CVE-2026-98402

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98402", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.347Z", "datePublished": "2026-10-14T13:26:02.321Z", "dateUpdated": "2026-10-19T09:18:55.710Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:18:55.710Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: icmp: avoid invalid transport header access in icmp_send tracepoint\n\nsyzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():\n\n WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline]\n WARNING: at udp_hdr include/linux/udp.h:23 [inline]\n WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]\n WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11\n Call trace:\n skb_transport_header include/linux/skbuff.h:3087 [inline]\n udp_hdr include/linux/udp.h:23 [inline]\n do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]\n trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11\n __traceiter_icmp_send include/trace/events/icmp.h:11 [inline]\n __do_trace_icmp_send include/trace/events/icmp.h:11 [inline]\n trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11\n __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013\n ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline]\n ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287\n dst_link_failure include/net/dst.h:438 [inline]\n vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307\n\nTP_fast_assign() unconditionally calls udp_hdr(skb) before checking\nwhether the packet is UDP. Furthermore, __icmp_send() can be invoked\nfrom paths (e.g., link failures, ARP errors, forwarding, AF_PACKET)\nwhere skb->transport_header was never initialized (~0U).\n\nUnder CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers\nDEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)).\n\nFix this by:\n1. Only parsing transport info when iph->protocol == IPPROTO_UDP.\n2. Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2)\n to safely fetch the UDP header without assuming transport_header is set."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/trace/events/icmp.h"], "versions": [{"version": "524c341cb16a8d5318d2ffacf6fe160271a18743", "lessThan": "ec6d4612d1c170e1cef1fe55526471da1e81e777", "status": "affected", "versionType": "git"}, {"version": "21b28f97e621cba196fb32c576734d216a8a79c9", "lessThan": "99654b651c6d5fe865798a2adb859767905f9278", "status": "affected", "versionType": "git"}, {"version": "db3efdcf70c752e8a8deb16071d8e693c3ef8746", "lessThan": "b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1", "status": "affected", "versionType": "git"}, {"version": "db3efdcf70c752e8a8deb16071d8e693c3ef8746", "lessThan": "04c0d35bac5122b533672a6775851dfae84e265e", "status": "affected", "versionType": "git"}, {"version": "db3efdcf70c752e8a8deb16071d8e693c3ef8746", "lessThan": "2b32f8c3560905582fb12ed68315a6e606367a6a", "status": "affected", "versionType": "git"}, {"version": "db3efdcf70c752e8a8deb16071d8e693c3ef8746", "lessThan": "7fcc2fe39fed1cb98a7374a113ff3800e8f9af80", "status": "affected", "versionType": "git"}, {"version": "6.1.130", "lessThan": "6.1.189", "status": "affected", "versionType": "semver"}, {"version": "6.6.81", "lessThan": "6.6.158", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/trace/events/icmp.h"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.130", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.81", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ec6d4612d1c170e1cef1fe55526471da1e81e777"}, {"url": "https://git.kernel.org/stable/c/99654b651c6d5fe865798a2adb859767905f9278"}, {"url": "https://git.kernel.org/stable/c/b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1"}, {"url": "https://git.kernel.org/stable/c/04c0d35bac5122b533672a6775851dfae84e265e"}, {"url": "https://git.kernel.org/stable/c/2b32f8c3560905582fb12ed68315a6e606367a6a"}, {"url": "https://git.kernel.org/stable/c/7fcc2fe39fed1cb98a7374a113ff3800e8f9af80"}], "title": "net: icmp: avoid invalid transport header access in icmp_send tracepoint", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/trace/events/icmp.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ec6d4612d1c170e1cef1fe55526471da1e81e777", "status": "affected", "version": "524c341cb16a8d5318d2ffacf6fe160271a18743", "versionType": "git"}, {"lessThan": "99654b651c6d5fe865798a2adb859767905f9278", "status": "affected", "version": "21b28f97e621cba196fb32c576734d216a8a79c9", "versionType": "git"}, {"lessThan": "b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1", "status": "affected", "version": "db3efdcf70c752e8a8deb16071d8e693c3ef8746", "versionType": "git"}, {"lessThan": "04c0d35bac5122b533672a6775851dfae84e265e", "status": "affected", "version": "db3efdcf70c752e8a8deb16071d8e693c3ef8746", "versionType": "git"}, {"lessThan": "2b32f8c3560905582fb12ed68315a6e606367a6a", "status": "affected", "version": "db3efdcf70c752e8a8deb16071d8e693c3ef8746", "versionType": "git"}, {"lessThan": "7fcc2fe39fed1cb98a7374a113ff3800e8f9af80", "status": "affected", "version": "db3efdcf70c752e8a8deb16071d8e693c3ef8746", "versionType": "git"}, {"lessThan": "6.1.189", "status": "affected", "version": "6.1.130", "versionType": "semver"}, {"lessThan": "6.6.158", "status": "affected", "version": "6.6.81", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/trace/events/icmp.