All vulnerabilities
CVE-2026-98402

Linux: net: icmp: avoid invalid transport header access in icmp_send tracepoint

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in99654b651c6d5fe865798a2adb859767905f9278Also 04c0d35bac5122b533672a6775851dfae84e265e, 2b32f8c3560905582fb12ed68315a6e606367a6a and 3 moreCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 99654b651c6d5fe865798a2adb859767905f9278LinuxCVE List
  • 04c0d35bac5122b533672a6775851dfae84e265eLinuxCVE List
  • 2b32f8c3560905582fb12ed68315a6e606367a6aLinuxCVE List
  • 7fcc2fe39fed1cb98a7374a113ff3800e8f9af80LinuxCVE List
  • 6.1.189LinuxCVE List
  • 6.6.158LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: icmp: avoid invalid transport header access in icmp_send tracepoint

syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():

WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline] WARNING: at udp_hdr include/linux/udp.h:23 [inline] WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 Call trace: skb_transport_header include/linux/skbuff.h:3087 [inline] udp_hdr include/linux/udp.h:23 [inline] do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 __traceiter_icmp_send include/trace/events/icmp.h:11 [inline] __do_trace_icmp_send include/trace/events/icmp.h:11 [inline] trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11 __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013 ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline] ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287 dst_link_failure include/net/dst.h:438 [inline] vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307

TP_fast_assign() unconditionally calls udp_hdr(skb) before checking whether the packet is UDP. Furthermore, __icmp_send() can be invoked from paths (e.g., link failures, ARP errors, forwarding, AF_PACKET) where skb->transport_header was never initialized (~0U).

Under CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)).

Fix this by:

  1. Only parsing transport info when iph->protocol == IPPROTO_UDP.
  2. Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2)

to safely fetch the UDP header without assuming transport_header is set.

Text from CVE List

Affected versions 16

  • Linuxaffected: 524c341cb16a8d5318d2ffacf6fe160271a18743 before ec6d4612d1c170e1cef1fe55526471da1e81e777CVE List
  • Linuxaffected: 21b28f97e621cba196fb32c576734d216a8a79c9 before 99654b651c6d5fe865798a2adb859767905f9278CVE List
  • Linuxaffected: db3efdcf70c752e8a8deb16071d8e693c3ef8746 before b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1CVE List
  • Linuxaffected: db3efdcf70c752e8a8deb16071d8e693c3ef8746 before 04c0d35bac5122b533672a6775851dfae84e265eCVE List
  • Linuxaffected: db3efdcf70c752e8a8deb16071d8e693c3ef8746 before 2b32f8c3560905582fb12ed68315a6e606367a6aCVE List
  • Linuxaffected: db3efdcf70c752e8a8deb16071d8e693c3ef8746 before 7fcc2fe39fed1cb98a7374a113ff3800e8f9af80CVE List
  • Linuxaffected: 6.1.130 before 6.1.189CVE List
  • Linuxaffected: 6.6.81 before 6.6.158CVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6