Integer underflow in Linux kernel - CVE-2026-98573

Vulnerability details

The vulnerability allows a remote attacker to cause memory corruption that may result in a denial of service.

The vulnerability exists due to an unsigned integer underflow in skb_maybe_pull_tail(), called by skb_checksum_setup_ipv6(), when parsing IPv6 extension headers. A remote attacker can supply crafted IPv6 packet data to trigger subtraction of skb_headlen(skb) from a smaller max value, producing a negative delta after conversion to a signed integer. This delta reaches skb_copy_bits() through __pskb_pull_tail(), where it can become a very large copy length and potentially cause memory corruption and a kernel crash.

The triggering condition requires an skb whose linear area exceeds MAX_IPV6_HDR_LEN and parsing that needs data beyond that linear area.

Affected software

How to mitigate CVE-2026-98573

External References

• https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd
• https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b
• https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78
• https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26
• https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12
• https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6
• https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962
• https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf

Related Security Bulletins

• Integer underflow in Linux kernel core