CVE-2026-98570

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98570", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.357Z", "datePublished": "2026-10-18T15:18:36.308Z", "dateUpdated": "2026-10-19T09:21:55.765Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:55.765Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: keep room for the mac header in dst_dev_overhead()\n\nThe seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as\nthe length they are about to push plus dst_dev_overhead(), then push the\nnew headers and rebuild the mac header below them with\nskb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom,\nbut dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device,\n16 bytes for plain Ethernet.\n\nWhere the mac header is longer than that, as it is on ingress through a\nVLAN device with reorder_hdr off, the rebuild runs out of room:\nskb_set_mac_header(skb, -skb->mac_len) computes a negative offset,\nstores it unchecked in the u16 skb->mac_header, and the memmove that\nfollows writes skb->mac_len bytes about 64 KB past skb->head.\nForwarding plain ping6 traffic through such a device reproduces it on\nall five seg6 encapsulation modes and on the rpl and ioam6 inline paths;\nskb->mac_header comes back as 65534 on a 704-byte head.\n\nReturn the larger of the two. The helper already returns skb->mac_len\nwhen it has no dst, so this only makes the other branch agree, and it\ncovers every caller rather than each call site in turn."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/dst.h"], "versions": [{"version": "dce525185bc92864e5a318040285ee070563fe34", "lessThan": "36c07127924f11fc5741a780abcaaf808fe9ef13", "status": "affected", "versionType": "git"}, {"version": "dce525185bc92864e5a318040285ee070563fe34", "lessThan": "87cd6b717e4069dca34e0866e57eaeb44d3b173e", "status": "affected", "versionType": "git"}, {"version": "8471e228448a818e4c27cab4b681b2e758e46cf5", "status": "affected", "versionType": "git"}, {"version": "c432cd18a07b623651ed15ea167bd303467004cc", "status": "affected", "versionType": "git"}, {"version": "634710a372ba65bee667c2f6e58a97658c639eab", "status": "affected", "versionType": "git"}, {"version": "c447c5a9c47bb4858ab12bf90879fe595d2b7f46", "status": "affected", "versionType": "git"}, {"version": "ab9de9c48316d2622d3bf353916b99971570e2c9", "status": "affected", "versionType": "git"}, {"version": "2fcc9f3798ef82399564d247458e69abd10e683b", "status": "affected", "versionType": "git"}, {"version": "371d8dc298b4f59e99b4564ac5d906fce0932c69", "status": "affected", "versionType": "git"}, {"version": "b26f015dfb07b6be12d005a0ed0c5c43b7bedbf3", "status": "affected", "versionType": "git"}, {"version": "c0b11dc50590e10590b39dcda79835cd32f49d00", "status": "affected", "versionType": "git"}, {"version": "4c12c3c8abd8b888945d31e7bdbb0d8b73032fc5", "status": "affected", "versionType": "git"}, {"version": "25d8e065c7972dc98fd7a4cac322d5367eaede88", "status": "affected", "versionType": "git"}, {"version": "4a855c5aec41bf84922224ab7a74e088776e3ac4", "status": "affected", "versionType": "git"}, {"version": "a9f0407414e16176fdbbbd298c9e18d6dfdf96bc", "status": "affected", "versionType": "git"}, {"version": "6.12.16", "lessThan": "6.13", "status": "affected", "versionType": "semver"}, {"version": "6.13.4", "lessThan": "6.14", "status": "affected", "versionType": "semver"}, {"version": "5.15.179", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.1.130", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.6.81", "lessThan": "6.7", "status": "affected", "versionType": "semver"}, {"version": "5.10.235", "lessThan": "5.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/dst.h"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.179"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.235"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.179"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/36c07127924f11fc5741a780abcaaf808fe9ef13"}, {"url": "https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e"}], "title": "net: ipv6: keep room for the mac header in dst_dev_overhead()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/dst.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "36c07127924f11fc5741a780abcaaf808fe9ef13", "status": "affected", "version": "dce525185bc92864e5a318040285ee070563fe34", "versionType": "git"}, {"lessThan": "87cd6b717e4069dca34e0866e57eaeb44d3b173e", "status": "affected", "version": "dce525185bc92864e5a318040285ee070563fe34", "versionType": "git"}, {"status": "affected", "version": "8471e228448a818e4c27cab4b681b2e758e46cf5", "versionType": "git"}, {"status": "affected", "version": "c432cd18a07b623651ed15ea167bd303467004cc", "versionType": "git"}, {"status": "affected", "version": "634710a372ba65bee667c2f6e58a97658c639eab", "versionType": "git"}, {"status": "affected", "version": "c447c5a9c47bb4858ab12bf90879fe595d2b7f46", "versionType": "git"}, {"status": "affected", "version": "ab9de9c48316d2622d3bf353916b99971570e2c9", "versionType": "git"}, {"status": "affected", "version": "2fcc9f3798ef82399564d247458e69abd10e683b", "versionType": "git"}, {"status": "affected", "version": "371d8dc298b4f59e99b4564ac5d906fce0932c69", "versionType": "git"}, {"status": "affected", "version": "b26f015dfb07b6be12d005a0ed0c5c43b7bedbf3", "versionType": "git"}, {"status": "affected", "version": "c0b11dc50590e10590b39dcda79835cd32f49d00", "versionType": "git"}, {"status": "affected", "version": "4c12c3c8abd8b888945d31e7bdbb0d8b73032fc5", "versionType": "git"}, {"status": "affected", "version": "25d8e065c7972dc98fd7a4cac322d5367eaede88", "versionType": "git"}, {"status": "affected", "version": "4a855c5aec41bf84922224ab7a74e088776e3ac4", "versionType": "git"}, {"status": "affected", "version": "a9f0407414e16176fdbbbd298c9e18d6dfdf96bc", "versionType": "git"}, {"lessThan": "6.13", "status": "affected", "version": "6.12.16", "versionType": "semver"}, {"lessThan": "6.14", "status": "affected", "version": "6.13.4", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.179", "versionType": "semver"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.130", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.81", "versionType": "semver"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.235", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/dst.