CVE-2026-98621

Severidad por fuente

Ninguna fuente da una puntuación CVSS.

La etiqueta propia de Trivy es HIGH. Crítica según Ubuntu. Más baja según Photon OS (alta).

Descripción

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows. A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer. Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.

Paquetes afectados y versiones corregidas

Referencias

• https://git.kernel.org/stable/c/1d664be4ca49d1696e85239236f4988dfc4653c3
• https://git.kernel.org/stable/c/1eeec0c51fd5598da44080ed96bbd9880021c28b
• https://git.kernel.org/stable/c/2566866fc30965d915d0b52b5c3323b362619f0e
• https://git.kernel.org/stable/c/40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f
• https://git.kernel.org/stable/c/43efb1f997e976f386aa89716f55870cd2cff9ad
• https://git.kernel.org/stable/c/4b9bc21b2396c396d88dd909caaf73d5be6ff593
• https://git.kernel.org/stable/c/97f907203321eee2cc9132d5c9eb47698fb41d35
• https://git.kernel.org/stable/c/c20f755338ca234e523dfc943719f194dfc1f903