CVE-2026-98573

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98573", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.358Z", "datePublished": "2026-10-18T15:18:38.914Z", "dateUpdated": "2026-10-19T09:21:58.681Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:58.681Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\n\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int. The\nfunction does not ensure that max is at least skb_headlen(skb).\n\nThis can happen while parsing IPv6 extension headers when an skb already\nhas a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data\nbeyond the linear area, max - skb_headlen(skb) wraps and is converted to a\nnegative delta. __pskb_pull_tail() then passes that negative length to\nskb_copy_bits(), where it can become a very large copy length.\n\nPass the requested length itself as the pull bound at the three\nextension-header call sites, so the delta can no longer go negative."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "lessThan": "9c4e432132a97b82edf28fa172c39f743e6bfb26", "status": "affected", "versionType": "git"}, {"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "lessThan": "718747afa5463d9cc5fd9a09f03b2a492edd9b78", "status": "affected", "versionType": "git"}, {"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "lessThan": "a0ad0473c09d2e947aecac5c82e637ec85924b12", "status": "affected", "versionType": "git"}, {"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "lessThan": "b2da5ed3d8c75e1b729a21b6d3beaed415e263f6", "status": "affected", "versionType": "git"}, {"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "lessThan": "6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b", "status": "affected", "versionType": "git"}, {"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "lessThan": "cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962", "status": "affected", "versionType": "git"}, {"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "lessThan": "d7f474226809471dc7877435e9c492cc914df0bf", "status": "affected", "versionType": "git"}, {"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "lessThan": "3b4e0b0c008a8c1b474730248cd5b873026c74bd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "3.13", "status": "affected"}, {"version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26"}, {"url": "https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78"}, {"url": "https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12"}, {"url": "https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6"}, {"url": "https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b"}, {"url": "https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962"}, {"url": "https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf"}, {"url": "https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd"}], "title": "net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/skbuff.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9c4e432132a97b82edf28fa172c39f743e6bfb26", "status": "affected", "version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "versionType": "git"}, {"lessThan": "718747afa5463d9cc5fd9a09f03b2a492edd9b78", "status": "affected", "version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "versionType": "git"}, {"lessThan": "a0ad0473c09d2e947aecac5c82e637ec85924b12", "status": "affected", "version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "versionType": "git"}, {"lessThan": "b2da5ed3d8c75e1b729a21b6d3beaed415e263f6", "status": "affected", "version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "versionType": "git"}, {"lessThan": "6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b", "status": "affected", "version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "versionType": "git"}, {"lessThan": "cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962", "status": "affected", "version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "versionType": "git"}, {"lessThan": "d7f474226809471dc7877435e9c492cc914df0bf", "status": "affected", "version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "versionType": "git"}, {"lessThan": "3b4e0b0c008a8c1b474730248cd5b873026c74bd", "status": "affected", "version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/skbuff.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"lessThan": "3.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\n\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int. The\nfunction does not ensure that max is at least skb_headlen(skb).\n\nThis can happen while parsing IPv6 extension headers when an skb already\nhas a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data\nbeyond the linear area, max - skb_headlen(skb) wraps and is converted to a\nnegative delta. __pskb_pull_tail() then passes that negative length to\nskb_copy_bits(), where it can become a very large copy length.\n\nPass the requested length itself as the pull bound at the three\nextension-header call sites, so the delta can no longer go negative."}], "id": "CVE-2026-98573", "lastModified": "2026-10-19T10:19:15.453", "metrics": {}, "published": "2026-10-18T16:17:09.587", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()", "id": "2554955", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554955"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int. The\nfunction does not ensure that max is at least skb_headlen(skb).\nThis can happen while parsing IPv6 extension headers when an skb already\nhas a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data\nbeyond the linear area, max - skb_headlen(skb) wraps and is converted to a\nnegative delta. __pskb_pull_tail() then passes that negative length to\nskb_copy_bits(), where it can become a very large copy length.\nPass the requested length itself as the pull bound at the three\nextension-header call sites, so the delta can no longer go negative.", "A flaw was found in the Linux kernel. An integer underflow in the networking subsystem allows an attacker to trigger an out-of-bounds memory copy by sending specially crafted Internet Protocol version 6 (IPv6) packets with extension headers. This vulnerability can lead to kernel memory corruption, resulting in a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-98573", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98573\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98573\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98573.mbox"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1431fb31ecbaba1b5718006128f0f2ed0b94e1c3,9c4e432132a97b82edf28fa172c39f743e6bfb26)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1431fb31ecbaba1b5718006128f0f2ed0b94e1c3,718747afa5463d9cc5fd9a09f03b2a492edd9b78)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1431fb31ecbaba1b5718006128f0f2ed0b94e1c3,a0ad0473c09d2e947aecac5c82e637ec85924b12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1431fb31ecbaba1b5718006128f0f2ed0b94e1c3,b2da5ed3d8c75e1b729a21b6d3beaed415e263f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1431fb31ecbaba1b5718006128f0f2ed0b94e1c3,6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1431fb31ecbaba1b5718006128f0f2ed0b94e1c3,cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1431fb31ecbaba1b5718006128f0f2ed0b94e1c3,d7f474226809471dc7877435e9c492cc914df0bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1431fb31ecbaba1b5718006128f0f2ed0b94e1c3,3b4e0b0c008a8c1b474730248cd5b873026c74bd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-19T01:00:10.576400+00:00", "updated": "2026-10-20T21:30:17.901022+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}