CVE-2026-98417
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. Use the careful transport-header helper and drop the skb through the existing XFRM error path when the offset cannot be represented.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-10-14 14:17:53.040000
Last modified
2026-10-19 10:18:47.100000
View original CVE JSON
{
"id": "CVE-2026-98417",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-14T14:17:53.040",
"lastModified": "2026-10-19T10:18:47.100",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xfrm: reject unrepresentable espintcp transport headers\n\nESP-in-TCP can hand xfrm packets whose transport header offset no longer\nfits after the stream parser trims the TCP envelope. The plain transport\nheader reset truncates that offset and triggers the skb warning path.\n\nUse the careful transport-header helper and drop the skb through the\nexisting XFRM error path when the offset cannot be represented."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/xfrm/espintcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "d37a5b87577c4b4c1a1dcb000a9dff1df2cf886b",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "6c29681207bc213188afa603dff2d55e7178a341",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "4a8243fd2e21980fa3fd10c0610e9155057cebd3",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "b2b84e73e0386ad0b4f9b8d3afde343e761f5275",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "327b2a457dd7d5445f7395f371f3c65de79bd5ce",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "cce630c751279e974fa0bb574d80575e0cc7e8f3",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "206f396f46149dc8bc4dfd2b54b9879ba3ee1d7d",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "96f01b53c2d05e003b040892256de54a586e8529",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/xfrm/espintcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.6",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.271",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.222",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.189",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.158",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.112",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.54",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.8",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/206f396f46149dc8bc4dfd2b54b9879ba3ee1d7d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/327b2a457dd7d5445f7395f371f3c65de79bd5ce",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4a8243fd2e21980fa3fd10c0610e9155057cebd3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6c29681207bc213188afa603dff2d55e7178a341",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/96f01b53c2d05e003b040892256de54a586e8529",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b2b84e73e0386ad0b4f9b8d3afde343e761f5275",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cce630c751279e974fa0bb574d80575e0cc7e8f3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d37a5b87577c4b4c1a1dcb000a9dff1df2cf886b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}