All vulnerabilities
CVE-2026-98950

Linux: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2aAlso 61b43a51a55929ec040bee3ea51af2121b956d05CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2aLinuxCVE List
  • 61b43a51a55929ec040bee3ea51af2121b956d05LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen).

If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values.

This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() returns early when a BPF flow dissector handles the packet.

struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen to U16_MAX before clamping.

Found by sashiko while reviewing the commit above.

Text from CVE List

Affected versions 12

  • Linuxaffected: d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before c44c02c930c6583b235a1937c69ff716c4bb4514CVE List
  • Linuxaffected: d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before 3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2aCVE List
  • Linuxaffected: d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before cc18eb0e9941162c03f03f411ed7f6c339d91fa0CVE List
  • Linuxaffected: d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before 61b43a51a55929ec040bee3ea51af2121b956d05CVE List
  • Linuxaffected: d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before f202578efc738b883cfa04889eb97328914265a7CVE List
  • Linuxaffected: 4.20CVE List
  • Linuxunaffected: all versions before 4.20CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5