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: keep room for the mac header in dst_dev_overhead()\n\nThe seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as\nthe length they are about to push plus dst_dev_overhead(), then push the\nnew headers and rebuild the mac header below them with\nskb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom,\nbut dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device,\n16 bytes for plain Ethernet.\n\nWhere the mac header is longer than that, as it is on ingress through a\nVLAN device with reorder_hdr off, the rebuild runs out of room:\nskb_set_mac_header(skb, -skb->mac_len) computes a negative offset,\nstores it unchecked in the u16 skb->mac_header, and the memmove that\nfollows writes skb->mac_len bytes about 64 KB past skb->head.\nForwarding plain ping6 traffic through such a device reproduces it on\nall five seg6 encapsulation modes and on the rpl and ioam6 inline paths;\nskb->mac_header comes back as 65534 on a 704-byte head.\n\nReturn the larger of the two. The helper already returns skb->mac_len\nwhen it has no dst, so this only makes the other branch agree, and it\ncovers every caller rather than each call site in turn."}], "id": "CVE-2026-98570", "lastModified": "2026-10-19T10:19:15.053", "metrics": {}, "published": "2026-10-18T16:17:09.233", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/36c07127924f11fc5741a780abcaaf808fe9ef13"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: ipv6: keep room for the mac header in dst_dev_overhead()", "id": "2554991", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554991"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: ipv6: keep room for the mac header in dst_dev_overhead()\nThe seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as\nthe length they are about to push plus dst_dev_overhead(), then push the\nnew headers and rebuild the mac header below them with\nskb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom,\nbut dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device,\n16 bytes for plain Ethernet.\nWhere the mac header is longer than that, as it is on ingress through a\nVLAN device with reorder_hdr off, the rebuild runs out of room:\nskb_set_mac_header(skb, -skb->mac_len) computes a negative offset,\nstores it unchecked in the u16 skb->mac_header, and the memmove that\nfollows writes skb->mac_len bytes about 64 KB past skb->head.\nForwarding plain ping6 traffic through such a device reproduces it on\nall five seg6 encapsulation modes and on the rpl and ioam6 inline paths;\nskb->mac_header comes back as 65534 on a 704-byte head.\nReturn the larger of the two. The helper already returns skb->mac_len\nwhen it has no dst, so this only makes the other branch agree, and it\ncovers every caller rather than each call site in turn.", "A flaw was found in the Linux kernel's IPv6 networking subsystem. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending network traffic through an affected IPv6 tunnel interface. Due to insufficient buffer allocation when reconstructing packet headers, an unchecked negative offset triggers an out-of-bounds memory write. This vulnerability can lead to an immediate system crash and potential memory corruption."], "name": "CVE-2026-98570", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98570\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98570\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98570.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dce525185bc92864e5a318040285ee070563fe34,36c07127924f11fc5741a780abcaaf808fe9ef13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[36c07127924f11fc5741a780abcaaf808fe9ef13,87cd6b717e4069dca34e0866e57eaeb44d3b173e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8471e228448a818e4c27cab4b681b2e758e46cf5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c432cd18a07b623651ed15ea167bd303467004cc"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "634710a372ba65bee667c2f6e58a97658c639eab"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c447c5a9c47bb4858ab12bf90879fe595d2b7f46"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ab9de9c48316d2622d3bf353916b99971570e2c9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "2fcc9f3798ef82399564d247458e69abd10e683b"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "371d8dc298b4f59e99b4564ac5d906fce0932c69"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b26f015dfb07b6be12d005a0ed0c5c43b7bedbf3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c0b11dc50590e10590b39dcda79835cd32f49d00"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4c12c3c8abd8b888945d31e7bdbb0d8b73032fc5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "25d8e065c7972dc98fd7a4cac322d5367eaede88"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4a855c5aec41bf84922224ab7a74e088776e3ac4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "a9f0407414e16176fdbbbd298c9e18d6dfdf96bc"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.16,6.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.13.4,6.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.179,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.130,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.81,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.235,5.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-19T00:00:10.774663+00:00", "updated": "2026-10-20T16:45:14.066271+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-122", "CWE-787"]}