Incorrect comparison in Linux kernel - CVE-2026-98497

Vulnerability identifier: #VU156798

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98497

CWE-ID: CWE-697

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to interfere with IPv6 IPsec policy enforcement, potentially causing traffic to be incorrectly included in or excluded from a policy.

The vulnerability exists due to incorrect address matching in the Linux kernel mlx5e driver's setup_fte_addr6() function when installing IPv6 IPsec policies with different source and destination prefix lengths. A remote attacker can send IPv6 traffic to trigger incorrect policy matching because the hardware rule applies the destination prefix mask to the source address and the source prefix mask to the destination address.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/10de7ed8ef4840da9ca21de4c29578657ac367db
• https://git.kernel.org/stable/c/3803dc8477f08e0dac4050cafee0de43f32727be
• https://git.kernel.org/stable/c/e73f832f0a7b2c6ea45b2124c732d639be97b547

• Incorrect comparison in Linux kernel core en_accel driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more