All vulnerabilities
CVE-2026-98621

Linux: net: gue: reject invalid REMCSUM offsets

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4b9bc21b2396c396d88dd909caaf73d5be6ff593Also 43efb1f997e976f386aa89716f55870cd2cff9ad, 1eeec0c51fd5598da44080ed96bbd9880021c28b and 4 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4b9bc21b2396c396d88dd909caaf73d5be6ff593LinuxCVE List
  • 43efb1f997e976f386aa89716f55870cd2cff9adLinuxCVE List
  • 1eeec0c51fd5598da44080ed96bbd9880021c28bLinuxCVE List
  • 1d664be4ca49d1696e85239236f4988dfc4653c3LinuxCVE List
  • 97f907203321eee2cc9132d5c9eb47698fb41d35LinuxCVE List
  • 40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57fLinuxCVE List
Show all 7 fixed versions
  • 2566866fc30965d915d0b52b5c3323b362619f0eLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: gue: reject invalid REMCSUM offsets

The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows.

A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer.

Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.

Text from CVE List

Affected versions 18

  • Linuxaffected: fe881ef11cf0220f118816181930494d484c4883 before 4b9bc21b2396c396d88dd909caaf73d5be6ff593CVE List
  • Linuxaffected: fe881ef11cf0220f118816181930494d484c4883 before 43efb1f997e976f386aa89716f55870cd2cff9adCVE List
  • Linuxaffected: fe881ef11cf0220f118816181930494d484c4883 before 1eeec0c51fd5598da44080ed96bbd9880021c28bCVE List
  • Linuxaffected: fe881ef11cf0220f118816181930494d484c4883 before 1d664be4ca49d1696e85239236f4988dfc4653c3CVE List
  • Linuxaffected: fe881ef11cf0220f118816181930494d484c4883 before 97f907203321eee2cc9132d5c9eb47698fb41d35CVE List
  • Linuxaffected: fe881ef11cf0220f118816181930494d484c4883 before 40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57fCVE List
  • Linuxaffected: fe881ef11cf0220f118816181930494d484c4883 before c20f755338ca234e523dfc943719f194dfc1f903CVE List
  • Linuxaffected: fe881ef11cf0220f118816181930494d484c4883 before 2566866fc30965d915d0b52b5c3323b362619f0eCVE List
  • Linuxaffected: 4.0CVE List
  • Linuxunaffected: all versions before 4.0CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8