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: icmp: avoid invalid transport header access in icmp_send tracepoint\n\nsyzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():\n\n WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline]\n WARNING: at udp_hdr include/linux/udp.h:23 [inline]\n WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]\n WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11\n Call trace:\n skb_transport_header include/linux/skbuff.h:3087 [inline]\n udp_hdr include/linux/udp.h:23 [inline]\n do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]\n trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11\n __traceiter_icmp_send include/trace/events/icmp.h:11 [inline]\n __do_trace_icmp_send include/trace/events/icmp.h:11 [inline]\n trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11\n __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013\n ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline]\n ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287\n dst_link_failure include/net/dst.h:438 [inline]\n vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307\n\nTP_fast_assign() unconditionally calls udp_hdr(skb) before checking\nwhether the packet is UDP. Furthermore, __icmp_send() can be invoked\nfrom paths (e.g., link failures, ARP errors, forwarding, AF_PACKET)\nwhere skb->transport_header was never initialized (~0U).\n\nUnder CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers\nDEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)).\n\nFix this by:\n1. Only parsing transport info when iph->protocol == IPPROTO_UDP.\n2. Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2)\n to safely fetch the UDP header without assuming transport_header is set."}], "id": "CVE-2026-98402", "lastModified": "2026-10-19T10:18:45.083", "metrics": {}, "published": "2026-10-14T14:17:51.257", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/04c0d35bac5122b533672a6775851dfae84e265e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2b32f8c3560905582fb12ed68315a6e606367a6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7fcc2fe39fed1cb98a7374a113ff3800e8f9af80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/99654b651c6d5fe865798a2adb859767905f9278"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec6d4612d1c170e1cef1fe55526471da1e81e777"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: icmp: avoid invalid transport header access in icmp_send tracepoint", "id": "2552227", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552227"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel. An attacker could cause a Denial of Service (DoS) or system instability by triggering network error events while kernel event tracing is active. When recording Internet Control Message Protocol (ICMP) messages, the kernel attempts to read transport header information without verifying that the packet header is initialized and valid, leading to an invalid memory read that can crash the system."], "name": "CVE-2026-98402", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98402\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98402\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98402.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[524c341cb16a8d5318d2ffacf6fe160271a18743,ec6d4612d1c170e1cef1fe55526471da1e81e777)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[21b28f97e621cba196fb32c576734d216a8a79c9,99654b651c6d5fe865798a2adb859767905f9278)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db3efdcf70c752e8a8deb16071d8e693c3ef8746,b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db3efdcf70c752e8a8deb16071d8e693c3ef8746,04c0d35bac5122b533672a6775851dfae84e265e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db3efdcf70c752e8a8deb16071d8e693c3ef8746,2b32f8c3560905582fb12ed68315a6e606367a6a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db3efdcf70c752e8a8deb16071d8e693c3ef8746,7fcc2fe39fed1cb98a7374a113ff3800e8f9af80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.130,6.1.189)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.81,6.6.158)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-15T03:45:12.188467+00:00", "updated": "2026-10-19T18:45:01.852360+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}