header is not checked. IPv6 tunnels such as ip6_gre and ip6_tunnel add an outer Destination Options header by default (encap_limit). Their GSO packets skip software GSO, then skb_csum_hwoffload_help() sees the outer extension header and calls skb_checksum_help() on the GSO skb, which warns and drops it. 2. Tunnels over IPv6 without an outer transport header, such as ip6_tunnel, leave skb->transport_header at the inner transport header. skb_network_header_len() then spans the outer IPv6, tunnel and inner IP headers, a false positive. 3. UDP tunnels without an inner network header, such as SCTP-in-UDP or PSP, have no inner IPv6 header to check. Decide on the outer header alone. 4. Directly dereferencing inner_ip_hdr(skb)->version without skb_header_pointer() is unsafe. Instead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and, if set, on the inner IPv6 header. Read the headers with skb_header_pointer(). Keep the skb_network_header_len() check when !skb->encapsulation to also catch encapsulated packets without skb->encapsulation (e.g., virtio). Use the same helper in skb_csum_hwoffload_help(). Its open coded test has the false positive of (2) and ignores the inner header. Background: checksum offload of tunneled packets invariants: Non-GSO skb: - If the inner packet is CHECKSUM_PARTIAL, Local Checksum Offload computes the outer checksum in software and the device offloads only the inner L4 checksum. - If the inner packet is CHECKSUM_NONE (e.g., SCTP-in-UDP, ESP-in-UDP, Remote Checksum Offload), the device offloads the outer UDP or GRE checksum instead. GSO skb: - A device with NETIF_F_GSO_UDP_TUNNEL_CSUM or NETIF_F_GSO_GRE_CSUM computes both inner and outer checksums per segment. The outer checksum is seeded with only the pseudo-header checksum. A NETIF_F_IPV6_CSUM device must parse through the outer headers to reach the inner ones.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 33670f780e0120c3dacda188c512bbffe0b6044c ~ 44ba9dc568c878b699d05e7cf699572dc9df4b59 -
Linux Linux 7.0 -

II. Public POCs for CVE-2026-98852

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98852

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98852 (2)

Same Patch Batch · Linux · 2026-10-18 · 436 CVEs total

CVE-2026-98582 nfc: st21nfca: validate received frame size
CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies
CVE-2026-98570 net: ipv6: keep room for the mac header in dst_dev_overhead()
CVE-2026-98571 net: stmmac: clear stale buf->page after recycling on skb build failure
CVE-2026-98572 bpf: Fix immediate JMP JEQ/JNE on MIPS32
CVE-2026-98573 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
CVE-2026-98574 net: bcmgenet: stop Tx NAPI before disabling the queues
CVE-2026-98575 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names
CVE-2026-98577 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length
CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
CVE-2026-98580 nfc: llcp: Fix race condition in accept_queue lifecycle
CVE-2026-98581 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
CVE-2026-98593 s390/debug: Fix NULL pointer dereference in debug_info_copy()
CVE-2026-98590 bpf: Fix bpf_sock context code generation
CVE-2026-98591 bpf: Fix bounds check for skb-backed dynptrs
CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure
CVE-2026-98589 bpf: Reject pkt arguments in mutating subprogs
CVE-2026-98594 tg3: clean up PHYLIB resources on probe failure

Showing top 20 of 436 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98852

No comments yet

Leave a comment