Out-of-bounds read in Linux kernel - CVE-2026-98241

Vulnerability details

The vulnerability allows a remote attacker to trigger out-of-bounds reads in kernel memory.

The vulnerability exists due to out-of-bounds reads caused by treating request sockets as full IPv6 sockets in xfrm6_local_rxpmtu() and xfrm6_local_error() when accessing inet_sock or ipv6_pinfo state through skb->sk. A remote attacker can trigger local PMTU or error handling for TCP SYN-ACK packets owned by a request socket to trigger out-of-bounds reads in kernel memory.

The vulnerable path is reachable when rerouting selects an IPv6 XFRM tunnel route with a lower MTU while a TCP_NEW_SYN_RECV request socket remains attached to the packet.

Affected software

How to mitigate CVE-2026-98241

External References

• https://git.kernel.org/stable/c/4c030a0400ebfd2318361c923a88103b2c67c49f
• https://git.kernel.org/stable/c/60459c670329d586a58db5d8f811fa5accfe4862
• https://git.kernel.org/stable/c/675919e08ce266b8cac11fd9af29170e762a480f
• https://git.kernel.org/stable/c/6973a21ee73c5567f883813c8ef414774b45892f
• https://git.kernel.org/stable/c/904a0e827d0d7189271a3a2eb648293809f25efc
• https://git.kernel.org/stable/c/b1a88633c36d2cbc3831382f3846754d344276fd
• https://git.kernel.org/stable/c/c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8
• https://git.kernel.org/stable/c/ca3d68c3213475b53db6647e159dc73bd1af5ab1

Related Security Bulletins

• Out-of-bounds read in Linux kernel ipv6
• Debian update for linux