Cloudanix VulnDB

CVE-2026-98288

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A network driver bug in Linux can cause certain IPv6 connections to fail or crash the system when headers get too large.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Integer truncation of the protocol header length value (stored in u8) during TSO transmission in stmmac_tso_xmit() allows headers between 256 and 1023 bytes to wrap modulo 256, violating the hardware limit check in stmmac_tso_valid_packet().

Why it matters to the business

Network instability or crashes on systems using affected stmmac Ethernet controllers when handling certain IPv6 TCP traffic with large header options, potentially disrupting connectivity and requiring reboots.

How an attack unfolds

An attacker establishes a TCP over IPv6 connection and attaches sticky destination or hop-by-hop options exceeding 255 bytes but below 1023; the truncated length causes malformed TSO packets that the driver mishandles, leading to kernel-level errors.

How to fix it

Apply the upstream fix widening proto_hdr_len to unsigned int and updating the debug print; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Confirm the source change in stmmac_tso_xmit() and stmmac_tso_header_size() handling; test with IPv6 TCP sockets carrying header options >255 bytes to verify no truncation occurs.

Typical attack path

  1. Establish TCP/IPv6 socket to target
  2. Attach large sticky IPv6 header options (e.g., destination/hop-by-hop)
  3. Send data triggering TSO path in stmmac driver
  4. Trigger wrap-around of proto_hdr_len causing invalid packet construction
  5. Induce kernel fault or packet corruption

How to detect it

Review kernel logs for stmmac TSO-related warnings or faults around packet transmission; inspect skb header sizes in network traces for values that would have wrapped.

What your security team should do

  • Prioritize kernel updates for systems using stmmac controllers
  • Monitor for related network driver patches in distribution updates
  • Test IPv6-heavy workloads post-update to confirm stability

The record

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmac_tso_xmit() stores the protocol header length returned by stmmac_tso_header_size() in a u8. stmmac_tso_valid_packet() admits headers up to 1023 bytes, so a header longer than 255 bytes wraps modulo 256 (486 becomes 230, 256 becomes 0). A TCP over IPv6 socket carrying a few hundred bytes of sticky destination/hop-by-hop options makes skb_tcp_all_headers() exceed 255 while staying below the 1023-byte limit, so such an skb reaches stmmac_tso_xmit(). Widen proto_hdr_len to unsigned int, which is sufficient since the value is bounded by the hardware limit, and adjust the debug print specifier accordingly.

Affected packages

Ecosystem Package Introduced Fixed