All vulnerabilities
CVE-2026-98241

Linux: ipv6: xfrm: use full sockets in local error paths

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in904a0e827d0d7189271a3a2eb648293809f25efcAlso 675919e08ce266b8cac11fd9af29170e762a480f, 60459c670329d586a58db5d8f811fa5accfe4862 and 2 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 904a0e827d0d7189271a3a2eb648293809f25efcLinuxCVE List
  • 675919e08ce266b8cac11fd9af29170e762a480fLinuxCVE List
  • 60459c670329d586a58db5d8f811fa5accfe4862LinuxCVE List
  • 4c030a0400ebfd2318361c923a88103b2c67c49fLinuxCVE List
  • 6973a21ee73c5567f883813c8ef414774b45892fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: xfrm: use full sockets in local error paths

xfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it always pointed at a full IPv6 socket.

That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCP_NEW_SYN_RECV request_sock while the output path itself is driven by the full listener. If rerouting selects an IPv6 XFRM tunnel route with a lower MTU, the local PMTU/error handling path can reach these callbacks with that mini-socket still attached to the skb.

The callbacks then miscast the request socket as a full inet/IPv6 socket and can read beyond the request_sock allocation when they access inet_sock or ipv6_pinfo state.

Resolve the owner with skb_to_full_sk() in both callbacks and bail out when no full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error logic, which already reasons about full sockets with skb_to_full_sk().

Text from CVE List

Affected versions 18

  • Linuxaffected: dd767856a36e00b631d65ebc4bb81b19915532d6 before b1a88633c36d2cbc3831382f3846754d344276fdCVE List
  • Linuxaffected: dd767856a36e00b631d65ebc4bb81b19915532d6 before 904a0e827d0d7189271a3a2eb648293809f25efcCVE List
  • Linuxaffected: dd767856a36e00b631d65ebc4bb81b19915532d6 before 675919e08ce266b8cac11fd9af29170e762a480fCVE List
  • Linuxaffected: dd767856a36e00b631d65ebc4bb81b19915532d6 before 60459c670329d586a58db5d8f811fa5accfe4862CVE List
  • Linuxaffected: dd767856a36e00b631d65ebc4bb81b19915532d6 before ca3d68c3213475b53db6647e159dc73bd1af5ab1CVE List
  • Linuxaffected: dd767856a36e00b631d65ebc4bb81b19915532d6 before 4c030a0400ebfd2318361c923a88103b2c67c49fCVE List
  • Linuxaffected: dd767856a36e00b631d65ebc4bb81b19915532d6 before c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8CVE List
  • Linuxaffected: dd767856a36e00b631d65ebc4bb81b19915532d6 before 6973a21ee73c5567f883813c8ef414774b45892fCVE List
  • Linuxaffected: 3.2CVE List
  • Linuxunaffected: all versions before 3.2CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8