{"schema":"threatline.record/2","record":{"id":"CVE-2026-98241","aliases":[],"summary":"ipv6: xfrm: use full sockets in local error paths","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: xfrm: use full sockets in local error paths\n\nxfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it\nalways pointed at a full IPv6 socket.\n\nThat is not guaranteed. TCP SYN-ACK skbs can be owned by a\nTCP_NEW_SYN_RECV request_sock while the output path itself is driven by the\nfull listener. If rerouting selects an IPv6 XFRM tunnel route with a lower\nMTU, the local PMTU/error handling path can reach these callbacks with that\nmini-socket still attached to the skb.\n\nThe callbacks then miscast the request socket as a full inet/IPv6 socket and\ncan read beyond the request_sock allocation when they access inet_sock or\nipv6_pinfo state.\n\nResolve the owner with skb_to_full_sk() in both callbacks and bail out when\nno full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error\nlogic, which already reasons about full sockets with skb_to_full_sk().","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98241","source_modified_at":"2026-10-19T09:16:12.796Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"b1a88633c36d2cbc3831382f3846754d344276fd","status":"affected","versionType":"git"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"904a0e827d0d7189271a3a2eb648293809f25efc","status":"affected","versionType":"git"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"675919e08ce266b8cac11fd9af29170e762a480f","status":"affected","versionType":"git"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"60459c670329d586a58db5d8f811fa5accfe4862","status":"affected","versionType":"git"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"ca3d68c3213475b53db6647e159dc73bd1af5ab1","status":"affected","versionType":"git"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"4c030a0400ebfd2318361c923a88103b2c67c49f","status":"affected","versionType":"git"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8","status":"affected","versionType":"git"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"6973a21ee73c5567f883813c8ef414774b45892f","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98241","source_modified_at":"2026-10-19T09:16:12.796Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98241","source_modified_at":"2026-10-19T09:16:12.796Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"904a0e827d0d7189271a3a2eb648293809f25efc","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98241","source_modified_at":"2026-10-19T09:16:12.796Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"675919e08ce266b8cac11fd9af29170e762a480f","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98241","source_modified_at":"2026-10-19T09:16:12.796Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"60459c670329d586a58db5d8f811fa5accfe4862","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98241","source_modified_at":"2026-10-19T09:16:12.796Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"4c030a0400ebfd2318361c923a88103b2c67c49f","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98241","source_modified_at":"2026-10-19T09:16:12.796Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6973a21ee73c5567f883813c8ef414774b45892f","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00138,"percentile":0.02938,"score_date":"2026-10-23"},"published_at":"2026-10-06T08:45:11.954Z","modified_at":"2026-10-19T09:16:12.796Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98241","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:16:12.796Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98241","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/b1a88633c36d2cbc3831382f3846754d344276fd"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/904a0e827d0d7189271a3a2eb648293809f25efc"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/675919e08ce266b8cac11fd9af29170e762a480f"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/60459c670329d586a58db5d8f811fa5accfe4862"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/ca3d68c3213475b53db6647e159dc73bd1af5ab1"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/4c030a0400ebfd2318361c923a88103b2c67c49f"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6973a21ee73c5567f883813c8ef414774b45892f"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:16:12.796Z","content_hash":"dd53ffe864282f86e7cc54aafca99152ac6bdb9c5c31aabc62a3ad904353e331"}}