SB2026100773 - Numeric Truncation Error in Linux kernel stmicro stmmac driver

Description

This security bulletin contains information about 1 vulnerability.

1) Numeric Truncation Error (CVE-ID: CVE-2026-98288)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause protocol header lengths to be truncated during TCP segmentation offload.

The vulnerability exists due to numeric truncation in stmmac_tso_xmit() when processing TCP over IPv6 packets with protocol headers longer than 255 bytes. A local user can create a TCP over IPv6 socket with several hundred bytes of sticky destination or hop-by-hop options to cause protocol header lengths to be truncated during TCP segmentation offload.

The packet validation function accepts protocol headers up to 1023 bytes, allowing these packets to reach the affected transmit function.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/15989abd74f16f44bf953d056b95f1d2fda9b0cd
• https://git.kernel.org/stable/c/bcf6013c2b4d732c6e4bf4d0f6ae4a18d63d414b